The companies listed in the section “Data Controllers” (hereinafter, the “Data Controllers”), in accordance with current legislation on the Protection of Personal Data, hereby inform users of the website (hereinafter, the “Website”) of the Privacy and Data Protection Policy that will apply to the processing of personal data voluntarily provided by the User.

By providing their personal data through the Website’s electronic forms and by checking the corresponding acceptance box, users expressly consent to the processing of such data in accordance with the terms of this Privacy and Data Protection Policy clause and for the purposes set forth herein.

The Data Controllers, who affirm their commitment to comply with the legislation in force at all times, inform users that their personal data may only be collected for processing when such data is adequate, relevant, and not excessive in relation to the specific, explicit, and legitimate scope and purposes for which it was collected. It will be deleted when it is no longer necessary or relevant for said purpose or when requested by the data subject in the exercise of their right to erasure.

The personal data provided will be processed and used in accordance with the following information.

Data Controllers

The processing of your personal data is carried out on behalf of the following entities, which act as Data Controllers and are the owners of the properties:

2. Data Processor

What personal data do we collect and how do we use it?

• Data collected directly: through the voluntary completion of forms for requesting information, registering as a user in the private area, or for commercial communications.
• Data collected indirectly through the use of cookies: for statistics, to analyze the use of our Website, and to provide value-added services such as a map showing the location of our offices.
• Data collected during the pre-contractual phase of the lease: documentation proving identity, creditworthiness, and employment status, as well as information obtained from credit scoring systems, document verification systems, and credit history databases, where legally applicable.

The data processed are as follows:

• Identifying data: first name, last name, ID number/foreign resident ID number and passport number, nationality, address, phone number, email address.
• Professional and financial data: employment contract, pay stubs, income tax returns, employment history, income, and employment status.
• Banking data: IBAN, bank statements, or documentation proving financial solvency.
• Information obtained from automated scoring and document verification systems.
• Information from creditworthiness files (if consulted).

In the sections below, you will find more detailed information about the processing of your personal data:

• Data source: The sources from which your data is obtained are identified.
• Purposes: We identify the purpose for which we need to collect your data, that is, why we process your information.
• Legal basis and retention: Details the legal basis that allows us to process your data and the retention period or the criteria determining that period.
• Recipients: We identify, where applicable, with whom we will legitimately share your data.
• Rights of data subjects: We inform you of the rights you have as a data subject regarding the processing of your personal data.

Source of the data

The data comes from the Website itself, from one of the Data Controllers (if you have given your consent), from social media platforms where the Data Controllers are present, from third parties with whom collaboration agreements have been formalized, or from various portals through which you have submitted a request for information.

During the pre-contractual phase of the lease, data may also come from documentation provided directly by the prospective tenant, as well as from entities that maintain financial solvency and credit files, when it is appropriate to consult them in accordance with current regulations.

Purposes

Management of the relationship established with the user.

• Management of the relationship established with the user
• Contact: Responding to your request for general information about any of the services we offer, whether our own or those of third parties, through various channels, including by phone, SMS, WhatsApp, email, and/or phone call.
• Sale: To properly address your request to receive an offer for your property.
• Purchase: To properly address your request to reserve the property, schedule a visit, or arrange a call.
• Mortgages: To properly address your request for a personalized mortgage assessment, as well as your contact request; regarding the possibility of being subject to automated individual decision-making, please refer to the “Additional Purposes” section.
• Sales Management: To properly address your request for information regarding real estate brokerage services.
• Anti-Money Laundering: Identification and recording of transactions in accordance with the law, as a regulated entity in the prevention of money laundering and terrorist financing.
• Rental: To properly address and evaluate your request to rent a property, as well as schedule a visit; regarding the possibility of being subject to automated individual decisions, please refer to the “Additional Purposes” section.
• Private Area: To manage the user’s registration as a tenant, as well as to properly address issues related to the leased property; to manage the signing of the lease agreement electronically and to maintain a record of actions throughout the term of the lease.
• Pre-contractual phase of the lease: Analyze the financial viability of the prospective tenant using automated systems; verify the validity of the documents provided; consult creditworthiness records when relevant; contact you to complete the process in order to detect any unpaid debts or financial issues or to verify information during the evaluation process; and inform you about the possibility of purchasing home insurance for the property being leased that may be of interest to you. Regarding the possibility of being subject to automated individual decision-making, please refer to the "Additional Purposes" section.
• Contractual Phase of the Lease: To manage the signing of the lease agreement, fulfill the obligations arising from the contract, manage issues related to the use of the property, maintain the traceability of ’s actions during the term of the lease, and evaluate our quality system.
• Cookies: maintaining the logged-in status, ensuring the validity of the application process, providing statistics related to the use of the Website, and implementing anti-spam systems (captcha). You can review the purposes of cookies in Clikalia’s Cookie Policy. Any references in Clikalia’s Cookie Policy to the Data Controller should be understood as referring to the companies listed in point 1 of this policy.
• The Data Controllers may send you commercial information through various channels (phone, email, WhatsApp, and SMS) regarding products or services similar to those you have previously contracted and that may be of interest to you. Specifically, they may send you information about changes in the conditions of properties you have shown interest in, such as price decreases or increases, or other properties in the area you have shown interest in. We inform you that you may always object to this processing by sending an email to dpo@clikalia.com.
• We inform you of the existence of advertising opt-out systems designed to prevent the sending of commercial communications. A list of these systems is available on the AEPD’s website.
• Quality surveys: Conducting quality surveys—including via electronic means—regarding our products and services in order to improve our management models and internal procedures.
• Management of participation in events, contests, and sweepstakes that we organize.
• Call recording to identify issues related to customer service, ensure transparency in the execution of operations, and improve our quality system.
• Customer service and incident management.

