InmoNexo
ESPT

← InmoNexo

Privacy policy

1. Data controller

The controller under the GDPR (Regulation (EU) 2016/679) is Magnara Realty S.L., which operates the service under the InmoNexo brand. No data protection officer (DPO) has been designated. Contact for any privacy question or to exercise your rights: soporte@inmonexo.es.

2. Two different roles

Controller of account data (agency, users, billing), of people who write to us through the contact form and of visitors to this website.

Processor (article 28 GDPR) of the data each agency stores in the CRM: clients, owners, buyers, leads, viewings and signed viewing sheets, documents and team chat messages. The agency is the controller of that data and we process it only on its instructions, under the Data Processing Agreement provided to each agency (write to soporte@inmonexo.es if you need it). If you are a client of an agency that uses InmoNexo, please contact that agency to exercise your rights; if you write to us, we will forward your request to it.

3. What data we process, why and on what legal basis

Agency account and users

Agency data (name, tax details, address, phone, email, plan) and user data (name, email, phone, role, office). Passwords are stored only as an argon2id hash and, if you enable two-step verification, the TOTP secret. We log relevant actions and sign-ins (date, user and IP address) for account security. Purpose: providing the service, support, sending service emails (password reset, invitations, account and trial notices) and invoicing. Legal basis: performance of the contract (art. 6.1.b GDPR), legal invoicing obligations (art. 6.1.c) and legitimate interest in service security (art. 6.1.f).

Company sign-up (fraud prevention): when an agency signs up on the website, together with the sign-up data we store the IP address it was sent from, the browser and device (user agent), the date and time and the date on which the terms, the privacy policy and, if ticked, marketing communications were accepted. From the IP we derive an approximate location (country and city) using a database hosted on our own server, without sending it to third parties. The InmoNexo team uses this data only to validate sign-ups and detect fraudulent or duplicate registrations. Legal basis: legitimate interest in fraud prevention (art. 6.1.f GDPR). It is kept for as long as the account record.

Contact form

If you write to us from the Contact page, we process your name, email, phone and agency name (if given), country, subject and message, plus the date and text of your consent, your browser and a hashed fingerprint of your IP address used to limit spam; the IP is not stored in clear. We use them only to answer your enquiry. Legal basis: your consent (art. 6.1.a), which you can withdraw at any time.

Product news

Only if you tick the box when signing up, we will email you InmoNexo news. Legal basis: your consent; you can unsubscribe at any time by writing to soporte@inmonexo.es.

Website visitors

This website does not use analytics or advertising cookies (see the Cookie policy).

4. Where data is stored and who processes it on InmoNexo's behalf

We do not sell or share data with third parties. Property portals only receive the listings each agency decides to publish there. We do not use the WhatsApp Business API: the WhatsApp button on agency websites is a wa.me link and the conversation takes place directly between the visitor and the agency.

Public services used by the application: maps load OpenStreetMap tiles (OpenStreetMap Foundation, United Kingdom, a country with an EU adequacy decision) directly from your browser, which receives your IP address and the map area shown; the custom-domain check queries Google public DNS (dns.google) with the domain name only; Spanish Cadastre (Catastro) lookups are made from our server with the cadastral reference or property address, without personal data. Other than this, data does not leave the European Economic Area.

5. How long we keep data

6. Security

All connections are encrypted (HTTPS/TLS). Each agency's data is isolated in the database with row-level security; sessions use httpOnly cookies; internal access by the InmoNexo team always requires two-step verification (2FA) and agencies can enable it for their users; relevant actions are recorded in an audit log and daily backups are encrypted and stored off the server.

7. Incident notification

If a security breach affects an agency's data, we will notify it without undue delay and in any case within 48 hours of becoming aware of it.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to soporte@inmonexo.es. Agencies can export all their data at any time as a ZIP file from the CRM. If you consider that your request has not been properly handled, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or with the supervisory authority of your country of residence (in Portugal, the Comissão Nacional de Proteção de Dados, cnpd.pt).

9. Changes to this policy

If we change this policy, we will publish the new version on this page with its date and, if the change is significant, we will notify account holders by email.

This English version is provided for convenience; in case of discrepancy, the Spanish version prevails.

Last updated: 20/10/2026