Vivienda España
Privacy policy
1. Who is responsible
The controller of your personal data is Thierry Kruijff, trading as Vivienda España, NIE Y-4533902H, Camino Pedro Maña 11, 03727 Jalón (Alicante), España. Privacy contact: info@vivienda-espana.com.
2. Whose data and which data
| Group | Data | Source |
|---|---|---|
| Estate agency offices and their users | Office legal name, tax ID, billing address, login email, name and telephone of contact person if given, office logo, language, office home region, subscription and payment status, Stripe customer reference | You, at registration and in your account |
| Visitors who write to us | Name, email, role (agent, seller, other), message, consent time | Contact form |
| Sellers who request a private listing | Name, telephone, email, language, town, property type, price indication, message, consent time and language, hashed IP address | Seller form |
| Sellers with an instruction | Name, ID or NIE number, address, telephone, email, language, property data (address, cadastral reference, asking price, documents such as title deed and nota simple), agreed commission, term and notice period, signature, time, version and language of the instruction, hashed IP address, name and contact details of the photographer and proof of rights, the promotion choice per property with changes and removal instructions | The seller, through the form or through the regional partner |
| Regional partners (Listers) | Name or company name, tax ID, address, email, region, results, statements and invoices, login data | The Lister, when the agreement is made and in the dashboard |
| Buyers who request a viewing through an office | Name, contact details, message and the property concerned | The office, when it forwards a viewing request to us |
| Everyone who uses the Website | IP address, device and browser data, time of access, pages and documents opened, buyer PDFs generated, security events | Automatic |
| Administrators | Actions in the admin area (audit log) | Automatic |
Card details are entered on a Stripe page. We never see or store them.
3. Purposes and legal bases (Article 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Create and manage your office account, give access, handle the subscription, send service emails (password reset, payment notices, the daily listings email to subscribed offices for their home region) | Performance of the agreement (6.1.b) |
| Answer your contact message or seller request, and take the steps you ask for before an agreement | Pre-contractual steps at your request (6.1.b) |
| Invoicing, accounting and tax obligations | Legal obligation (6.1.c) |
| Security, fraud prevention, access and audit logs, protecting listings and photographs against misuse | Legitimate interest (6.1.f). Our interest is to secure the network and protect seller and photographer rights. |
| Storing proof of your consent to this policy | Legal obligation to show consent / legitimate interest |
| Prepare, record and carry out a seller's instruction, place the property in the network, and check the origin and rights of the photographs, if needed by contacting the named photographer | Performance of the agreement (6.1.b) and legitimate interest (6.1.f): protecting photographers' rights |
| Appoint regional partners, calculate and settle their remuneration | Performance of the agreement (6.1.b) |
| Keep signed instructions and their evidence for possible claims | Legitimate interest (6.1.f): establishing, exercising or defending legal claims |
| Record the promotion choice per property, show it to member offices, instruct offices on change or withdrawal and keep evidence | Performance of the agreement with the seller (6.1.b) and legitimate interest (6.1.f): being able to instruct offices and keep evidence. Where a publication may contain personal data beyond what the instruction requires, such as the exact address or recognisable persons, we ask for your separate consent (6.1.a), which you can withdraw |
| Coordinate viewings between office, buyer and seller | Pre-contractual steps at the buyer's request (6.1.b) and legitimate interest (6.1.f): being able to organise a viewing |
| Any other use, such as marketing emails beyond the service emails above | Only with your consent (6.1.a), which you can withdraw at any time |
4. Who receives data
We use the following providers and recipients for the purposes described above. Hosting, storage and email providers act as processors under their data processing terms. Where a provider acts as an independent controller, its own privacy policy also applies.
- Cloudflare, Inc. (hosting and network security), using a global network. Processing is not restricted to the EU.
- Supabase Pte. Ltd. (database, authentication and file storage). The production project stores its primary data in Ireland (eu-west-1); this does not mean all support or subprocessor operations take place in the EU.
