Privacy Policy

The data controller is Wood Side S.L. (CIF B67595397), Passeig de Gràcia 95, 5º 1º, 08008 Barcelona, Spain — inscribed in the Registro Mercantil de Barcelona, Tomo 47317, Folio 49, Hoja B-548366 — operating the LORQA platform at lorqa.estate.

LORQA is run by its founder, who is the only person with access to member personal data. For anything in this policy, write to privacy@lorqa.estate.

Your account: name and email address, from Google sign-in or an emailed link. Legal basis: contract performance (Art. 6(1)(b) GDPR).

Your application and vetting: the membership you apply for, your professional licence or registry number and its issuing authority, years in practice, your website and professional links, and a short note about your practice. Where your country has no public licence registry — or where you prefer — you may upload a credential document such as a licence or registry certificate. Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b)), and our legitimate interest in confirming that every member is a genuine practising professional, which is the promise the whole platform rests on (Art. 6(1)(f)).

References: we do not ask for referees on the application form. If a particular application needs corroborating, we will ask you first, and we contact a referee only with your agreement.

Your member profile: your name, photograph, professional title, agency, city and country, biography, specialisms, languages, website and social links. See section 9 — this is published in the members’ directory and shown to signed-in members. The properties you list appear separately on public listing pages. Legal basis: contract performance, together with your explicit consent to publication (section 9).

Property enquiries: when a buyer contacts a member, we collect their name, email, phone and message and pass them to that member so they can reply. Legal basis: legitimate interest (Art. 6(1)(f)) — connecting a buyer with the agent they asked for.

Messages between members: stored to run the messaging service. We do not read them except where required to investigate a Code of Conduct report. Legal basis: contract performance.

Support tickets: the subject and content of what you send us, the conversation thread, and factual details of your own membership (your tier, status, verification state and renewal date) so we can answer. See section 5 on the AI assistance involved. Legal basis: contract performance.

Technical data: IP address, browser and device data, and server logs, to operate and secure the platform. Legal basis: legitimate interest.

Member data — profiles, applications, credential documents, listings, messages and support tickets — is stored by Supabase in the European Union (Ireland). It rests inside the European Economic Area. Data is encrypted in transit (TLS) and at rest, and credential documents sit in a private repository that no public request can reach.

Three services necessarily process data outside the EEA: our website delivery network, our email sender, and the AI service described in section 5. They are named in section 4.

We use the following processors, each under a data-processing agreement, and only for the purpose stated. We do not sell your personal data, and we never will.

Transfers outside the EEA rely on the safeguards required by Chapter V of the GDPR — the EU–US Data Privacy Framework and/or Standard Contractual Clauses, depending on the provider. We share your details with a member only when you enquire about their listing.

We use an AI service (Anthropic) as a research assistant in two places. It never makes a decision about you. Anthropic does not use data sent through its API to train its models.

Checking applications. When reviewing your application we may run an AI check. It receives what you submitted — your name, title, agency, contact details, location, licence number and issuing body, website and links, and your note — searches public sources such as professional registries and your own website, and returns a summary of what it could and could not confirm, with a confidence score. A person decides whether to approve, decline, or come back to you with questions, and is free to disagree with it. Your credential documents are never sent to the AI service; we read those ourselves.

Support tickets. An AI assistant sorts your ticket and, for straightforward questions, drafts an answer using only our published help material and the facts of your own membership. Anything touching money, payments, your plan, a verification decision, or a change to your account always goes to a person. If an AI answer misses the mark, one click sends the ticket to a human and no further automated answer is given.

You can object to AI-assisted processing at privacy@lorqa.estate and we will handle your application or ticket entirely by hand. You can also ask a person to review any assessment that affects your membership.

Credential documents: deleted as soon as verification is recorded. We keep the outcome — that your licence was checked, by whom and when — not the document.

Declined applications: the documents and personal details are deleted promptly. We keep only a minimal record that an application was declined and when, so we can be consistent if you apply again.

While you are a member: for as long as your membership is active.

After you leave: your profile, listings, messages and tickets are deleted. Invoices and payment records are kept for the period Spanish commercial and tax law requires (currently six years).

Property enquiries: two years. Vetting decision records: for as long as you are a member, as the evidence that you were vetted.

Under the GDPR you may: access your data; correct it; erase it; take it with you in a machine-readable format; object to processing based on legitimate interest, including AI assistance; restrict processing; and withdraw consent at any time — including consent to publish your profile (section 9), which unpublishes it.

You can delete your account whenever you like: write to privacy@lorqa.estate and we remove your sign-in, profile, listings, tickets, messages and files permanently. We answer any request within 30 days.

This site has no cookie banner because it needs none. We use no analytics, no advertising trackers and no tag managers, and nothing here follows you anywhere.

Signing in sets a session cookie so the platform knows it is you. It cannot work without it.

Choosing a display currency saves that choice in your own browser’s local storage. It never leaves your device.

That is the entire list.

Membership says nothing about your sexual orientation or gender identity, and we never ask. LORQA is open to LGBTQ+ professionals and to allies on exactly the same terms, and allies are a real part of the membership. We do not collect, record or infer data about any member’s orientation or identity. Being listed here therefore does not indicate that a member is LGBTQ+ — only that they met our professional standard and accepted our Code of Conduct.

We say that plainly and on purpose: because membership is open to allies, no conclusion about any individual’s identity can be drawn from their presence on this platform.

Where your profile appears. Once you are approved, your professional profile is published in the LORQA member directory, which is visible only to signed-in members — not to the public, search engines or AI assistants. The properties you list appear separately on public listing pages, shown with your agency’s name and branding but not the profile itself. We ask for your explicit consent before your profile goes live in the directory, because being listed among an alliance of LGBTQ+ and ally professionals is something you should decide knowingly.

What is never shared: your email address, phone number, application, licence number, credential documents and vetting record. Buyers reach you through the platform.

You stay in control. At any time you can withdraw consent, which unpublishes your profile from the directory, or ask to be excluded from the member roster while keeping your own profile page. Use the controls in your account, or write to privacy@lorqa.estate. We will never make you justify it.

If you think we have mishandled your data, please tell us first — we would rather fix it. You also have the right to complain to the Spanish Data Protection Authority (AEPD), www.aepd.es.

We may update this policy. If a change is material we will email registered members rather than quietly change the page. The date at the top always reflects the current version.