This is an English translation for convenience. The Spanish text, at padrial.com/privacidad, is the one that applies. If anything here is unclear, write to info@padrial.com and we will explain it in English.
Privacy policy for padrial.com
Last updated: 6 October 2026.
This policy explains what personal data we process when a person visits padrial.com or uses its forms, and what we do with it. There are three forms:
- Property developers, to ask for an invitation to Padrial.
- Estate agencies, to put their office on the waiting list.
- Investors, to ask the founders of Padrial to contact you.
Under each form there is a summary of this policy. Other Padrial pages, such as those on pro.padrial.com, have their own privacy policy.
1. Who is the controller
- Controller: THE MANIFEST GROUP, S.L. (in this text, “The Manifest Group”).
- Tax ID (NIF): B75806182.
- Registered office: Av. Principal del Candado 4, 29018 Málaga, Spain.
- Email: info@padrial.com.
- Registered in the Registro Mercantil de Málaga (Málaga Commercial Register), sheet MA-187378, entry 1.
We have not appointed a data protection officer, because the law does not require one for this processing. For any question about your data, write to us at info@padrial.com.
Padrial is today a project of The Manifest Group, until its own company is set up. If The Manifest Group transfers the project as a whole to that company, your data will pass to it, and it will become the new controller (art. 21 LOPDGDD). We will tell you by email before this happens, and you will be able to object or ask us to delete your data. If we have already deleted your data, it will not pass to that company.
2. What data we process
If you only visit the page. We do not ask you for any data. Our hosting provider records, for security, the address you request, your IP address and your browser (see section 4). If you arrive through another person's link, the page looks up which first name to show you. To stop people from trying links at random, we count for 10 minutes how many lookups arrive from your IP address. We keep nothing else about you if you do not send a form.
Data you write in the form. All three forms ask for the same things:
- your name;
- your company, if you want to give it (in the agencies' form, your agency or office);
- your phone number, if you want to give it;
- your email.
The name of a company is not personal data, unless the company is a sole trader or a professional who works under their own name.
Data created when you send the form:
- which form you used (property developers, agencies or investors);
- the language of the page;
- the date and time you sent it;
- the IP address you sent it from;
- your browser and operating system (the “user agent”);
- your personal code, which is in the link you can pass to a colleague (see below);
- if you came through another person's link, that person's code. This tells us who passed you the link;
- if you came through a link from one of the founders, a short tag that shows which link it was (for example, the name of the founder who gave it to you);
- an integrity code for the record: a code (a SHA-256 “hash”) calculated from everything we keep about your request, which lets us detect later whether the record has changed. It is not biometric data and it cannot identify you on its own.
Next to your personal code we also keep your name, the form you used and the integrity code, so that we can show your first name to whoever opens your link.
Temporary counters per IP address. To prevent mass submissions, and to stop people from trying links at random, we count how many requests and how many link lookups arrive from the same IP address. Each counter holds your IP address and a number, and deletes itself after 10 minutes.
What we discuss later. If we later write to each other or talk, we keep what we need to follow up your request: for example, the date of our last contact, or the date we confirmed your place on the list or invited you.
Your link for a colleague. After you send the form, each person gets a personal link to pass to a colleague. You send that link yourself, to whoever you choose: you do not give us your colleague's data. Whoever opens your link will see your first name (the first word of the name you wrote in the form), in a sentence saying that you are sending them this letter. They will see nothing else: not your surname, your email, your phone number, your company or the form you used. If someone forwards your link, the person who receives it will see your first name too. If your colleague uses the link to send their own form, their request will carry your code, and we will know they came through you. We do not tell you whether your colleague has used the link, and we do not give you their data. If you do not want your link to show your name, write to info@padrial.com and we will remove it. If we delete your request, your link stops showing your name.
3. What we use the data for, and on what legal basis
The laws we cite in this policy are Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, “GDPR”), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (“LOPDGDD”), and Spanish Law 34/2002 of 11 July on information society services and electronic commerce (“LSSI”).
