Privacy policy

1. Data controller

The controller of your personal data is PSS GROUP SPAIN SL (Sociedad Limitada), trading as Spanish Casa, NIF B54289798, with registered office at Carrer de Carlos Benimeli 14, 03730 Xàbia (Alicante), España, operating the website https://www.spanishcasa.es.

For any question regarding this policy or the processing of your personal data you can contact us at hola@spanishcasa.com or by post at the address above.

2. Data we process

Depending on how you use the platform, we process the following categories of personal data, provided directly by you:

• Identification and contact data: first and last name, email address, phone number, and identity document (NIE, DNI or passport).
• Solvency and application documentation, according to your applicant profile (employed, self-employed, student or retired): salary slips (nóminas), IRPF returns, pension statements, bank statements, employment or study documentation.
• Reservation and payment data: reserved property, amounts paid, payment references and invoicing data.
• Account and usage data: login credentials (password stored in hashed form), language and theme preference, and the documents you choose to keep in your personal wallet.
• Technical data: an anonymous first-party session identifier used solely for aggregated visit statistics on our own site (see section 9, Cookies).

We do not request or process special categories of data (art. 9 RGPD), and we ask you not to include such data in the documents you upload.

3. Purposes and legal bases

We process your data for the following purposes, each with its legal basis under art. 6 RGPD:

• Managing your rental application, viewings, reservation and, where applicable, the tenancy: performance of a contract or pre-contractual measures taken at your request (art. 6.1.b RGPD).
• Verifying solvency documentation and communicating your application to the landlord of the property applied for: pre-contractual measures at your request (art. 6.1.b RGPD).
• Issuing invoices, depositing the fianza with the Generalitat Valenciana and complying with tax and record-keeping duties: compliance with legal obligations (art. 6.1.c RGPD).
• Platform security, fraud prevention, and anonymous aggregated visit statistics on our own site: our legitimate interest in operating a safe and functional service (art. 6.1.f RGPD). You may object to processing based on legitimate interest at any time.
• Property alerts by email and browser push notifications: your consent (art. 6.1.a RGPD), which you can withdraw at any time without affecting prior processing. Push notifications are only sent after you expressly accept them in your browser, and you can disable them in your browser settings or from your account.

Providing the data marked as required in the application forms is necessary to process your application; without it we cannot provide the service.

4. Recipients

We never sell your personal data. Your data are disclosed only to:

• The landlord (arrendador) of the property you apply for, to the extent necessary to assess your application and conclude the tenancy.
• Banking and payment entities, to process the payments and refunds you make or receive.
• IT and hosting service providers who support the operation of the platform (server hosting, email delivery, image hosting), acting as processors under contracts pursuant to art. 28 RGPD and only on our instructions.
• Public authorities where a legal obligation requires it: the competent body of the Generalitat Valenciana (deposit of the fianza) and the tax authorities (AEAT), among others.

No other transfers of data to third parties take place without your consent, unless required by law.

5. International transfers

As a rule, our service providers process data within the European Union / European Economic Area. If a specific provider (for example, an email delivery or push notification service) processes data outside the EEA, we ensure that the transfer is covered by an adequacy decision of the European Commission or by appropriate safeguards under arts. 44 y ss. RGPD, in particular the Standard Contractual Clauses approved by the Commission. You may request information about the safeguards applied by writing to hola@spanishcasa.com.

6. Retention periods

We keep your data only as long as necessary for each purpose:

• Rejected applications, and pending applications that did not lead to a reservation, are automatically deleted (including the uploaded solvency documents) 90 days after their last update.
• Data relating to confirmed reservations, tenancy contracts and invoices are kept for the limitation periods established by Spanish tax and commercial law (in general, 4 years under the Ley General Tributaria and up to 6 years under art. 30 del Código de Comercio).
• Documents you store in your personal wallet are deleted 12 months after your last contract ends, or earlier on request; the automatic application cleanup never removes them.
• Account data are kept while your account is active and, after closure, blocked for the period needed to meet legal responsibilities.

7. Your rights

Under the RGPD (EU 2016/679) and the Ley Orgánica 3/2018 (LOPDGDD) you have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erase your data when they are no longer necessary (supresión).
• Object to processing based on legitimate interest (oposición).
• Restrict the processing in the cases provided by law (limitación).
• Receive your data in a structured, machine-readable format and transmit them to another controller (portabilidad).
• Withdraw any consent given, at any time, without affecting prior processing.

To exercise these rights, write to hola@spanishcasa.com or to our postal address, indicating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for a copy of your DNI, NIE or passport solely to verify it. We will respond within one month, extendable by two further months for complex requests, as provided in art. 12 RGPD.

8. Complaints before the AEPD

If you consider that the processing of your data infringes data protection law, you have the right to lodge a complaint with the Spanish supervisory authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. We would nonetheless appreciate the opportunity to resolve any concern first: you can always write to us at hola@spanishcasa.com.

9. Cookies

We only use first-party cookies and similar technologies, strictly limited to:

• Essential cookies required for authentication and session management; without them you cannot log in.
• A preference cookie that remembers your language (EN/ES) and theme choice.
• An anonymous first-party session identifier used solely for aggregated visit statistics on our own site; it does not identify you personally and is not shared with anyone.

We do not use third-party tracking, analytics or advertising cookies, and we do not perform cross-site tracking or profiling. Because only essential and preference cookies of our own are used, no cookie consent banner from third parties is required; you can delete cookies at any time from your browser settings.

10. Security

We apply technical and organisational measures appropriate to the risk (art. 32 RGPD): the documents you upload are stored on private servers outside the public web root and can only be retrieved through time-limited, cryptographically signed (HMAC) links; access to personal data is restricted to authorised personnel who need it to provide the service; passwords are stored in hashed form; and communications with the platform are encrypted in transit. In the unlikely event of a security breach involving risk to your rights, we will notify the AEPD and, where required, yourself, in accordance with arts. 33 and 34 RGPD.

11. Updates to this policy

We may update this policy when the platform, our providers or the applicable regulations change. The version in force is always published on this page; where a change is material, we will inform you through the platform or by email. Last revision: the date shown on this page.