Privacy policy
This policy explains which personal data we process when you request a price, take out an insurance policy or use your client area, why we process it and what your rights are.
Data controller
Compro en España Servicios Inmobiliarios, S.L. (trading as Alveo Seguros), tax ID B98989932, Calle Luis Vives nº 6, 6, 46003 Valencia, Spain. Contact for any question about personal data: rgpd@alveo.co.
Data processed
Identification and contact data (name, email, telephone, country of residence), data needed to calculate the price and issue the policy for the product requested (home, vehicle, letting situation, health-related information for the products that require it), your client account data, and documents you upload to your area. The questions asked in the pricing journey define the only data we collect: we collect nothing beyond what the requested product needs.
Purposes and legal bases
- Preparing your quote, calling you back and taking out your policy: performance of the contract and pre-contractual steps taken at your request (art. 6(1)(b) GDPR).
- Managing your policy, your documents, your claims and your client area: performance of the contract, and compliance with our legal obligations as an insurance distributor (art. 6(1)(b) and 6(1)(c) GDPR, RDL 3/2020).
- Platform security, fraud prevention and improvement of our services: legitimate interest (art. 6(1)(f) GDPR).
- For the products that require it, health-related data is processed on the basis of your explicit consent and solely for the purposes of taking out and managing the policy (art. 9(2)(a) GDPR).
Recipients
Your data is disclosed to Caja de Seguros Reunidos, Compañía de Seguros y Reaseguros, S.A. (Caser), the insurance undertaking for which we are the exclusive agent, in order to issue, manage and settle your policy. Caser acts as controller of its own processing: its privacy policy applies to that processing. Our technical providers (hosting, email delivery, document storage) are also involved, acting as processors and only on our instructions. No data is sold or passed to third parties for advertising purposes.
Data location
Data is hosted in the European Union. Should a provider involve a transfer outside the European Economic Area, it would be covered by the safeguards set out in Chapter V of the GDPR (adequacy decision or standard contractual clauses).
Retention period
Quotes without a policy: your data is kept for as long as needed to handle your request, then deleted or anonymised. Policies taken out: for the whole life of the policy, then for the limitation period of the actions arising from it, that is two years for damage insurance and five years for personal insurance, under article 23 of Ley 50/1980 de Contrato de Seguro. Records with accounting value are kept for six years, under article 30 of the Código de Comercio. Identification records required by anti-money-laundering rules are kept for ten years, under article 25 of Ley 10/2010. These periods match the applicable statutory obligations; where several of them cover the same data, the longest one prevails.
Your rights
You have the rights of access, rectification, erasure, objection, restriction of processing and portability, as well as the right to withdraw your consent at any time where processing is based on it, without affecting the lawfulness of processing carried out beforehand. These rights are exercised by writing to rgpd@alveo.co or to the postal address above, providing proof of identity. Articles 12 to 18 of Spanish Organic Law 3/2018 (LOPDGDD) also grant you specific digital rights.
Complaint to the supervisory authority
If you consider that the processing of your data does not comply with the rules, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.