| Purpose | Data | Legal basis | Our legitimate interest |
|---|---|---|---|
| Handling your request: reading it, contacting you, answering you and, depending on the form, inviting your company, keeping your office on the waiting list and inviting it, or talking to you as a possible investor. Each request reaches the founders as a notice in an internal messaging channel, with everything you filled in, so that they can answer you. | name, company, phone, email, form, language, what we discuss later | Legitimate interest (art. 6.1.f GDPR). If you write on behalf of a company, or as a sole trader or professional, the law presumes that this processing of your contact data rests on legitimate interest, when the data is used only to reach you professionally and for the relationship with the company, or with you in that capacity (art. 19 LOPDGDD). If you write as a private person, the basis is the same, our legitimate interest, and you can object in the same way. | Answering people who ask us for something, and maintaining relations with the company you work for. |
| Giving you a link for a colleague, and knowing who brings whom and by which routes requests reach us | your personal code; if you came through a link, the code of the person who passed it to you; the tag of a founder's link, if any | Legitimate interest (art. 6.1.f GDPR). | Letting each person bring a colleague, and knowing by which routes requests reach us. |
| Showing your first name to whoever opens your link | your first name | Legitimate interest (art. 6.1.f GDPR). | Letting the person who receives your link know who sent it, as with a signed letter. |
| Keeping a record of the request | date and time, IP address, user agent, integrity code, form, language | Legitimate interest (art. 6.1.f GDPR). | Being able to check what we received and when, and being able to defend ourselves against a claim. |
| Protecting the page and the form against abuse and failures | IP address, user agent, temporary counters, technical server logs | Legitimate interest (art. 6.1.f GDPR). | The security of the page and of the data it receives. |
We only write to you about what you asked for. We write to answer you, to confirm your place and, when the time comes, to invite you, because you asked for this when you sent the form. We do not send you advertising. We never write to a person only because someone else gave us their name: each person writes to us on their own. Every email we send you will tell you how to object to the use of your data, leave the list or ask us to stop writing to you: you only need to reply to that email or write to info@padrial.com. If we ever wanted to send you other commercial communications, we would first ask for your separate consent.
We do not make automated decisions about you and we do not build profiles. People decide who receives an invitation, and when.
Your right to object. Every use in this section rests on our legitimate interest. So you can object at any time to any of them, for reasons to do with your particular situation, by writing to info@padrial.com. We will stop processing your data for that purpose, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims (art. 21 GDPR).
4. How long we keep the data
| Data | Period |
|---|---|
| A property developer's request | 12 months from when you sent the form or from our last contact with you, whichever is later. Then we delete it. If your company signs up to Padrial, the sign-up data follows the sign-up privacy policy. |
| An agency's request (waiting list) | Until we invite your office or you ask us to take you off the list. Then we delete it within 30 days. If 24 months pass from when you sent the form or from our last contact with you, whichever is later, without us inviting your office, we will ask you whether you want to stay on the list. If you do not answer within 30 days, we delete your data. |
| An investor's request | 12 months from when you sent the form or from our last contact with you, whichever is later. Then we delete it. If we reach an agreement, we keep what that agreement needs for as long as the agreement and the law require. |
| Data created when you send the form (date and time, IP, user agent, integrity code, codes, tag of a founder's link), and the copy of your name and form kept next to your code | The same period as the request it belongs to. |
| The notice to the founders in the internal messaging channel | 90 days from when you sent the form. |
| The emails we exchange | The same period as the request. |
| Temporary counters per IP address | 10 minutes. They delete themselves. |
| Technical server logs | The period our hosting provider sets for our plan, 30 days at most. They delete themselves. |
How we delete. Except for the counters and the server logs, which delete themselves, we delete data by hand: when you ask us, and in a review we do once a month. So a piece of data may stay stored for up to one month after its period ends. If you ask us to delete your data, we do not wait for the review.
If we delete your request, we also delete the copy of your name we keep next to your code, and your link stops showing your name. Your code may stay in the request of a colleague who came through your link, but it no longer leads to any data about you.
Blocking. When we delete your data, the law first requires us to block it: we keep it set apart, without using or consulting it, only to make it available to judges, courts, the public prosecutor or the competent authorities, in particular the Spanish Data Protection Agency, if we were held liable for the processing. We keep it like this only while that liability can be claimed, three years at most, and then we destroy it (art. 32 LOPDGDD).
5. Who we share the data with, and where it is
We do not sell your data. We do not give it to anyone to send you advertising.
Who has access. The founders of Padrial, and the people who handle the requests or maintain the page technically on our behalf, have access to your data, all under a duty of confidentiality. If any of them does not work within The Manifest Group, they process the data on our behalf, under a contract that binds them to follow our instructions.
