Version 1.0 | Last updated: January 10, 2026
Document required by GDPR (EU) 2016/679 and Spanish Law 10/2010
This document constitutes the Explicit and Informed Consent that you, as a user of the CUANDEORO platform (hereinafter, "the Platform"), must provide freely, specifically, informedly and unambiguously for the processing of your personal data, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, "GDPR"), as well as Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights (hereinafter, "LOPDGDD").
Furthermore, since CUANDEORO operates as an obliged entity within the framework of prevention of money laundering and terrorist financing, the processing of your data is also subject to the provisions of Law 10/2010, of April 28, on the prevention of money laundering and terrorist financing (hereinafter, "Law 10/2010"), and its implementing Regulation approved by Royal Decree 304/2014, of May 5.
For the purposes provided in current data protection regulations, the controller responsible for the processing of your personal data is:
| Concept | Information |
|---|---|
| Company Name | CUANDEORO TECHNOLOGIES, S.L. |
| Tax ID (CIF) | [Pending registration] |
| Registered Office | Spain |
| privacy@cuandeoro.com | |
| Data Protection Officer | dpo@cuandeoro.com |
CUANDEORO is a technology platform that facilitates the purchase and sale of real estate through blockchain technology (specifically, the Stellar network) and smart contracts. To provide our services efficiently, securely and in compliance with current legislation, we need to collect, store and process certain personal data from our users.
This document aims to inform you exhaustively and in detail about:
Regulation (EU) 2016/679, directly applicable in all European Union Member States since May 25, 2018, establishes the fundamental legal framework for the protection of natural persons with regard to the processing of their personal data.
In accordance with Article 4.11 GDPR, "consent of the data subject" means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Article 7 GDPR establishes the conditions for consent, requiring that:
Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights, complements and develops the GDPR in the Spanish legal system. This law establishes specific provisions for data processing in certain sectors and situations, as well as a catalog of digital rights.
Article 6 LOPDGDD regulates processing based on the consent of the data subject, establishing that:
Law 10/2010, of April 28, on the prevention of money laundering and terrorist financing, imposes on obliged entities—among which CUANDEORO is included due to its activity of intermediation in real estate transactions with crypto-assets—a series of due diligence obligations that necessarily involve the processing of clients' personal data.
Article 25.1 of Law 10/2010 textually states:
The convergence of the aforementioned regulations has the following practical implications for you as a user:
| Aspect | Implication | Legal Basis |
|---|---|---|
| Minimum retention | Your KYC data will be retained for 10 years mandatorily | Art. 25 Law 10/2010 |
| Right to erasure | NOT applicable to KYC data during the legal period | Art. 17.3.b) GDPR |
| Restricted access | After 5 years, access only for compliance | Art. 25 Law 10/2010 |
| Mandatory deletion | After 10 years, automatic deletion | Art. 25 Law 10/2010 |
To comply with the formal identification obligations established in Article 3 of Law 10/2010, CUANDEORO will collect the following identification data:
In accordance with Article 4 of Law 10/2010 and Article 4 bis introduced by Royal Decree-Law 7/2021, data will be collected to identify the beneficial owner of operations:
To comply with know-your-customer (KYC) obligations and continuous monitoring of the business relationship established in Articles 5 and 6 of Law 10/2010, the following data will be processed:
In certain circumstances, it may be necessary to process special categories of data according to Article 9 GDPR:
The following processing is carried out in compliance with legal obligations (Art. 6.1.c) GDPR) and does NOT require your consent, being mandatory for the provision of services:
| Purpose | Legal Basis | Retention Period |
|---|---|---|
| Formal customer identification (KYC) | Art. 3 Law 10/2010 | 10 years |
| Beneficial owner identification | Art. 4 Law 10/2010 | 10 years |
| Knowledge of business relationship purpose | Art. 5 Law 10/2010 | 10 years |
| Continuous monitoring of operations | Art. 6 Law 10/2010 | 10 years |
| Special examination of suspicious operations | Art. 17 Law 10/2010 | 10 years |
| Communication to authorities (SEPBLAC) | Art. 18 Law 10/2010 | 10 years |
| Documentation retention | Art. 25 Law 10/2010 | 10 years |
| Tax obligations compliance | General Tax Law | 4-6 years |
The following processing is necessary for the performance of the service provision contract (Art. 6.1.b) GDPR):
The following processing requires your express consent (Art. 6.1.a) GDPR) and can be revoked at any time:
In accordance with Art. 6.1.f) GDPR, the following processing will be carried out based on the legitimate interest of the controller:
The principle of storage limitation established in Article 5.1.e) GDPR
However, this principle must be reconciled with the legal documentation retention obligations imposed by Law 10/2010 and other applicable regulations.
