Privacy policy

01Who is the data controller

The controller of the data you provide to us through this website is NM Servicios Inmobiliarios 2026, S.L., which provides this service under the trade name “luzgasia”. These are its identifying details:

For any question about privacy, including the exercise of your rights, you can write to us at info@luzgasia.com.

02What data we process

Contact details that you provide to us: name, email, telephone, postal code and type of customer.

Your electricity or gas bill and the data extracted from it: account holder, CUPS, supply address, current retailer, contracted power, tariff, consumption, billing period and amounts. If you prefer not to upload your bill, you can instead give us your consumption, your contracted power and what you pay, or your CUPS (the code of your supply point).

If you compare using your CUPS and give us permission to check that the supply is yours: the number of your DNI, NIE or CIF, which you type in yourself (never a photograph), and the result of that check. If the answer is yes, also the official contracted power and consumption of that supply point.

Technical data: the IP address and the browser from which you accept each permission and from which you sign. We keep them precisely so that we can evidence what you accepted and when. We also keep the IP address from which you start your request, to prevent fraud and automated submissions.

If you decide to contract: your DNI/NIE (the number and a photograph of both sides), your bank account (IBAN), your signature and, where relevant to your case, the CIF and registered name of your company, the title deed or rental contract showing that you are entitled to contract that supply and, if you are changing the account holder, the document number of the previous holder, which we check with the distribution company. We do not ask for them beforehand, and when we do ask for them we tell you what for. The IBAN is used solely to set up the direct debit for the supply you contract: it is neither shared with third parties outside the registration process nor used for any other charge.

If one of our collaborators handles your registration: they can open a file in your name with your contact details and your bill (or your consumption data), after you have asked them to. Before opening any file, whoever handles your registration (one of our collaborators or our office) can save your contact details in a record in your name (name, email, phone number, whether you are an individual, self-employed or a company and, where applicable, your trading name or company name); your DNI, your CIF and your bank account are only requested within a file with a tariff to offer you. Once the file contains the necessary data, we write to you so that you can review it, and nothing is processed until you authorise it and sign it yourself from the link we send you by email (the collaborator can also get it to you themselves, for example by WhatsApp). If the file is never completed, you do not reply or you object, we destroy the data they gave us (the time limits are in section 6).

If you ask us directly to prepare your switch — by phone, at our office, by email or via WhatsApp — or someone else asks us on your behalf (for example, the owner of the property, a relative or your administrative agency), our team opens a record in your name with your contact details and a file for each supply, with your bill or your consumption data, and notes the name of the person who asked us. If your data is given to us by someone else, we tell you so in the first email. Nothing is processed until you authorise it yourself: from the link we send you, here at our office on one of our devices (after first checking your DNI) or by signing the printed document by hand.

If you came through a recommendation: if you arrived through a collaborator's link or through another customer's invitation (our “Invite and earn” programme), we record who recommended you so that we can pay them their commission or grant them their coupon if you contract. That person does not receive your data: they only see that someone who arrived through their link moved forward or signed a contract, without your name or your contact details.

Which campaign you came from: if you visit the website from one of our campaigns (an ad, an email or a promotional link), the page address carries some tags that say which campaign you came from: the parameters beginning with “utm_” and, in Google ads, “gad_source” and “gad_campaignid”. They identify the campaign, not the person. We read them, they are carried over in the internal links as you browse — so that they are not lost when you change page or language — and, if you request your analysis, we store them with your request.

The ad click identifier: if you arrive from a Google or Microsoft ad, the platform itself adds an identifier for that click to the address (“gclid”, “gbraid” or “wbraid” on Google; “msclkid” on Microsoft). It does not tell us who you are, but the platform can link it to the click you made, so we treat it with extra care: it only travels in the link that takes you from the page you landed on to the analysis, not around the rest of the website; it is only stored in your browser if you accept the optional cookies (the “lg_campana” cookie, 30 days); and, if you request your analysis, we store it with your request while you decide whether to let us report your outcome to that platform (section 3). If you say no, we delete it at that very moment; if you say yes, we keep it for the period set out in section 6.

Website usage measurement (without cookies): to know how many people view the public pages and the comparison tool, and how they move between pages, we record on our servers a pseudonymous identifier — a fingerprint encrypted with a key held on our server, calculated from your IP address and your browser — together with the date and the public pages you visit. When you arrive from a campaign, that visit is counted with a fingerprint that changes every day, so that your visits on different days cannot be linked to one another. We do not use cookies or any storage on your device for this, we do not use it to identify you and it is automatically deleted after 6 months. Legal basis: legitimate interest in measuring and improving our own service (art. 6.1.f GDPR).

