Privacy Policy

1. Information for the User

Who is the data controller for your personal data?

Lumio CRM S.L. is the CONTROLLER of the processing of the USER's personal data and informs you that this data will be processed in accordance with the provisions of Regulation (EU) 2016/679, dated April 27 (GDPR), and Organic Law 3/2018, dated December 5 (LOPDGDD).

• Contact details for exercising your rights: Lumio CRM S.L., Avda. Emilio Castelar 10, 30740 San Pedro del Pinatar (Murcia), Spain. E-mail: support@5minagency.com

Why do we process your personal data?

To maintain a commercial relationship with the user and to provide the services contracted through 5min Agency. The planned operations for processing are:

• Creating and managing your account, providing the functionalities of the platform contracted, and managing the subscription, billing and invoicing associated with it.
• Processing orders, requests, responding to queries or any type of request made by the USER through any of the contact forms available on the CONTROLLER's website.
• Sending of commercial communications by email or any other electronic or physical means that enables commercial communications. These communications will be carried out by the CONTROLLER and will be related to its products and services, or those of its collaborators or suppliers with whom it has reached a promotion agreement. In this case, third parties will never have access to the personal data.
• Sending the online newsletter about news, offers and promotions in our activity.
• Conducting market research and statistical analysis.

On what grounds can we process your personal data?

Because the processing is legitimised by Article 6 of the GDPR as follows:

• Performance of a contract: creating and maintaining your account, providing the contracted services and managing the subscription.
• Legal obligation: issuing and retaining invoices and accounting records in accordance with applicable tax legislation.
• With the USER's consent: sending of commercial communications and the newsletter.
• In the legitimate interest of the CONTROLLER: conducting market research and statistical analysis, ensuring the security of the platform, and processing orders and requests made by the USER.

Whose data do we process as a processor rather than as controller?

5min Agency is used by real estate agencies to manage their listings, contacts, pipeline and marketing activity. Where an agency records the personal data of its own clients and contacts in the platform, that agency is the data controller for that data and Lumio CRM S.L. acts solely as a data processor on its behalf, processing it only in order to provide the contracted service and in accordance with the agency's instructions. If you are a client or contact of one of our agency customers and wish to exercise your rights over that data, please contact the agency directly.

To whom do we disclose your personal data?

No disclosure of personal data to third parties is foreseen, except where necessary for the development and execution of the purposes of the processing, to the service providers listed in section 3, with whom the CONTROLLER has signed the confidentiality and data processor contracts required by current privacy regulations. We do not sell personal data, and we do not use it for advertising purposes.

What are your rights?

If you are located in the European Union or the United Kingdom, you have the following rights under the GDPR and Spain's LOPDGDD:

• Right of access: request a copy of your personal data.
• Right to rectification: request correction of inaccurate data.
• Right to erasure: request deletion of your personal data.
• Right to restriction: request that we limit how we process your data.
• Right to portability: receive your data in a machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent at any time, where processing is based on consent.
• Right to lodge a complaint with the supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es), if you consider that the processing does not comply with current regulations.

To exercise any of these rights, write to support@5minagency.com. We will respond within 30 days.

2. What Data We Collect

2.1 Agency users (agents, administrators)

• Full name and email address, used for login and identification.
• Phone number, optional, used for agent contact cards.
• Profile photo, optional.
• Role and permissions within the agency.
• Login timestamps and session data.
• Activity logs of actions taken within the platform.
• Billing and tax details where a subscription is contracted.

2.2 Property data

• Property details entered by agency users, such as address, price, description and photos.
• Property images uploaded to our storage service.
• Viewing records and open house registrations.

2.3 Contact and lead data

• Name, email address and phone number of property enquirers.
• Nationality, budget and property preferences.
• Communication history and notes entered by agents.
• Consent status and marketing preferences.
• Lead source and scoring data.

This category is the data for which the agency is controller and we are processor, as described above.

2.4 Technical data

• IP address and browser type, for security logging.
• Device type and operating system.
• Pages visited within the platform and feature usage.
• Error logs and performance data.

3. Third-Party Services

5min Agency relies on the following providers to operate. Each processes data in accordance with its own privacy policy:

• Supabase: database, authentication and file storage. Processes all platform data.
• Vercel: application hosting and content delivery. Processes technical logs and IP addresses.
• Stripe: subscription payments. Processes billing details and card data, which is entered directly into Stripe's own fields and never reaches our servers.
• Anthropic: AI text generation. Processes property details and contact summaries submitted to the AI features.
• Google: optional Google Calendar sync. Processes the calendar events we send to and read from the Google Calendar of users who choose to connect it. See section 5.
• Resend: transactional email delivery. Processes recipient email addresses and message content.
• Meta (Facebook and Instagram), LinkedIn and TikTok: optional social media publishing. Process post content and access tokens, for agency accounts that choose to connect them.

4. Social Media Integrations

If an agency connects its social media accounts to 5min Agency, the following applies:

• We store OAuth access tokens in our database, which is encrypted at rest.
• Tokens are used solely to publish content on behalf of the agency, when a user explicitly chooses to post.
• We do not read your messages, followers or analytics beyond what publishing requires.
• Agencies can disconnect their social accounts at any time from Settings.
• Disconnecting revokes the token and we delete it within 24 hours.

5. Google Calendar Integration

Each user of 5min Agency can choose to connect their own Google Calendar from the Calendar page. The connection is optional, belongs to that user only, and can be removed at any time. This section explains what we do with Google user data once a user connects it.

