← Back

Legal information

Last updated: 10 October 2026

Imprint (Impressum / Aviso legal)

Hipotek is a trading name of RC Dock UMS B.V. (UNIT2).

Hipotek is software for mortgage intermediaries. It does not grant credit and does not itself act as a credit intermediary towards consumers.

Privacy notice

This notice explains how RC Dock UMS B.V., trading as UNIT2 and Hipotek, processes personal data in connection with the website www.hipotek.app and the Hipotek portal at app.hipotek.app.

1. Who is responsible?

Website and broker accounts: RC Dock UMS B.V. (Dockweg 23-H, 1976 CA IJmuiden, The Netherlands; KvK 83945857) is the controller for personal data collected through this website and for the accounts of brokerage firms and their users.

Client data in broker portals: each brokerage firm is the controller for the data of its own clients (for example identity documents, payslips, bank statements and fact-find answers). Hipotek processes that data only on the brokerage's instructions, as processor under a data processing agreement (Art. 28 GDPR). Clients should address requests about their application data to their brokerage first; we will assist the brokerage.

Contact for privacy matters: hello@hipotek.app.

2. Which data do we process?

• Website: technical data needed to deliver the site securely (such as IP address, browser type, requested page and time, in server logs of our hosting provider). The website uses no tracking cookies, no analytics and no external fonts.
• Contact emails: your name, email address, organisation and message when you write to hello@hipotek.app.
• Broker accounts: name, business email address, role, firm details, login and audit-trail data (who did what and when).
• Client data, on behalf of brokerages (processor): identity and contact details, fact-find answers (income, debts, property, household), uploaded documents such as passports, payslips, tax returns and bank statements, values extracted from those documents, messages with the broker, electronic signatures and consents, and audit-trail data.

3. Purposes and legal bases

• Answering contact requests and demo requests: our legitimate interest in following up a business conversation you requested (Art. 6(1)(f) GDPR) or steps prior to entering into a contract (Art. 6(1)(b)).
• Providing the portal to brokerages and their users: performance of our contract with the brokerage (Art. 6(1)(b)).
• Security, abuse prevention, logging and monitoring of availability: our legitimate interest in operating a secure service (Art. 6(1)(f)).
• Compliance with legal obligations, such as tax and accounting rules (Art. 6(1)(c)).
• Client data processed for brokerages: on the brokerage's instructions; the brokerage determines the legal basis.

Documents are read by an AI model only to classify them and extract figures; every extracted value is checked by a broker. Hipotek does not take automated decisions with legal or similarly significant effects: lenders make their own credit decisions. Where processing is based on consent, you may withdraw it at any time; withdrawal has no retroactive effect.

4. Retention

We do not retain data longer than necessary. Contact requests that are not followed up are generally deleted no later than 24 months after collection. Different periods may apply when a customer relationship or statutory retention obligation arises. Security logs are retained for shorter periods unless an incident investigation requires longer retention. Client data in broker portals is kept as instructed by the brokerage under the data processing agreement and is deleted or returned when the brokerage's contract ends, within the period set out in the separate written agreement between RC Dock UMS B.V. and the brokerage. Encrypted backups are kept for 35 days and then deleted automatically.

5. Recipients and sub-processors

We share data only with service providers required for hosting, security, communication and business operations, or where the law requires it. We enter into appropriate agreements with processors.

6. International transfers and safeguards

Application data and documents are stored on servers in the EU. Some providers listed above are located, or may process data, outside the European Economic Area, notably in the United States (Anthropic, Vercel). Transfers outside the European Economic Area rely on appropriate safeguards under Chapter V GDPR, for example the EU standard contractual clauses or the EU-US Data Privacy Framework. Details per provider are available on request at hello@hipotek.app.

7. Security

We apply technical and organisational measures appropriate to the nature of the data, including access restrictions, encrypted connections, encryption of every stored document (AES-256), encrypted disks and encrypted backups, separation of each brokerage's data, logging and controlled changes. Platform administrator accounts have no access to client files. No system is absolutely secure; we therefore review and improve measures periodically.

8. Your rights

You may request access, correction, deletion, restriction, portability or object to processing. You may also withdraw consent. Send requests to hello@hipotek.app. We may request additional information to verify your identity. If your request concerns application data held for a brokerage, we will forward it to that brokerage and support it in responding.

9. Supervisory authority

If you believe we process your personal data incorrectly, please contact us. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Changes

We may update this notice when the website, services or law changes. The latest version is published on this page.

Terms of service

1. Service description and plans

Hipotek is a web portal for mortgage brokers serving foreign and non-resident buyers financing property in Spain: client portal, document checks, broker underwriting support and bank submission packs. Hipotek supports the broker's assessment; it does not grant credit, give financial advice to consumers or submit anything without the broker's review. Services, plans, implementations and support are supplied only under a separate written agreement between RC Dock UMS B.V. and the brokerage.

2. Account and acceptable use

You may not use the website or portal to disrupt its operation, bypass security measures, distribute malicious code, submit unlawful content or process another person's data without authority. Users must keep their login credentials confidential. Rules on suspension of accounts are set out in the separate written agreement between RC Dock UMS B.V. and the brokerage.

3. Data processing agreement

Client data in broker portals is processed on behalf of each brokerage under a data processing agreement (Art. 28 GDPR) concluded with that brokerage as part of the separate written agreement between RC Dock UMS B.V. and the brokerage.

4. Availability and support

We aim to provide a secure and useful service but do not guarantee uninterrupted availability. Functionality may be changed, temporarily restricted or discontinued for maintenance, security or product development. Support channels and any service levels are set out in the separate written agreement between RC Dock UMS B.V. and the brokerage.

5. Fees and billing

Fees, invoicing and payment terms are set out in the separate written agreement between RC Dock UMS B.V. and the brokerage.

6. Liability

To the extent permitted by law, RC Dock UMS B.V. is not liable for indirect loss or for decisions based solely on information shown in the website or the portal. Nothing in these terms excludes liability that cannot be excluded under mandatory law. Any limitation of liability for the portal service is set out in the separate written agreement between RC Dock UMS B.V. and the brokerage.

7. Term, termination and data export / deletion

A brokerage can export its documents, data and audit trail at any time. The contract term, notice period and the deletion period after termination are set out in the separate written agreement between RC Dock UMS B.V. and the brokerage.

8. Intellectual property

Text, design, software, methods, brand names and other content are owned by RC Dock UMS B.V. (UNIT2) or the relevant rights holder and may not be copied, published, reverse-engineered or reused commercially without permission.

9. Governing law and jurisdiction

These terms are governed by Dutch law. Disputes are submitted to the competent Dutch court unless mandatory law provides otherwise.

10. Contact

Questions about these terms may be sent to hello@hipotek.app.