Security logs: to protect the website against abuse (attempts at unauthorised access, automated submissions, attacks), we record the IP address and the technical data of suspicious requests, and we may temporarily block an address. Two external services, which we explain in section 5, help us with that protection: Cloudflare Turnstile, in the forms, and the CrowdSec security network.

If you write to us: through the contact form or at info@luzgasia.com, we process your name, your email, your telephone number if you give it to us, your message, our replies and, in the case of the form, the IP address you write from.

If you are a collaborator: your name, your email, your phone number, your password (stored in such a way that not even we can read it) and, if you enable two-step verification, its key, encrypted; to assess your application, what you tell us about your professional profile when you register (what you do, your experience, whether you have a client base, how you plan to bring in clients, which clients you want to work with, what you expect from the collaboration and how you heard about us); to verify your account, both sides of your DNI or NIE, proof of your activity as a self-employed person or of your company, and your declaration; to pay you, the bank account into which we pay you, who its holder is (self-employed or company), your NIF, NIE or CIF and the IRPF withholding you declare to us; your links, the registrations we attribute to you and your commissions. In the ranking among collaborators you appear under an alias.

Your cookie choice: we record whether you accepted or rejected the optional cookies, with a random identifier that is also kept in your browser, the version of the cookie policy and the date. We do not store your IP address or your browser with it. This allows us to prove what you decided.

03What we use your data for and on what legal basis

We do not create advertising profiles or use your data to show you personalised ads.

We do not use a single legal basis for everything. Each purpose has its own, and that changes what you can decide:

• Analysing your bill (or the data you give us), calculating your savings and showing you the result: we do this because you have asked us to, as a step prior to a possible contract (art. 6.1.b GDPR). We do not need your consent for this, but you can ask us to delete your data whenever you wish.
• Writing to you by email about your analysis and whatever is needed to continue with it (for example, the link to access your area if you decide to contract): it is part of the service you have asked us for (art. 6.1.b GDPR).
• Helping you complete a contracting process you left halfway: if you created your account and did not finish the process, we may contact you to sort out whatever is missing. This is the performance of what you yourself started (art. 6.1.b GDPR), not a sales call.
• Checking with your distribution company that the supply is yours (only when comparing by CUPS): with your consent (art. 6.1.a GDPR), which is optional. Without it we calculate from what you tell us and we do not show you any data about the supply.
• Sending you offers or calling you to sell you something: only with your express consent (art. 6.1.a GDPR), which is optional, separate and revocable at any time. Not ticking it changes nothing about your analysis.
• Calling you to explain the assessment of your supply or to look into a case for which we have no published tariff: only if you expressly request it by ticking the corresponding box, on your result screen or, if you give us your details without uploading your bill, in the permissions step. It is your consent (art. 6.1.a GDPR), which you can withdraw at any time, and, at the same time, the prior request that electricity sector regulations require for a call. We do not conclude contracts by phone.
• Managing your contracting and the switch of retailer: performance of the contract and of the authorisation you sign (art. 6.1.b GDPR).
• Assessing applications to become a collaborator, running the collaborators programme and paying their commissions: steps taken at your request prior to the agreement and performance of the collaboration agreement (art. 6.1.b GDPR), and compliance with our accounting and tax obligations, such as applying IRPF withholding to the payments of a self-employed collaborator and paying it over to the Spanish Tax Agency (art. 6.1.c GDPR). Recording who recommended you, so that we can reward them: legitimate interest in honouring our referral programme (art. 6.1.f GDPR).
• Protecting the website and preventing fraud: legitimate interest (art. 6.1.f GDPR). This includes comparing the IP address and browser from which an authorisation is signed with those of the collaborator handling that file or, if our office prepares it, with the addresses from which the office works, in order to detect signatures that were not made by the account holder.
• Handling the messages you send us: you write to us, and we process your data in order to reply to you (legitimate interest, art. 6.1.f GDPR).
• Knowing which campaigns work: we link your request to the campaign you came from in order to calculate how many requests and contracts each campaign brings in and how much each contract costs us. Only in our internal reports: we do not disclose it to anyone. Legal basis: legitimate interest in measuring the effectiveness of our own advertising (art. 6.1.f GDPR). You can object at any time, and we will remove that data from your request without deleting the request.
• Telling the platform you came from how far your request got: only if you arrived from a Google or Microsoft ad, and only if you give us your permission for that specific platform (art. 6.1.a GDPR): one per platform, optional, not ticked in advance and revocable. Without it we disclose nothing to that platform and we delete the click identifier. What we disclose to it is set out in section 5.

