Privacy notice

Last updated: July 2026

This notice explains how Awesome Content AS ("we", "us"), operator of the Spain Mortgage Calculator platform (the "Platform"), processes personal data. It is issued in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and, where applicable, Spain's Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

1. Data controller

The data controller for personal data processed via the Platform is:

Awesome Content AS (Norway)
Contact for privacy matters: susan@awesomecontent.no or via /contact (select the "Privacy / data protection" subject).

We have not appointed a statutory Data Protection Officer (DPO) as we are not required to under Article 37 GDPR. Privacy enquiries are handled by the operator via the contact form.

2. Personal data we process and why

2.1 Mortgage readiness check & calculators

Answers you enter into the readiness check, mortgage calculator and investment calculator are processed in your browser and stored in your device's local storage so you can resume later. These answers are not transmitted to our servers unless you separately choose to contact us or a broker.

Purpose: allow you to use the tool and resume progress.
Legal basis: performance of a service you have requested (Art. 6(1)(b) GDPR) and, for storage on your device, Article 22.2 of Spain's LSSI (strictly necessary technical storage).
Retention: until you clear browser storage or reset the check.

2.2 General contact form

When you submit the /contact form, we process the name, email address, optional subject, message content, the page path the form was submitted from, your browser's user-agent string, and a salted SHA-256 hash of your IP address (the raw IP is never stored).

Purpose: to respond to your enquiry and to prevent spam and abuse.
Legal basis: our legitimate interest in handling enquiries and protecting the service against abuse (Art. 6(1)(f) GDPR); and where your enquiry is a pre-contractual request, Art. 6(1)(b) GDPR.
Retention: up to 24 months after last correspondence, then deleted or anonymised. Records kept for legal defence may be retained until applicable limitation periods expire.

2.3 Broker partnership inquiry form

The form on /for-brokers is for brokers only. We process the company name, contact name, email, optional phone and website, tier of interest, regions, languages, message, page path, user-agent, and a salted SHA-256 hash of the submitting IP.

Purpose: to evaluate and respond to broker partnership enquiries.
Legal basis: steps prior to entering into a contract at the broker's request (Art. 6(1)(b) GDPR) and our legitimate interest in operating the directory (Art. 6(1)(f)).
Retention: for the duration of any partnership plus 24 months, or 24 months from last contact if no partnership is entered into.

2.4 Referral click measurement

When you click through to a third-party broker, we record the broker identifier clicked, timestamp, page path, user-agent and a salted SHA-256 hash of your IP address. We do not share your readiness answers with the broker.

Purpose: to measure outbound clicks and account for any referral compensation, and to prevent click fraud.
Legal basis: your consent for non-essential measurement (Art. 6(1)(a) GDPR), given via the cookie banner. Where you have not consented, this measurement is not performed.
Retention: up to 24 months in identifiable-hash form; aggregated statistics may be retained longer.

2.5 Analytics

Where you consent, we may process aggregated, pseudonymised usage data (pages viewed, drop-off points in the readiness flow).

Legal basis: your consent (Art. 6(1)(a) GDPR).
Retention: up to 14 months.

2.6 Server logs

Our hosting provider maintains short-term technical logs (IP, timestamp, request path, status code) for security and troubleshooting.

Legal basis: legitimate interest in the security and integrity of the Platform (Art. 6(1)(f) GDPR).
Retention: typically up to 30 days.

3. Cookies and similar technologies

The Platform uses strictly necessary storage plus optional functional, analytics and referral-measurement categories that are only activated with your consent. See our Cookie Policy for the full inventory. You can change your choice at any time via the "Cookie settings" link in the footer. We do not use advertising cookies or cross-site ad targeting.

4. Recipients and processors

We share personal data only with:

Hosting and database providers acting as processors under Art. 28 GDPR, to operate the Platform.
Email delivery providers used to route form submissions to us.
Competent authorities where we are legally required to disclose data.

We do not sell personal data. We do not transfer readiness answers to brokers — you contact them independently after leaving the Platform via a referral link.

5. International data transfers

Personal data is primarily processed within the European Economic Area (EEA). Where a processor operates from outside the EEA, the transfer is protected by an adequacy decision of the European Commission or by Standard Contractual Clauses (SCCs) adopted under Art. 46(2)(c) GDPR, together with supplementary measures as appropriate. You can request a copy of the safeguards via the contact form.

6. Security

We use encryption in transit (HTTPS), access controls, salted hashing of IP addresses instead of raw IP storage, and least- privilege database access. No system can be guaranteed impenetrable; you are responsible for keeping your device and credentials secure.

7. Your rights under GDPR

Subject to conditions in the GDPR, you have the right to:

Access the personal data we hold about you (Art. 15).
Rectification of inaccurate data (Art. 16).
Erasure ("right to be forgotten") (Art. 17).
Restriction of processing (Art. 18).
Data portability for data you provided (Art. 20).
Object to processing based on legitimate interests (Art. 21).
Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).
Not be subject to solely automated decisions with legal or similarly significant effects (Art. 22). Compatibility scoring is an informational estimate; it does not decide access to credit.

To exercise these rights, use the contact form selecting "Privacy / data protection". We may need to verify your identity before responding, and will reply within one month (extendable by two months for complex requests, Art. 12(3)).

8. Right to lodge a complaint

If you believe your data protection rights have been infringed, you can lodge a complaint with a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es. You may also complain to the authority of your EU/EEA country of residence. In Norway the authority is Datatilsynet.

9. Automated decision-making and AI

Compatibility scores between your profile and brokers are calculated from factors you enter and publicly available broker information. Scores are an estimate of profile fit, not a recommendation of the "best" broker and not a credit decision. You independently choose which broker, if any, to contact.

10. Children

The Platform is not directed at children under 16 and we do not knowingly process their personal data.

11. Changes to this notice

We may update this notice to reflect changes to the Platform or legal requirements. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, a notice on the Platform.

12. Platform limitations

All figures shown on the Platform are indicative only and do not constitute financial advice. Final mortgage assessment is conducted by regulated mortgage professionals and lenders.