The requested data is necessary for user transactions carried out through the website.

Additional Purposes

If you provide your consent, your data will be processed for the following additional purposes: To share information with the Data Controllers or third-party partners so that they may send you commercial communications, including electronic communications via SMS, WhatsApp, email, and/or phone calls regarding any product or service.

Additionally, we inform you of the use of artificial intelligence tools and the possible existence of automated individual decision-making, including profiling, derived therefrom. This processing will be carried out to confirm the accuracy of the data and the user’s interest in the provision of Leasing and Mortgage services.

In this regard, based on the information provided by the data subject, artificial intelligence will analyze the feasibility of providing the corresponding service and may determine whether or not to proceed with the data subject. In any case, the data subject may review the terms of the decision, object to this processing, and request human intervention.

Legal Basis and Retention

The legal basis for the processing is the establishment of the contractual relationship upon request for the service in question and the consent granted by the User by checking, where applicable, the corresponding box to accept the applicable Privacy Policy and to accept commercial communications; the application of Law 10/2010 of April 28 on the prevention of money laundering and terrorist financing, and other implementing regulations.

For the pre-contractual phase of the lease, the legal basis is the implementation of pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR) and the legitimate interest of the controller in verifying the financial solvency of the prospective tenant, in accordance with Art. 6.1.f GDPR and Art. 20 of the LOPDgdd.

The performance of the contract and the application of pre-contractual measures (Art. 6.1.b GDPR).

Compliance with legal obligations (Art. 6.1.c GDPR).

In the case of the Call Center, the basis for data processing is the proper execution of the relationship between the parties, as well as the legitimate interest of the controller in identifying potential issues or areas for improvement in its quality system.

For the sending of commercial information regarding products or services that are similar to those you have previously contracted and that may be of interest to you, the legal basis will be legitimate interest. 

The fields on the contact form marked with an asterisk (*) are considered necessary to process the purpose of the form. If you do not provide them, we will not be able to process your request. Please consult Clikalia’s cookie policy for information on the cookies necessary for the website to function.

• Contact information will be retained for as long as necessary to provide the requested services and unless you request its deletion.
• Data related to anti-money laundering will be retained for 10 years.
• Please refer to the Cookie Policy to determine the duration of each cookie.
• Contact information used for sending commercial communications will be retained until you request its deletion.
• Contact data used for sending commercial communications based on legitimate interest will be retained for a period of one year, provided you have not requested its deletion.
• Call recordings for quality assurance purposes will be retained for a period of 4 years.
• Data processed during the pre-contractual phase of a lease will be retained for a maximum of 6 months from the closure of the file (dismissal, withdrawal, or termination of the process), unless there is a legal obligation to retain it for a longer period.
• Data processed while a contract is in effect will be retained for the entire duration of the contract and, thereafter, for the applicable statutory periods.
• In general, data necessary to comply with the various statutes of limitations associated with legal obligations or the exercise and pursuit of legal actions may be retained.