04A 100% online service: when we contact you

The entire process with us — analysis, proposal, documentation and signing your authorisation — is carried out from the website: you do not need to speak to anyone or wait for us to call you in order to move forward.

There are three exceptions. The first is to help you: if you have created your account and have left the contracting process halfway, we may get in touch with you to complete what is missing. If you would rather we did not, tell us and we will not contact you again.

The second: if you have asked one of our collaborators to handle your registration, it is they who assist you.

The third: if you ask us to prepare it ourselves — by phone, in person, by email or via WhatsApp — or someone else asks us on your behalf, we assist you through that channel.

Apart from those cases, we do not make sales calls to anyone who has not expressly requested them by ticking the corresponding box. It is our own decision and it is also what the electricity sector regulations require.

05Who we share your data with

We do not sell your data. It only reaches those who are needed to provide you with the service, those to whom you expressly authorise us to disclose it or those to whom the law requires us to disclose it:

For the automatic reading of the documents you provide we work with two artificial intelligence providers, which act as processors on our instructions and under the contract required by Article 28 GDPR: Google LLC (United States), which is the one we normally use, and Anthropic PBC (United States), which we turn to only if the reading fails because of a service failure — an outage, a timeout or a provider error; in that case the document is sent to Anthropic to be read instead of by Google. We never send it to both to compare readings. If we change provider, we will update this policy beforehand, and our internal records show which provider read each document.

