Privacy policy

Sky Financial Services undertakes to adopt technical and organisational measures appropriate to the risk of the data collected. This policy respects, among others:

• Regulation (EU) 2016/679 (GDPR).
• Spanish Organic Law 3/2018 (LOPDGDD).
• Spanish Law 34/2002 (LSSI-CE), where applicable to information society services.

Unless the GDPR Art. 30(5) exception applies, a record of processing activities is maintained by purpose and other GDPR requirements.

• Legal name: SKY REAL ESTATE & FINANCIAL SERVICES, S.L. (formerly Finanzas del Cielo, S.L.).
• Tax ID (NIF): B87851150.
• Registro Mercantil de Madrid, tomo 36104, folio 74, hoja M-648701.
• Registered address: Avenida Manuel Fraga Iribarne 38, 1.ª planta, oficina 3, 28055 Madrid, España.
• Trading name: Sky Financial Services.
• Website: https://skyfinancialservices.es.
• General email: madrid@skyfinancialservices.es.
• National phone: +34 684 46 79 05.

For privacy rights or queries: gdpr@skyfinancialservices.es. Postal address: Avenida Manuel Fraga Iribarne 38, 1.ª planta, oficina 3, 28055 Madrid, España.

No Data Protection Officer (DPO) is publicly appointed at this time. If one is appointed, this policy will be updated.

• Lawfulness, fairness and transparency: processing on a suitable legal basis with clear information.
• Purpose limitation: specified, explicit and legitimate purposes.
• Data minimisation: only what is needed for those purposes.
• Accuracy: accurate and, where necessary, kept up to date.
• Storage limitation: kept only as long as needed (and for legal duties).
• Integrity and confidentiality: appropriate security.
• Accountability: the controller must be able to demonstrate compliance.

We mainly process identity and contact data, economic and employment data you provide for case review, and technical browsing data (IP, device, logs) as needed.

We do not routinely request special categories under GDPR Art. 9. If a specific case required health or other special-category data, we would ask explicitly on a suitable legal basis.

We process data mainly in these contexts:

• Browsing and technical security (logs, necessary cookies).
• Lead / case-review / calculator forms (name, phone, email, operation type and any data you volunteer).
• Intermediation relationship after you sign an engagement (credit documentation, lender communication, case file).
• Complaints handling and rights requests.
• Analytics and online ads only with non-essential cookie consent (see cookie policy).

• Pre-contractual steps / contract (Art. 6(1)(b)): reviewing your case, contacting you and providing intermediation where applicable.
• Consent (Art. 6(1)(a)): analytics/ads cookies; commercial messages if offered and accepted. You may withdraw consent as easily as you gave it.
• Legitimate interests (Art. 6(1)(f)): site security, abuse/fraud prevention, basic service improvement, legal defence — balanced against your rights.
• Legal obligation (Art. 6(1)(c)): where credit, AML or other rules require retention or disclosure.

When we collect data via a form, we will inform you of the specific purpose(s). Data may also support operational customisation and service statistics aligned with our intermediation activity, within the bases above.

Data may be accessed, only as needed, by:

• Authorised staff at Sky Financial Services / Sky Solutions Group handling your case.
• Group companies involved in the case circuit where needed (e.g. group legal or real-estate support), under the same confidentiality and a suitable legal basis.
• Lenders and technical intermediaries needed to present your application.
• Processors under GDPR Art. 28 contracts (hosting, SkyKnect CRM, email, analytics if consented, support tools).
• Authorities where legally required.

We do not sell your data. Any future transfers outside the EEA would be disclosed with appropriate safeguards.

• Leads without a formal engagement: as needed to handle the request plus a reasonable period thereafter (indicative up to 24 months), unless earlier erasure is required and no other basis applies.
• Intermediation files and contractual documents: for the contractual relationship and applicable legal/tax retention periods (often several years after closure).
• Cookies: per category (see cookie policy).
• Complaints and rights requests: as needed to handle them and evidence compliance.

You may exercise the rights under the GDPR and LOPDGDD against the controller:

• Access: confirmation whether we process your data and information about it and the processing.
• Rectification: correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): where legally applicable.
• Restriction: in the cases under GDPR Art. 18.
• Portability: receive your data in a structured, commonly used format and transmit it to another controller where processing is based on consent or contract and is automated.
• Objection: to processing based on legitimate interests or to direct marketing, where applicable.
• Rights relating to automated individual decision-making (GDPR Arts. 15–22), where applicable.

Email gdpr@skyfinancialservices.es or write to the controller’s postal address, referencing “GDPR – Sky Financial Services”, with your identity and request. We may ask for additional ID only when needed to verify identity. Representatives must evidence authority.

Response time: one month, extendable by up to two further months for complex cases with notice (Art. 12 GDPR).

• AEPD — Exercise your rights ↗
• Complaint to the AEPD ↗

Mortgage intermediation is aimed at adults with capacity to contract. Under LOPDGDD, consent-based processing of under-14s requires parental/guardian authorisation. We do not intentionally collect children’s data via lead forms.

We apply technical and organisational measures appropriate to risk (HTTPS/SSL in transit, access control, minimisation, staff and processor confidentiality). No system is fully invulnerable.

High-risk personal-data breaches would be notified without undue delay as required by the GDPR (Arts. 33–34).

The Website may link to third-party pages we do not operate. Those operators have their own privacy policies and are responsible for their processing. Read them before providing data.

If you believe processing infringes the rules, you have the right to an effective judicial remedy and to lodge a complaint with a supervisory authority, in particular in your habitual residence, place of work or place of the alleged infringement. In Spain: Agencia Española de Protección de Datos (https://www.aepd.es/).

You should read and agree with this Privacy Policy for the processing described. Use of the Website implies awareness of it; where a specific processing requires consent, we will ask explicitly (e.g. non-essential cookies or commercial messages).

We may update this policy for legal, case-law, AEPD or operational changes. The update date appears at the top of the page. Check it periodically. Where a change requires fresh consent, we will ask for it.