Recipients of Disclosures and International Transfers

The Data Controllers and the Data Processor responsible for managing the various services offered. Specifically, we may disclose your data in the following cases, provided you have given your consent:

• If you wish to receive information about properties, your data may be disclosed to companies within the Clikalia group. Please consult their privacy policy here
• If you wish to receive information about ancillary services such as alarms, security, PAO doors, and the management of procedures related to real estate transactions, your data will be transferred to CLIPISO DESARROLLO S.L.U.
• If you wish to receive information about financing, your data will be transferred to CLIKALIA HIPOTECAS S.L.U. View their privacy policy here.
• If you wish to receive information about renovation management and home furnishings, your data will be shared with CLIPISO REAL ESTATE III S.L.U. View their privacy policy here
• If you wish to receive information about insurance-related services, your data will be shared with CLIKALIA MEDIACIÓN DE SEGUROS S.L.U.
• To third parties with whom the Data Controllers have entered into commercial collaboration agreements for the promotion of their products and services, as specified in the terms and conditions of each product or service.
• To third parties with whom the Data Controllers have entered into collaboration agreements for the provision of maintenance, repair, and other services.
• Technology providers specializing in risk analysis, credit scoring, and document validation, as well as entities that maintain creditworthiness databases, in cases provided for by law.
• Providers of electronic signature and document management systems.
• Courts, public administrations, or competent authorities, when there is a legal obligation.
• Maintenance or technical support companies, if they are involved in resolving incidents.
• Banks and financial institutions to offer you real estate loan financing.
• Social media platform operators: The Data Controllers use social media. Interaction with users through the use of such profiles or tools involves the international transfer of data (of an analytical and technical nature) to the social media platform’s servers.
• Where applicable, to government agencies in compliance with Law 10/2010 of April 28 on the prevention of money laundering and terrorist financing, and other implementing regulations.

The use of the Stripe payment platform will involve the international transfer of data from users who pay for the service provided to the United States, an entity adhering to the Data Privacy Framework Adequacy Decision, which allows the flow of data from European citizens to the U.S.

Web Analytics Service Providers: The Website uses Google Analytics services provided by Google LLC. Interaction with users through the use of this tool involves the international transfer of analytical and technical data related to the Website.

The Data Controllers use Microsoft Corporation’s “Online Services for Business” with tools such as Office 365, a company adhering to the Data Privacy Framework Adequacy Decision, which establishes adequate safeguards for data flows between the EU and the U.S. However, its operators may be located in countries whose legislation is not comparable, which may entail potential international data transfers.

The management of customer incidents will involve an international data transfer because it is carried out through the software of Zendesk, Inc., a company adhering to the Data Privacy Framework Adequacy Decision, which allows the flow of data from European citizens to the U.S.

The Data Controllers use the services of Anthropic, PBC, which may involve an international data transfer covered by the Standard Contractual Clauses (SCCs) approved by the European Commission.

When users interact with artificial intelligence within the framework of communications, this will be carried out through the provider "respond.io" (ROCKETBOTS LIMITED), based in Hong Kong (China). This transfer is covered by a data processing agreement signed with respond.io in accordance with the Commission’s standard contractual clauses. You can view the provider’s privacy policy on its website.

Rights of Data Subjects

You may exercise your rights of access, rectification, erasure, portability, and restriction or objection by writing to dpo@clikalia.com

Data subjects have the right to withdraw their consent.

Data subjects have the right not to be subject to a decision based solely on automated processing and may exercise the right to object to such processing.

Data subjects have the right to file a complaint with the Supervisory Authority (Spanish Data Protection Agency: www.aepd.es).

The user shall be solely responsible for the accuracy of the data provided to the Data Controllers.

The Data Controllers adopt the necessary technical and organizational measures to ensure the security of personal data and to prevent its alteration, loss, unauthorized processing, or access, taking into account the state of technology, the nature of the data, and the risks to which it is exposed.

The Website has an SSL (Secure Socket Layer) Certificate to ensure the security of data transmission between your browser and our Website.

The secure server establishes a connection so that the information is transmitted in encrypted form, ensuring that it is only intelligible to the user’s device and the Website’s server. Thus, by using the SSL protocol, the following is guaranteed:

• That the user is sending their data to the Website’s server and not to any other.
• That data is transmitted in encrypted form between the user and the Website, preventing it from being read or manipulated by third parties.

To verify that you are in a secure environment, the Customer should check that the verification page’s address begins with https://

You can also identify the Website as secure when a padlock icon appears in your browser’s address bar.

Finally, you can also verify the presence of the SSL certificate by checking the Website’s properties in your browser, for which you should consult the browser’s settings.

Any changes made to the Privacy Policy and information management practices will be reflected in a timely manner, and the Data Controllers may add to, modify, or remove this privacy policy as they deem necessary.

Under no circumstances will the Data Controllers modify the policies or practices to make them less effective in protecting our customers’ previously stored personal data without the prior consent of the affected customers.

Last updated: May 2026