Data protection

Privacy policy

Draft pending review. This text is awaiting validation by Hogariza’s legal adviser before it is considered final. This English version is provided for convenience; in case of discrepancy, the Spanish version prevails.

This page explains what personal data we process when you use hogarizagestion.es (searching for a room, creating your account, requesting a booking, joining the waiting list or contacting us), what we use it for, how long we keep it and what your rights are.

Data controller

Hogariza Gestión S.L., with tax ID (CIF) B16436032 and registered address at Calle Labrador 20, 28005 Madrid. Contact email for privacy matters: administracion@hogarizagestion.es. You’ll find the rest of the company details in the legal notice.

What data we process

• Your account: email address, first name and surname. If you sign in with Google or Microsoft, that service gives us your name and email; we never see or store your password.
• Your profile: phone number, date of birth, nationality, work or study situation, type and number of identity document, billing details and, if you provide them, your guarantor’s details and what you tell us about yourself for flat-sharing (whether you smoke, whether you have a pet, your introduction).
• Your documents: the copy of your identity document and the supporting documents you upload (employment contract, payslip, enrolment or grant, or your guarantor’s).
• Your booking requests: the room, the dates, the amounts, the status of the request and the messages you send us from your account.
• Payments: you enter your card details directly in the form provided by Stripe, our payment provider; we never see or store them. Stripe keeps the card you use for your request so that, if we propose different terms and you accept them, you can pay the difference without typing it again (you always confirm it yourself). We only keep the reference, amount and status of each payment, and the invoices.
• Waiting list: if you join, the dates, area, budget and comments you give us, together with the name, email and phone number in your account.
• Contact form: first name, surname, phone number, email address and the content of your message.
• Technical data: to keep the website secure we log technical data about requests (date, page, errors) with the IP address anonymised. Your IP is only used briefly to stop abusive attempts (for example, a form being sent over and over) and is not stored.

What we use it for and on what legal basis

• Managing your account and your booking requests: checking your identity, assessing the request and keeping in touch with you. This is necessary to take pre-contractual steps at your request (Article 6(1)(b) GDPR).
• Preparing and performing the rental contract, charging the amounts due and issuing invoices: performance of the contract (Article 6(1)(b)) and compliance with our legal, tax and accounting obligations (Article 6(1)(c)).
• Letting you know when a room that suits you becomes available (waiting list): at your request (Article 6(1)(b)), and you can leave the list whenever you like.
• Answering your enquiries from the contact form: our legitimate interest in helping you (Article 6(1)(f)) or, if you ask about a room, pre-contractual steps (Article 6(1)(b)).
• Keeping the website secure and preventing fraud, including in payments: legitimate interest (Article 6(1)(f)).
• Measuring how the website is used with analytics cookies: only with your consent (Article 6(1)(a)), which you can withdraw at any time.

Your profile details and documents are needed to assess a booking request: without them we cannot process it. We don’t make decisions based solely on automated processing: every request is reviewed by a member of our team.

How long we keep it

As a rule, nothing we keep lasts longer than a year, and it is deleted automatically, without you having to ask:

• Documents (copy of your identity document, payslips, contracts or enrolment certificates): one year after you upload them.
• Booking requests, the data they contain and the messages you send us about them: one year after you send them.
• Waiting list: one year after you join, or as soon as you leave it.
• Your account and profile: after a year without signing in. We email you a month beforehand, and signing in is enough to keep it.
• Sessions (what keeps you signed in to your account): 30 days.
• Technical logs: 90 days at most.

You can delete your documents, leave the waiting list or delete your whole account whenever you like from the website. Deleting your account also deletes your booking requests, your waiting-list entry and your record in Homming and, if any request was still pending, it is cancelled and we release the hold on your card. We only keep requests that have already been accepted (and your record in Homming, if there is a contract), as they support the contract and the invoice.

There are two exceptions to these periods: invoices and proof of payment, which the law requires us to keep for the periods set by tax and commercial legislation (up to six years), and, if you sign a contract, its data, which is kept for the duration of the contractual relationship and for those same legal periods. In addition, deleted data may remain in technical backups for up to 30 days before it disappears completely.

Who processes your data

We don’t sell or pass on your data to third parties for commercial purposes. Only the members of our team who manage bookings and these providers, who process it on our behalf, have access to it:

• Microsoft Azure, which hosts the website, the database, the documents and the sign-in accounts. Personal data is stored in data centres in the European Union: the database, the documents and the API in the Spain region (Madrid), and the sign-in accounts in Europe.
• Homming, the platform we use to manage the flats, contracts and tenants, where we record your request.
• Stripe, our payment provider: it handles the card hold and payment and issues the invoices.
• Dinahosting, our email provider, in Spain, which we use to send you emails about your account and your bookings.
• Google or Microsoft, only if you choose “Continue with Google” or “Continue with Microsoft” to sign in: they verify your identity and send us your name and email.

We may also disclose data to public authorities, courts or law enforcement when the law requires us to.

External services loaded by the website

The website’s fonts, styles and scripts are served from our own domain, except for these services, which your browser contacts directly (and which therefore receive your IP address):

• Maps: location maps are drawn from our own website, but your browser downloads the map images from OpenStreetMap’s servers.
• Listing photos: they are loaded from Homming’s servers, on Amazon Web Services (Frankfurt, European Union).
• Payments: the booking pages load Stripe’s code, which is needed for secure payment and fraud prevention.

International transfers

Some providers may process data outside the European Economic Area. When they do, it is with the safeguards required by the GDPR:

• Stripe: our contract is with Stripe Payments Europe, Limited, in Ireland, but part of the payment data is processed in the United States by Stripe, LLC, which participates in the EU-US Data Privacy Framework.
• Google (sign-in with Google and Google Analytics) and Microsoft (sign-in with Microsoft and Clarity): US companies that participate in the EU-US Data Privacy Framework.
• OpenStreetMap: the OpenStreetMap Foundation is based in the United Kingdom, which benefits from an adequacy decision of the European Commission.

Cookies and analytics

We use the cookies and browser storage needed for the website to work: your account session, in a secure cookie that the page’s scripts cannot read, and your cookie choice, which is kept in your browser for 12 months. Only if you accept them in the cookie notice do we also use:

• Microsoft Clarity, which records in aggregate how people browse the website (clicks, scrolling, heatmaps) so we can improve it. It isn’t used on your account pages and, during the booking process, it hides what you type and your details.
• Google Analytics, to count visits and see which pages work best, with the IP address anonymised and no advertising purposes.

You can change your choice at any time from “Cookie preferences”, in the footer of any page.

Security

All communication with the website is encrypted. Documents are stored in private storage with no public access, and the bookings team only views them through temporary links. System keys are stored encrypted in a secrets vault.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to administracion@hogarizagestion.es. You can exercise many of them yourself from the website: correcting your profile, deleting your documents, leaving the waiting list, deleting your account or changing your cookie preferences. We will reply within one month.

If you believe we haven’t handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

Last updated: 28 September 2026.