When you use Credalye’s public contact form, we use the information you provide to receive and respond to your question. The form does not itself authorize a credit pull or automatically send your inquiry to a mortgage lender. If you separately request a provider connection, we explain the relevant data flow before or at the point of collection where required.
Controller and scope
KOVA FINANCE, S.L. (doing business as “CREDALYE”), tax identification number B40536161, with registered office at Calle Felip María Garín 4, planta 1, B2, 46021 Valencia, Spain, is the controller for the processing described in this Policy. Privacy questions may be sent to info@digitaldatacontrol.com.
Because the controller is established in Spain, processing carried out in the context of its activities may be subject to the EU General Data Protection Regulation (GDPR) and Spanish data-protection law even when the visitor is located in the United States. Depending on your state of residence and whether statutory thresholds are met, U.S. state privacy laws may also provide additional rights.
Information we collect
Contact information and inquiry content: for example, your name, email address, the reason for contacting us, and the message you submit. You may also voluntarily include general information about your home-buying or mortgage-planning situation.
Technical information: depending on how the site is configured, servers and service providers may process IP address, browser and device information, timestamps, referral information, and security or diagnostic logs needed to deliver and protect the website.
Preference and local-storage information: the site may use cookies, local storage, or similar technologies for necessary interface or security functions. See the Cookie Policy for the current U.S. build.
Please do not submit Social Security numbers, passwords, full financial-account numbers, tax returns, pay stubs, identity documents, or other highly sensitive records through the public contact form.
The U.S. site is intended for adults seeking mortgage information and is not directed to children under 13. Credalye does not knowingly seek personal information from children under 13 through the public contact form. If we learn that information was collected from a child in circumstances covered by the Children’s Online Privacy Protection Act (COPPA), we will take the steps required by applicable law.
How we use information
We use personal information to receive and answer inquiries, operate and secure the website, troubleshoot technical issues, maintain records needed for legal or security purposes, improve the clarity and usability of our content, and provide a provider connection when you specifically request one and that feature is available.
Where GDPR applies, the legal basis may include taking steps at your request before a service interaction, legitimate interests in operating and securing the website, compliance with legal obligations, and consent where consent is the appropriate basis. Consent can be withdrawn for future processing when the processing depends on consent.
Credalye does not use the public contact form to make a mortgage underwriting or credit decision. A planning calculator is informational; values entered into an on-page calculator may be processed in the browser and are not necessarily transmitted unless the feature expressly says they will be submitted.
Mortgage and provider connections
If you choose to be connected with a mortgage professional or provider, Credalye may disclose the information you intentionally submit for that purpose to the identified or participating recipient. The provider independently determines its application requirements, privacy practices, credit-report authorizations, underwriting, and lending decision.
A public Credalye contact inquiry is not automatically a mortgage application and does not by itself authorize Credalye or a third party to obtain your credit report. If a provider needs credit information or other regulated financial information, the provider is responsible for obtaining the authorization and providing the notices required by law.
Depending on the commercial arrangement and applicable U.S. state law, a provider-related disclosure can be treated differently for privacy-law purposes. Where a law that applies to Credalye treats a disclosure as a “sale,” “sharing,” or use for targeted advertising, Credalye will provide the notice and opt-out method required by that law.
Recipients and international processing
Information may be accessible to Credalye personnel who need it to handle your inquiry and to service providers that support hosting, email, website security, technical operations, or professional advice. Service providers should receive only the access reasonably necessary for their role and should be subject to appropriate contractual or legal obligations.
If you request a mortgage-provider connection, information may be disclosed to the provider or partner identified for that connection. Their privacy notice governs their independent processing once they receive the information.
Credalye is operated by a company established in Spain. Personal information may therefore be processed in Spain or elsewhere in the European Economic Area and may also be processed by service providers in the United States or other countries. Where cross-border transfer safeguards are legally required, Credalye will use the mechanism required by applicable law.
Retention
We keep inquiry information only as long as reasonably necessary to respond, manage follow-up, maintain security and operational records, comply with legal obligations, and establish or defend legal claims. Different categories of information can have different retention periods.
When information is no longer needed for a legitimate purpose, it is deleted, anonymized, or restricted from ordinary use where applicable law requires continued retention.
Your privacy rights
Because KOVA FINANCE, S.L. is established in the European Union, GDPR rights may apply to the processing described in this Policy. Depending on the circumstances, those rights include access, correction, deletion, restriction, objection, data portability, and withdrawal of consent. You may also have the right to lodge a complaint with the competent Spanish data-protection authority.
If a U.S. state privacy law applies to Credalye and to you, you may also have rights such as requesting access to or confirmation of personal information, correction, deletion, data portability, opting out of a legally defined sale or sharing of personal information or targeted advertising, limiting certain uses of sensitive personal information, appealing a denied request where the law provides an appeal, and not being discriminated against for exercising a privacy right.
California residents may have rights under the CCPA, as amended, when that law applies. Covered businesses must honor legally valid opt-out preference signals such as Global Privacy Control for sale or sharing. To submit a privacy request or ask whether a specific state right applies to you, email info@digitaldatacontrol.com. We may need to verify your identity before completing certain requests, and an authorized agent may be asked to provide proof of authority where permitted by law.
Security
Credalye uses reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. We also seek to limit collection of sensitive information that is not needed for the public website.
No internet-connected system can guarantee absolute security. If a security incident occurs, Credalye will assess and respond to it in accordance with applicable legal requirements.
Policy updates
We may update this Privacy Policy when our U.S. services, data practices, providers, or legal obligations change. The version posted on this page is the current version.
Last updated: September 1, 2026.
Questions or privacy requests?
To ask a privacy question or submit a rights request, email info@digitaldatacontrol.com.