• Automatic reading of your bill: the image or PDF you upload is sent to one of those two providers in order to extract its data (account holder, CUPS, supply address, contracted power, tariff, consumption, period and amounts). They process it solely in order to return that reading to us, and neither of the two uses your data to train or improve their models: the terms we have agreed with them expressly exclude it.
• Automatic reading of your identity document: it is optional and we only carry it out if you give us a specific permission, which we ask you for in your private area when this feature is available. With that permission, the photograph of the DNI, NIE or passport that you upload when contracting is sent to Google (and, only if that reading fails because of a fault, to Anthropic, just as with the bill) so that it can propose your first name, your surnames and your document number already filled in, which you then confirm or correct, with the same safeguards as the reading of the bill. Without that permission, no image of your document leaves our systems and you type that data in yourself.
• Transfers outside the European Economic Area: both providers are established in the United States, so sending them a document entails an international transfer of data. These transfers are covered by the safeguards of Chapter V GDPR: the standard contractual clauses approved by the European Commission (art. 46.2.c) and, for the providers that adhere to it, the adequacy decision of the EU-US Data Privacy Framework (art. 45). You can ask us for a copy of those safeguards by writing to info@luzgasia.com.
• The calculation of your savings is carried out entirely on our own systems: no third party receives your data in order to compare it.
• Ownership check (comparison by CUPS): only with your permission, your CUPS and your document number are sent to one of the retailers we work with for this query (Gana Energía or Naturgy), which asks your distribution company whether that document is registered as the holder of that supply point. The answer is yes or no and, if it is yes, it comes with the contracted power and consumption of the supply point. No registration is made and your contract is not modified.
• If you decide to contract: the retailer you choose and the distribution company receive the data that is essential to process the registration. You will see the name of that retailer before signing anything.
• Collaborators: if a collaborator handles your registration because you asked them to, they see the data in your file — including your full DNI and IBAN — while they are handling it, so that they can complete it with you. Once they finish handling it, or if you withdraw it, they can no longer see that data.
• Advertising platforms, only with your permission for that platform: Google Ireland Limited (Google Ads), if you arrived from one of our ads on Google, and Microsoft Ireland Operations Limited (Microsoft Advertising), if you arrived from one of our ads on Microsoft (Bing). What we disclose to them: the click identifier that the platform itself placed in the page address, the date and time of the outcome, what the outcome was (that we analysed your bill with a savings figure, that we sent you the contract or that your registration became active), a reference code that has no meaning of its own and is different for each outcome (where the platform supports it) and, where applicable, an economic value reflecting what that outcome is worth to us, never what you save or what you pay. Never your name, your contact details, your bill, your DNI or your IBAN.
• What the platform uses it for: to attribute that outcome to the click on our ad, to give us reports on how many outcomes each ad brings in and to adjust the delivery of our campaigns. We instruct it not to use this data to personalise ads for you. Each platform processes that data as a controller, in accordance with its own privacy policy. What each one does with the data it receives from its advertisers: Google, https://policies.google.com/technologies/partner-sites · Microsoft, https://privacy.microsoft.com/privacystatement. Google Ireland Limited and Microsoft Ireland Operations Limited are established in the European Union; if they process the data outside the European Economic Area, they do so with the safeguards they describe in that information.
• If you reach the website from an ad on any other platform or social network, we only record which campaign you came from (section 2): we disclose nothing to that platform.
• Technology providers, which act on our behalf and under a data processing agreement: website and database hosting, Hetzner Online GmbH, in data centres located in Germany; and email (the sending of our emails and the info@luzgasia.com mailbox), Google Workspace, provided by Google Ireland Limited, which may process data outside the European Economic Area with the safeguards of Chapter V GDPR (standard contractual clauses and the EU-US Data Privacy Framework).
• Help videos in the collaborators area: they are loaded from YouTube (Google) only when you press play. We explain this in the cookie policy.
• The domain luzgasia.com is registered with Cloudflare, Inc., which also manages its name servers (DNS). The website's traffic does not pass through Cloudflare: the only thing Cloudflare receives is what we explain in the next point.
• Protection against automated submissions: on the contact form and on the sign-in screens for the customer and collaborator areas we use Cloudflare Turnstile, provided by Cloudflare, Inc. (United States), which checks that whoever is using the form is a person and not an automated program. To do so, your browser connects to Cloudflare, which receives your IP address, technical data about your browser and your connection, and the page from which the check is made; it does not receive what you type in the form. Cloudflare processes that data on our behalf and, in order to improve its own detection of automated programs, also as a controller, in accordance with its policy: https://www.cloudflare.com/turnstile-privacy-policy/. The transfer to the United States is covered by the EU-US Data Privacy Framework (art. 45 GDPR) and by the standard contractual clauses (art. 46.2.c). Legal basis: legitimate interest in protecting the service against abuse (art. 6.1.f GDPR).
• Collaborative security network: our server uses CrowdSec, provided by CrowdSec SAS (France). When a connection triggers one of its attack alerts (for example, repeated attempts to get in without permission or to look for weaknesses in the website), we share with CrowdSec the IP address of that connection, the type of alert and the date; in return we receive its list of addresses that are attacking other servers, so that we can block them before they reach us. We share nothing about people who use the website normally. CrowdSec and we are joint controllers of that processing; its policy: https://www.crowdsec.net/privacy-policy. Legal basis: legitimate interest in the security of the website (art. 6.1.f and Recital 49 GDPR).
• Spanish Tax Agency (Agencia Tributaria): if you are a collaborator, we report to it what we have paid you and, if you are self-employed, the IRPF withholding we have applied to you, with your name and your NIF, when tax regulations require us to do so (art. 6.1.c GDPR).

06How long we keep each thing

We do not keep anything just in case. These are the periods, and we also tell you when deletion is approved by a person rather than happening automatically:

• Your uploaded bill: 30 days from upload, and only 24 hours if you did not go on to complete the analysis. If the analysis fails, we may keep it for up to 7 days to review why it failed. If it is provided by a collaborator or by our office in a file in your name, it is kept while the file awaits your reply: at most 7 days while the collaborator prepares it and, after that, up to 30 days from the last notice we sent you (or from when they completed your details, if you have not yet received any). It is destroyed as soon as you object or that period expires without a reply.
• The record with your contact details opened by a collaborator or by our office: while they have any file of yours in progress. If they have none, 7 days at most; and if you object, do not reply or withdraw the handling, it is destroyed at that moment.
• The document number used for the ownership check: 30 days. We keep the answer (yes or no), its date and which retailer carried out the check, because it is the evidence that the check was made.
• The data of a request that does not lead to a contract (your contact details, what was read from your bill and your analysis): it is not deleted automatically. Every month we prepare a proposal to delete the requests and accounts with no activity in the last 30 days, which a person on our team reviews and approves; and any that are still there are reviewed for erasure once 12 months have passed since your last contact.
• Your DNI, your IBAN and the contracting documents: 90 days from the formalisation of the registration, and 7 days if you never completed it. Once that period has passed, their deletion is approved and carried out by a person on our team.
• If you did contract: the data of the relationship is kept for as long as it lasts and thereafter for as long as legal and tax obligations require.
• The record of your permissions: for as long as we keep your request or your account and, if you contract, for as long as the relationship lasts and for 3 years thereafter, because it is the evidence that we acted correctly.
• Which campaign you came from: for as long as we keep your request, unless you object before then.
• The Google or Microsoft click identifier: if you never get as far as deciding whether to give us permission, 24 hours; if you say no or withdraw your permission, we delete it at that very moment; with your permission, 90 days from the click, which is the period during which the platform accepts it. After that time we keep only the fact that you arrived from an ad on that platform, never the identifier.
• The record of what we disclose to a platform: it is deleted together with your request. If you ask us for erasure after we have disclosed it, we keep only the reference code with no meaning of its own (no data of yours) for as long as necessary to ask the platform to withdraw it.
• The “lg_campana” cookie: 30 days in your browser. Your cookie choice: 400 days (about 13 months) in our records.
• Usage measurement and campaign visits: 6 months.
• Contact messages and their replies: 2 years, the usual period for a consumer complaint.
• Security logs with IP addresses: 90 days. The record of the addresses we block for abuse is kept so that we can detect whether that abuse is repeated; a temporary block stops applying as soon as it expires. What we share with CrowdSec is kept by CrowdSec in accordance with its own policy.
• Collaborator data: for as long as you keep your account. When you close it, we delete your personal data and your documents, and we keep the commission history without them, because it is an accounting record that we are obliged to retain. The only exception is what we have already paid you: your name, your NIF, the amounts and the withholding applied are kept blocked (art. 17.3.b GDPR and art. 32 LOPDGDD), solely so that we can respond to the Spanish Tax Agency and until our tax obligations on those payments become time-barred, four years from the end of the period for reporting them; after that, we delete your name, your NIF and the withholding.
• Backups: the server's daily backups are kept for 30 days; the backups we make just before a definitive deletion are kept for 90 days, except the most recent one, which is kept until another one replaces it.
• Technical server logs: website access logs, a maximum of 30 days, without click identifiers or the access links we send you; the error log, which may record the full address of a page, at most 15 days.

07Your rights and how to exercise them

You can exercise the rights of access, rectification, erasure, objection, restriction and portability. It is free of charge and we will reply to you within one month at most.

If you have a customer or collaborator account, you have a cancellation button inside your own area: you do not need to write to anyone or justify anything. For anything else, write to us at info@luzgasia.com.

You can withdraw at any time, without giving reasons, any of the permissions you have given us — commercial communications, the call to assess your case or the check with your distribution company — by writing to us at info@luzgasia.com, without this affecting what we did with them before. Every commercial email we send you will also include a link to unsubscribe.

If you gave us permission to report your outcome to Google or Microsoft, you can withdraw it with one click: from your area (the “Ad measurement” card) or, if you do not have an account, from the link we give you on your result screen. You can also do so by writing to us. As soon as you withdraw it, we delete the click identifier and disclose nothing further.

You can object to us linking your request to the campaign you came from: write to us and we will remove that data without deleting your request.

If you ask us to delete your data and we had already reported an outcome of yours to an advertising platform, we will ask that platform to withdraw it.

If you consider that we have not handled your data properly, you can lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es).

08Security

Your bill is transmitted encrypted, is not accessible through any public URL and is only served through authenticated access.

Your DNI, your IBAN and your signature are stored encrypted at rest. They are only seen in full by the members of our team who process your registration and, if your file is handled by a collaborator, by that collaborator while they are handling it, because they are needed in full to complete the registration with the retailer. There is always a record of who has consulted them and when (at the very least, one entry per person for each hour in which they consult them).

We apply appropriate technical and organisational measures against unauthorised access, and before any definitive deletion we make a backup so as not to destroy anything by mistake.

09Automated decisions

The analysis of your bill is automatic: an artificial intelligence system extracts its data (section 5) and the comparison engine calculates your estimated savings using the tariffs in our catalogue.

It is not a decision that produces legal effects concerning you or significantly affects you: it is an informative proposal. You decide freely whether or not to contract, and you can always ask us for a person to review the result.

The savings we show are an estimate based on the data from your bill or, if you do not upload it, on the data you give us or, with your permission, on the data held by your distribution company. If the figures do not add up for us, we prefer not to give you any figure rather than give you one that is made up.

How we choose the tariff we recommend to you is explained in the terms of service (section 2).