Providers who process the data on our behalf. They only follow our instructions and may not use the data for their own purposes:
| Provider | What for | Where the data is | Transfer outside the European Economic Area, and its safeguard |
|---|---|---|---|
| Vercel Inc. (United States) | Hosting the page and running the form | The page is served from Vercel's network, from the point nearest to you. The form runs in Frankfurt (Germany). What you send passes first through Vercel's network, through that nearest point. | Vercel states that it is certified under the EU-US Data Privacy Framework, which the European Commission considers adequate. Its data processing agreement also includes the European Commission's standard contractual clauses. |
| Upstash, Inc. (United States) | Storing the requests, the codes and the counters in a database | Frankfurt (Germany). Upstash is a United States company, and the data may be accessed from there. | Upstash states that it is certified under the EU-US Data Privacy Framework, which the European Commission considers adequate. |
| Slack Technologies Limited (Ireland) | Telling the founders about each request in an internal channel, with what you filled in. | Slack may store and process messages in other countries, among them the United States. | The European Commission's standard contractual clauses. |
| Our email provider | The info@padrial.com mailbox we write to you from | Our email provider may process data in other countries, among them the United States. | The European Commission's standard contractual clauses or, if Google has adopted one, another recognised transfer solution, such as a data protection framework considered adequate, as Google's data processing addendum says. |
You can ask us for a copy of these safeguards, or for the current list of providers, at info@padrial.com.
Other recipients:
- The people who open your personal link, who will see only your first name (see section 2).
- Our advisers (lawyers, accountants), under a duty of confidentiality, if they need it.
- Judges, courts and authorities, when the law requires us.
- The company to which The Manifest Group transfers the project as a whole (see section 1).
6. Your rights
You can ask us at any time for:
- access: to know what data about you we hold. We will send you a copy of your data, with what we hold about each request;
- rectification: to correct data that is wrong;
- erasure: to delete it. On the waiting list, this is the same as leaving the list;
- objection: to stop processing it, for reasons to do with your particular situation. You only need to tell us why. If we have no strong reason that obliges us to continue, we stop. For example, you can object to us recording who passed you the link, and we then remove that from your request, or to your own link showing your name;
- restriction: to keep it without using it while we deal with a request from you. For example, if you think a piece of data is wrong and want us not to use it while we check;
- portability: if you ask, we send you your data in a commonly used file format (for example, CSV). The law does not oblige us in this case, because we do not process your data on the basis of your consent or for a contract, but we do it anyway.
How to exercise them. Write to info@padrial.com and tell us what you want. To leave the waiting list, or to have your request deleted and not be written to again, just tell us in an email to info@padrial.com, in whatever words you like, in Spanish or English, and from the email you signed up with. If you write from another address, we may ask you to confirm it. If we have other reasonable doubts about your identity, we may ask you for more information to confirm it. We will answer within one month. If your request is complex or we receive many, this period can be extended by two more months, and we will tell you within the first month (art. 12 GDPR). Exercising your rights is free.
Complaint. If you think we are not handling your data properly, you can complain to the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (www.aepd.es). If you wish, you can write to us first at info@padrial.com to try to resolve it, but you do not have to.
7. Do you have to give us the data?
You have no legal obligation to give us your data. Your name and email are necessary: without them we cannot answer you or keep your place on the list. The company and the phone number are optional.
8. Cookies and what your browser stores
This website uses no cookies and no analytics or advertising tools, and it loads nothing from other websites. It stores only the two things explained below in your browser. Neither contains data about you, neither is sent to us, and we use them for nothing else.
| What is stored | Where | What for | How long |
|---|---|---|---|
| “lang”, with the value “es” or “en” | The browser's local storage (localStorage) | Showing you the page next time in the language you chose with the ES / EN button. It is stored only if you press the button. If you do not, the page picks the language from your browser settings and stores nothing for it. | Until you delete it. |
| “padrial-travelled”, with the value “1” | The browser's session storage (sessionStorage) | Playing the page's animation only once per visit. It is stored the first time the animation plays. If your browser asks for reduced motion, the animation does not play and nothing is stored. | Deleted when you close the tab. |
Neither needs your consent (art. 22.2, third paragraph, LSSI). The language choice is a preference you expressly ask for, and it is used only for that. The session mark is technical: it is used only to make the page work as designed. The Spanish Data Protection Agency's guide on the use of cookies gives both cases as examples: a language chosen by the user, and enabling dynamic content, such as an animation. You can delete both at any time in your browser settings.
9. Security
We apply technical and organisational measures suited to the risk:
- the data travels encrypted, between your browser and the page, and between the page and our providers;
- only the people who need the data to handle requests or maintain the page can access it;
- we limit the number of requests and link lookups from the same IP address;
- our providers process the data on our behalf, only following our instructions.
10. Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If the change matters to you, we will tell you by email before it applies.