Privacy notice

Version: 31 October 2026.

This notice explains what personal data HammerMap (hammermap.com) processes, why, on what legal basis and for how long, under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

1. Controller

• Saba ja Sarved OÜ (registry code 12759581), Toom-Kuninga tn 12-7, 10122 Tallinn, Estonia.
• Email for any data protection question: [email protected].

2. BOE notices

• HammerMap shows public notices of court auctions and sales of state property published in Spain’s Official State Gazette (BOE). These notices may contain data about individuals.
• Our principle is to show the property, not the person. Before we store a notice, we automatically remove the names and DNI or NIE numbers of individuals that we detect in the text. The court and the case number may remain visible. If you still find personal data, ask us to remove it at [email protected].
• Purpose and legal basis: making public information on auctions and sales easier to find, based on legitimate interests (Art. 6(1)(f) GDPR). You can object to this processing (section 11).
• Retention: court auctions are shown for up to 30 days from their publication in the BOE; state sales until the auction date or the bidding deadline has passed; correction notices for 120 days. If the BOE excludes a notice from search engines, we remove it at the next daily update.

3. Visiting the site

• To deliver the pages and protect the site against attacks, our hosting provider Cloudflare processes your IP address and technical connection data, such as your browser and approximate country. Legal basis: legitimate interests in a secure and available site (Art. 6(1)(f) GDPR).
• We use no analytics or advertising tools and do not build visitor profiles.
• To prevent abuse, such as many sign-in link requests in a row, we keep a counter linked to the IP address for no more than one hour.
• Requests to our public API and MCP server are logged without the IP address (time, tool, search parameters, client program and approximate country) to produce usage statistics. This log is deleted after 90 days.

4. Emails you send us

• If you write to [email protected], for example with a question or a removal request, we process your email address, your name if you give it and the content of your message in order to reply.
• Legal basis: providing the service or the steps you ask for (Art. 6(1)(b) GDPR) and, in other cases, our legitimate interests in replying to people who write to us (Art. 6(1)(f) GDPR).
• We send an automatic acknowledgement with a reference number. To avoid sending it more than once, we keep only a cryptographic hash of the sender’s address for 24 hours.
• Retention: we keep enquiries and correspondence for 12 months.

5. Account and sign-in

• Creating an account is optional: you can use HammerMap without signing up. If you wish, you can sign in with Google, with a passkey or with a link we send to your email. We do not use passwords.
• Account data: email address and name (if you sign in with Google or by email), the identifier Google gives us and, if you create a passkey, its public key. Your fingerprint or face never leaves your device.
• A log of every sign-in, including failed attempts: date and time, method, result, approximate country, region and city based on Cloudflare’s network, browser (user agent) and IP address.
• Purpose and legal basis: giving you access to your account as part of the service you ask for (Art. 6(1)(b) GDPR), and protecting accounts against unauthorised access, abuse and fraud, based on legitimate interests (Art. 6(1)(f) GDPR; Recitals 47 and 49 GDPR).
• Retention:
  • IP address: 90 days, then deleted automatically;
  • rest of the sign-in log: 12 months;
  • session: 30 days or until you sign out; email sign-in links expire after 15 minutes and work only once;
  • account data: for as long as you keep the account; you can ask us to delete it at [email protected];
  • unused accounts: if you do not sign in for 24 months, we delete the account and all its data (favourites, alerts and preferences). We warn you by email one month before; if you sign in before that date, the account is kept.

6. Favourites and email alerts

• Favourites: when signed in, you can save auctions with the heart. We store which auctions you saved and when. Legal basis: the service you ask for (Art. 6(1)(b) GDPR). They are kept until you remove them or delete your account.
• Email alerts and reminders: only if you switch them on by ticking the box. We send at most one email a day with new BOE auctions matching the province and property type you chose and, if you switch it on, a reminder before your favourites close.
• Data: your email address, the province and property type chosen, the language, the date and text of your consent, and a log of emails sent (date, type and delivery result).
• Legal basis: your consent (Art. 6(1)(a) GDPR). We keep the date and text of your consent so that we can demonstrate it (Art. 7(1) GDPR).
• You can withdraw your consent at any time with the ‘Unsubscribe with one click’ link in every email or on the ‘My email alerts’ page. Withdrawing is as easy as giving consent and does not affect emails already sent (Art. 7(3) GDPR).
• Retention: for as long as the alert is active. The log of emails sent is deleted after 400 days.
• Our emails contain no advertising and no tracking pixels.

7. Cookies

We use only these first-party cookies:

• __Host-hm_session: keeps you signed in. Duration: 30 days or until you sign out.
• hm_li: tells the page that you are signed in, so that it can show ‘My account’. It contains only the value ‘1’. Duration: the same as the session.
• __Host-hm_oauth: protects Google sign-in against forged requests. Duration: 10 minutes, only during that sign-in.
• lang: remembers the language you choose in the language menu. It contains only the language code. Duration: 1 year.

The first three are set only if you sign in, and lang only if you choose a language in the menu. They serve only to provide the service you ask for, so they do not require consent (Art. 22(2) of Spanish Law 34/2002, LSSI). We use no analytics, advertising or third-party cookies.

8. Interactive map

• The list and the auction pages load no third-party resources. Only if you click ‘Map’ does your browser download the Leaflet library from unpkg.com and the map images from tile.openstreetmap.org (OpenStreetMap Foundation). As with any download, these services receive your IP address and technical browser data.
• Legal basis: legitimate interests in showing the map you ask for (Art. 6(1)(f) GDPR). If you do not want this connection, use the list view.
• More information: OpenStreetMap Foundation privacy policy.

9. Recipients

• Cloudflare, Inc.: hosting and network for the site, the account database and receiving email sent to [email protected].
• Google: Google sign-in, only if you choose it. In addition, email we receive at [email protected] is forwarded to a Gmail mailbox.
• Resend (Plus Five Five, Inc.): sending sign-in links, alerts and other HammerMap emails.
• unpkg.com and the OpenStreetMap Foundation: only if you open the interactive map (section 8).
• We do not sell personal data or share it for advertising.

10. Transfers outside the EEA

• Cloudflare and Resend are based in the US, and Google may process data in the US. Cloudflare, Inc., Google LLC and Plus Five Five, Inc. (Resend) are listed as participants in the EU-U.S. Data Privacy Framework (dataprivacyframework.gov). Transfers rely on the European Commission’s adequacy decision for that framework (Implementing Decision (EU) 2023/1795; Art. 45 GDPR). Resend also uses standard contractual clauses (Art. 46 GDPR).
• The account database is in Cloudflare’s EU location. Resend stores sending data in the US.
• The OpenStreetMap Foundation is based in the United Kingdom and serves map images through a worldwide network of servers; see its privacy policy (section 8).

11. Your rights

• You can exercise your rights of access, rectification, erasure, restriction of processing, data portability and objection (Arts. 15 to 21 GDPR) by writing to [email protected].
• You can object at any time to processing based on legitimate interests (Art. 21 GDPR).
• Where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
• We reply without undue delay and in any event within one month of receiving your request (Art. 12(3) GDPR).

12. Complaints

• You can lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).
• In Spain: Agencia Española de Protección de Datos (AEPD), www.aepd.es.
• In Estonia, where Saba ja Sarved OÜ is established: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, www.aki.ee.

13. Automated decisions

• The risk light assesses the property and the procedure, not people. We do not profile anyone or make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR).

14. Changes

• If we change this notice, we will publish the new version here with its date.