- Stripe (payments and invoices). Stripe is an independent controller for its own payment compliance duties.
- Resend, provided by Plus Five Five, Inc. (system emails), with primary processing in the United States.
- Google (YouTube property videos), loaded only after your consent and subject to Google's privacy policy. Google Maps and Google address lookup are currently disabled. Business email correspondence is handled through Google Workspace.
- Regional partners (Listers): independent agents who handle seller files and offices in their region on our behalf. They see only the files assigned to them, act on our instructions and are bound by a data processing agreement.
- Member estate agency offices: they receive property information, buyer PDFs and released media. For their own use and their own channels they are independent controllers.
- Public channels of member offices, only for properties for which the seller has permitted public promotion: the office's own website, property portals and other real estate websites, social media, digital newsletters, window displays and printed presentations, advertisements and the office's internal agency system. There the property description, price, status, released photographs, videos, drone images and floor plans and the released location may become public. Public information may be indexed by search engines and copied by third parties. The seller's identity and contact details are not provided.
- Service providers of those offices (portals, CRM, advertising and newsletter services), under their own terms.
- Van Riemsdijk & Karman S.L. (website management, support and photography production)
- Accountants and legal advisers, under confidentiality, where needed
We do not sell personal data. The identity and contact details of sellers are visible to Vivienda administrators and to the regional partner who handles the file, and are never shown to estate agency offices.
5. Transfers outside the EEA
Cloudflare, Supabase and Resend describe the safeguards for restricted international transfers, including Standard Contractual Clauses, in their data processing terms. A European database location does not exclude international support or subprocessors. Google and Stripe describe transfers for their own processing in their privacy information. You can request information about the applicable safeguards and how to obtain a copy at info@vivienda-espana.com.
6. Retention
For the portfolio preview, we record your email address and when you open the preview. This does not verify your identity or subscribe you to marketing emails. These access records are deleted after 30 days.
| Data | Period |
|---|---|
| Office account data | Duration of the agreement plus 12 months |
| Invoices and accounting records | 6 years as required by Spanish commercial and tax law |
| Contact messages | 24 months |
| Seller requests not converted into a listing | 12 months |
| Seller data of an active listing | Duration of the mandate plus 12 months |
| Signed instruction with evidence (signature, time, version, documents) | Duration of the instruction plus 5 years |
| Regional partner data | Duration of the agreement plus 6 years for statements and invoices |
| Promotion choice per property, changes and removal instructions | As part of the instruction: duration of the instruction plus 5 years |
| Access, security and audit logs | 12 months |
| PDF generation records | 12 months |
| Consent records | As long as the consent is relied on plus 3 years |
After these periods data is deleted or anonymised, unless the law requires longer storage or a claim is pending.
7. Your rights
You can ask for access, correction, deletion, restriction, objection and portability, and withdraw consent at any time. Write to info@vivienda-espana.com. We may ask for proof of identity. We answer within one month. You can complain to the Spanish Data Protection Agency (AEPD), www.aepd.es.
If you want a property no longer to be publicly promoted, or the property leaves the network, we give the member offices a removal instruction. We cannot ourselves recall publications that have already spread beyond our control, such as search engine caches, portal feeds, newsletters sent, printed materials and copies, and we do not promise complete or immediate removal from the internet. A removal request therefore covers what we manage and what we can have offices remove.
8. Security
Access is protected by login with rate limiting, roles are checked on the server, files are stored privately and served through short-lived links, and administrator actions are logged. No system is completely secure. We report personal data breaches to the AEPD and to affected persons as the law requires.
9. Cookies
See the Cookie Information.
10. Changes
We will publish changes on this page and show the version and date. For material changes affecting subscribed offices we also inform them by email.
Version 1.0 · effective date 1 November 2026. Existing acceptances and the change procedure remain applicable.
Document updated: · v1.0