Privacy Policy
Last updated: January 2025
Who We Are
Handover (handoverpro.co) is a property inspection documentation platform. This Privacy Policy explains how we collect, use, store, and protect personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 on Personal Data Protection (LOPDGDD).
Data Controller contact: legal@handoverpro.co
Data We Collect
Data you provide directly
Agency account holders:
- Full name and agency name
- Email address and password (encrypted)
- Phone number and business address
- Agency logo (optional)
- Payment information (processed by Stripe — we never store card details)
Tenants (via inspection link, no account required):
- Name (provided by the agency)
- Email address (provided by the agency)
- Digital signature (captured during signing)
- Dispute comments (if submitted)
Property data:
- Property addresses
- Room photographs and annotations
- Inspection reports and PDF documents
Data collected automatically
- IP address and browser type (for security and fraud prevention)
- Usage data and session information
- Device type (for PWA optimization)
Legal Basis for Processing
We process personal data on the following legal bases under GDPR Article 6:
- Contract performance (Art. 6(1)(b)): Processing necessary to provide the inspection documentation service
- Legal obligation (Art. 6(1)(c)): Compliance with Spanish tax and commercial law requirements
- Legitimate interests (Art. 6(1)(f)): Security, fraud prevention, and service improvement
- Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies
How We Use Your Data
- To provide and operate the Handover service
- To generate legally formatted inspection reports
- To send transactional emails (inspection invitations, signed reports, payment receipts)
- To process subscription payments via Stripe
- To comply with legal and tax obligations
- To detect and prevent fraudulent activity
We do not sell your personal data to third parties under any circumstances.
Data Retention
Data retention periods are tied to your subscription tier:
| Tier | Inspection data retention |
|---|---|
| Starter | 6 months after inspection date |
| Professional | 5 years after inspection date |
| Agency Plus | 10 years after inspection date |
Account data is retained for the duration of your subscription plus 12 months after cancellation to comply with Spanish commercial law record-keeping requirements.
When an account is deleted, all associated personal data is permanently deleted within 30 days, except where retention is required by law.
Third Parties We Share Data With
We share data with the following third-party processors, each operating under a Data Processing Agreement with us:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database and file storage | EU (Frankfurt) |
| Stripe | Payment processing | EU |
| Resend | Transactional email delivery | EU |
| Vercel | Application hosting | EU |
No data is transferred outside the European Economic Area.
Your Rights Under GDPR
As a data subject you have the following rights, which you can exercise by contacting legal@handoverpro.co:
- Right of access: Request a copy of all personal data we hold about you
- Right to rectification: Correct inaccurate or incomplete data
- Right to erasure: Request deletion of your personal data ("right to be forgotten")
- Right to restriction: Limit how we process your data in certain circumstances
- Right to portability: Receive your data in a structured, machine-readable format
- Right to object: Object to processing based on legitimate interests
- Right to withdraw consent: Where processing is based on consent, withdraw it at any time
We will respond to all requests within 30 days. If you believe your rights have been violated, you have the right to lodge a complaint with Spain's data protection authority, the AEPD (Agencia Española de Protección de Datos) at aepd.es.
Data Security
We implement appropriate technical and organizational measures to protect your personal data including:
- Encryption of data in transit (HTTPS/TLS)
- Encrypted storage via Supabase
- Row-level security ensuring agencies can only access their own data
- Private storage buckets with time-limited access URLs
- Regular security reviews
Children's Data
Handover is a professional B2B service and is not intended for use by persons under the age of 18. We do not knowingly collect data from minors.
Changes to This Policy
We will notify registered users of any material changes to this Privacy Policy by email at least 30 days before changes take effect.
Contact
For any privacy-related questions or to exercise your rights: legal@handoverpro.co