| Data Category | Period | Legal Basis | Observations |
|---|---|---|---|
| Identification documents (KYC) | 10 years | Art. 25 Law 10/2010 | From end of business relationship |
| Beneficial owner information | 10 years | Art. 4 bis Law 10/2010 | From cessation as beneficial owner |
| Transaction records | 10 years | Art. 25 Law 10/2010 | From execution of operation |
| Communications to SEPBLAC | 10 years | Art. 25 Law 10/2010 | From the communication |
| Blockchain wallet addresses | 10 years | Art. 25 Law 10/2010 | Associated with AML operations |
| Invoices and commercial documents | 6 years | Art. 30 Commercial Code | From fiscal year closing |
| Tax documentation | 4 years | Art. 66 General Tax Law | Tax limitation period |
| Granted consents | While valid + 6 years | GDPR + Limitation of actions | Evidence of consent |
| Navigation data (logs) | 2 years | Legitimate interest | Platform security |
| Commercial communications (if consented) | Until revocation | Consent | Can be revoked at any time |
In accordance with Article 25.1 in fine of Law 10/2010, retained documentation will be subject to different access levels depending on elapsed time:
Your data may be communicated to the following authorities and organizations in compliance with legal obligations:
CUANDEORO uses the following data processors, who access your data to provide necessary services:
All data processors have signed the corresponding data processing agreements pursuant to Article 28 GDPR, guaranteeing the confidentiality and security of your data.
Your data may be subject to international transfers to countries outside the European Economic Area in the following cases:
Current regulations recognize the following rights regarding your personal data:
| Right | Content | GDPR Article |
|---|---|---|
| Access | Obtain confirmation of whether your data is being processed and access to it | Art. 15 |
| Rectification | Obtain rectification of inaccurate or incomplete data | Art. 16 |
| Erasure | Obtain erasure of data when certain circumstances apply | Art. 17 |
| Restriction | Obtain restriction of processing in certain cases | Art. 18 |
| Portability | Receive your data in a structured, commonly used format | Art. 20 |
| Objection | Object to processing based on legitimate interest or marketing purposes | Art. 21 |
| Not be subject to decisions based solely on automated processing | Art. 22 |
To exercise any of the indicated rights, you must:
CUANDEORO will respond to your request within one month from receipt, extendable by two additional months in cases of particular complexity.
If you consider that the processing of your personal data violates current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
CUANDEORO has implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, including:
CUANDEORO uses automated systems for money laundering risk assessment, in accordance with the obligations imposed by Law 10/2010. These systems:
In case an automated decision produces legal effects or significantly affects you, you have the right to:
CUANDEORO reserves the right to modify this consent document to adapt it to legislative, jurisprudential or business practice developments. In case of substantial modifications, you will be notified through the contact means provided, requiring new consent if necessary.
It is recommended to periodically review this document, the updated version of which will always be available on the Platform.
This consent document is governed by Spanish law and, in particular, by:
For any dispute that may arise from the processing of your personal data, the Courts and Tribunals of the user's domicile shall have jurisdiction, in accordance with consumer protection regulations.
You have reached the end of the document. You may now proceed to grant or deny your consent.
Last updated: January 10, 2026
By clicking "I ACCEPT AND GRANT MY CONSENT", the date, time, your IP address and the version of the accepted document will be recorded as proof of granted consent.