What we access

• The email address of the Google account you connect, so we can show you which account is linked.
• Events on the primary calendar of that Google account. Google sends each event in full, which can include details such as guests and the organiser. We keep only the title, start and end time, whether the event lasts all day, location, description, status, the link to the event in Google Calendar and Google's identifier for the event, and discard the rest without storing it. The first sync reads events from 30 days ago to 180 days ahead; later syncs read only events that were added, changed or deleted since.

We do not access your other calendars, your Gmail, your contacts, your files or any other Google data through this connection.

How we use it

• To add your own viewings and tasks in 5min Agency to your Google Calendar and update them when they change, so your schedule is the same in both places. A viewing you cancel in 5min Agency is removed from your Google Calendar at the next sync. Tasks, and viewings you delete in 5min Agency instead of cancelling, stay in your Google Calendar until you delete them there.
• To show the events you keep in Google Calendar on your 5min Agency calendar, so you can see when you are free before you book a viewing. Only you can see these events. Your colleagues and your agency's administrators cannot.
• A sync runs only when you start it from the Calendar page.

We do not use Google user data for advertising, we do not sell it, we do not use it to train or improve artificial intelligence or machine learning models, and we do not send it to our AI provider.

How we store and protect it

• The access and refresh tokens Google issues are encrypted with AES-256 before they are stored in our database, and they are never sent to your browser. Only our server functions can read them.
• The events we read from Google are stored in our database so we can show them on your calendar. Only you can see them.
• All traffic between 5min Agency and Google is encrypted with HTTPS.

Who we share it with

We do not share, sell or transfer Google user data to anyone. It is processed only by the providers that run 5min Agency on our behalf, Supabase (database) and Vercel (hosting), and only to operate the feature described above. We may disclose it where the law requires us to. Our staff do not read your Google Calendar data, unless you ask us to look into a specific problem and agree to it, or it is necessary for security reasons or to comply with the law.

How long we keep it and how to delete it

• We keep this data while your Google Calendar is connected.
• An event you delete in Google Calendar is removed from our copy at the next sync.
• To disconnect, open the Calendar page, then the calendar settings, and press Disconnect under Google Calendar. This immediately deletes the stored tokens and every Google event we hold for you. Google's identifiers for the events that 5min Agency created in your Google Calendar stay on your viewings and tasks. Encrypted backups that may still contain this data are deleted within 30 days, as described under Data Retention.
• Events that 5min Agency created in your Google Calendar stay there after you disconnect, because they belong to your Google account. You can delete them in Google Calendar.
• You can also remove the access of 5min Agency from your Google Account at myaccount.google.com/connections. After that, syncing stops working and you can disconnect in 5min Agency.
• If your user account or your agency's account is deleted, the connection and all Google data we hold for it are deleted with it.
• You can ask us to delete this data at any time by writing to support@5minagency.com.

Limited Use

5min Agency's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data Retention

• Active accounts: data is retained for the duration of the agency's subscription.
• Cancelled accounts: data is retained for 90 days after cancellation, then permanently deleted.
• Contact and lead data: retained while the agency's account is active. The agency is responsible for its own compliance in respect of that data.
• Backups: encrypted backups are retained for 30 days.
• Security logs: retained for 12 months.
• Invoices and accounting records: retained for the period required by Spanish tax legislation.

7. Cookies

5min Agency uses only technical and functional devices, which are strictly necessary to keep you signed in and to preserve the state of the interface, together with the cookies our payment provider sets on the checkout page. We use no analytical, advertising or tracking cookies. Full detail is in our Cookie Policy.

8. Data Security

In accordance with current data protection regulations, the CONTROLLER complies with the GDPR and the LOPDGDD for the processing of personal data under its responsibility, and with the principles described in Article 5 of the GDPR, whereby data is processed lawfully, fairly and transparently in relation to the data subject, and is appropriate, relevant and limited to what is necessary in relation to the purposes for which it is processed. The measures in place include:

• All data transmitted over HTTPS and TLS encryption.
• Access to the platform controlled by authenticated sessions and role-based permissions.
• API keys and secrets held as environment variables, never in source code.
• OAuth tokens stored encrypted.
• Regular automated backups.
• Access logs for authentication events.

In the event of a data breach affecting your personal data, we will notify affected parties within 72 hours, as required by the GDPR.

9. Children's Privacy

5min Agency is a business-to-business platform intended for use by real estate professionals. We do not knowingly collect personal data from anyone under the age of 18.

10. Mandatory or Optional Nature of the Information Provided

USERS, by ticking the corresponding boxes and entering data in the fields marked with an asterisk (*) in the contact form or presented in download forms, expressly and freely accept that their data are necessary for the provider to meet their request, with the inclusion of data in the remaining fields being voluntary. The USER guarantees that the personal data provided to the CONTROLLER are truthful and is responsible for communicating any modification thereof.

The CONTROLLER informs that the data requested through the website are necessary for the provision of an optimal service to the USER. If all data is not provided, it is not guaranteed that the information and services provided will be completely tailored to their needs.

The CONTROLLER guarantees that it has implemented appropriate technical and organisational policies to apply the security measures established by the GDPR and the LOPDGDD in order to protect the rights and freedoms of USERS, and has communicated the appropriate information to them so that they can exercise them.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the date shown at the top of this page, and notify active agency administrators by email if the changes are material. Continued use of 5min Agency after changes are published constitutes acceptance of the updated policy.

12. Contact

For any privacy related question, or to exercise the rights described above, contact Lumio CRM S.L., Avda. Emilio Castelar 10, 30740 San Pedro del Pinatar (Murcia), Spain, e-mail support@5minagency.com.