Privacy policy

This is a translation provided for information purposes. In the event of any discrepancy, the Spanish version prevails.

This policy explains clearly what personal data we process at Llavely, for what purposes, on what legal basis, for how long, with whom we share it and what rights you have. It is organised in two layers: first a summary and then the full information, arranged by type of user so that you can quickly find what applies to you.

---

FIRST LAYER · Basic information

---

SECOND LAYER · Full information

1. Who is the controller?

---

2. Llavely and agencies: who is responsible for what?

In lettings, Llavely is a platform used by private individuals and also by estate agencies and professionals (in sales we do not work with agencies). Depending on the case, Llavely is the controller of your data or acts as a processor for an agency (that is, it processes the data on the agency's behalf and following its instructions). This table summarises it:

What does this mean in practice?

• If you are a client of an agency (for example, the agency manages your property and has published it on Llavely), the controller of your data is the agency. To exercise your rights over that data, contact the agency. If you write to us, we will forward your request to the agency without delay.
• If you are a Llavely tenant, we are the controller of your data and your verification. When you accept an invitation or a viewing from an agency, we share with it only what you have decided to show, and the agency becomes the controller of the data it receives, which it may only use for that transaction.

---

3. What data do we process, for what purpose and on what legal basis?

We first explain the processing common to all users and then the processing specific to each profile. For each one we state what data, for what purpose, on what legal basis (art. 6 GDPR and, where applicable, art. 9) and for how long we keep it.

How to read the retention periods: when we say "for the duration of the relationship + blocking", this means that, when it ends (for example, when you delete your account), we stop using the data and block it (art. 32 LOPDGDD (Ley Orgánica 3/2018, Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights)): it is only kept, with restricted access, to deal with possible legal liabilities during the stated period, and is then deleted.

3.1. Processing common to all registered users

3.2. Tenants

3.3. Private landlords (lettings)

3.4. Buyers (sales, Comunidad de Madrid)

Sale adverts are not public: you create your buyer account free of charge and we invite you to the homes that match. The buyer pays nothing.

3.5. Sellers and inheritances (sales, Comunidad de Madrid)

3.6. Agencies, professionals and their agents (lettings only)

3.7. Partner lawyers (sales and inheritances)

The legal services for the Venta Llavely and for inheritances are provided by specialist lawyers who work with us. To do so, they see the data relating to the transaction or the inheritance: identity of the parties, property details, nota simple, charges and debts, offers, arras, tax data and the documentation for the notary. They are bound by professional secrecy and have a contract with Llavely that sets out what data they may use and for what purpose.

The lawyer handling the transaction acts for the seller. With the buyer, they act as a mediator: they explain each step, the deadlines and the paperwork, at no cost, but they are not the buyer's lawyer.

3.8. Website visitors (without an account)

3.9. Waiting list, blog and newsletter

3.10. Commercial communications

• To customers: if you are already a user, we may send you emails about Llavely products or services similar to those you already use (art. 21.2 LSSI-CE). We give you the opportunity to object when you register and in every communication, simply and free of charge.
• In all other cases: only with your prior and express consent (art. 21.1 LSSI-CE), which you can withdraw at any time from your account or using the unsubscribe link.
• We never pass your data to third parties so that they can send you their advertising.
• Operational notifications (an invitation, a viewing, a message, a payment, an offer or the weekly summary from the seller portal) are not commercial communications and form part of the service.
• Invitations to other homes for sale, other than the one you asked about, only reach you if you ticked that box (section 3.4).

3.11. Job applicants (if any applications are received)

3.12. Third-party data you provide to us

If you give us data about other people (for example, those who will live with you, a guarantor, a co-owner of the property, the other heirs or a representative), you must have informed them and have their authorisation. We will only process that data for the purpose for which you give it to us.

---

4. Identity verification: how biometrics work and what the alternative is

What we do. To ensure that all lettings profiles are genuine, we verify the identity of tenants, landlords and the person in charge of each agency. (In sales, the identity of buyers and sellers is checked by our team: see sections 3.4, 3.5 and 6.) The quickest way is automatic verification with a selfie: you take a photo of your DNI/NIE and a selfie (or a short liveness check video). The system of our verification provider [name to be determined] checks that the document is genuine and compares your face with the photo on the document, generating a biometric template for that purpose.

Why it is special category data. That template is biometric data intended to identify you uniquely, a special category of data (art. 9 GDPR). That is why we only do this if you give us your explicit consent, through a specific, separate box that is not pre-ticked, before starting.

Alternative without biometrics. You are not obliged to use the selfie. You can choose, at no extra cost:

• Verification by video call with a member of the Llavely team, who visually checks your document and your identity without generating biometric templates, or
• In-person verification [at our offices / at the time of the viewing or signing, as will be determined], or
• [Another alternative, e.g. digital certificate or Cl@ve (Spanish government electronic ID system) — to be assessed].

The alternative may take a little longer, but you will obtain the same "identity verified" badge and will not be at any disadvantage on the Platform.

How long. The selfie and the biometric template are deleted as soon as the result is obtained. We only keep the result of the verification (yes/no, date and method). The verification provider acts as a processor and may not use your data for its own purposes (for example, to train its systems).

Withdrawal of consent. You can withdraw it at any time before the verification is completed; afterwards, as the template has already been deleted, withdrawal does not affect the verification already carried out.

---

4.1. Optional documentation to strengthen your profile

If you wish, you can upload additional documents (employment contract, receipts from your previous tenancy, a reference from your previous landlord, a report from debtor files that you have requested yourself, employment history record (vida laboral), savings certificate, guarantee or surety insurance, income tax return, certificates showing you are up to date with payments, enrolment or grant, your pet's health record). Legal basis: your consent, which you can withdraw whenever you wish. What we do: the artificial intelligence system in section 4.2 checks it and, if something does not add up, a member of the team does (a reference from your previous landlord is always completed by a person, who speaks to them), and we only show the landlord a badge (for example, "Payments up to date"), never the document. Retention: we delete the file once we have finished verifying it (at most, [30] days) and only keep the result while your profile is active. We recommend that you cover up any data that is not necessary, such as account numbers or items unrelated to the tenancy. Llavely does not consult debtor files on its own initiative.

4.2. Verification of tenants with artificial intelligence

What we do. All the documents a tenant uploads (identity, income and the optional ones in section 4.1, including those of the people renting with them in section 4.3) are checked by an artificial intelligence system from a provider, Anthropic (Claude model): it reads the document, checks that it is consistent and genuine and calculates the result (for example, "income verified" and the rent-to-income ratio).

Human involvement. If the system cannot confirm a piece of information or sees something that does not add up, it does not reject your profile: the document is passed to a member of the Llavely team for review. You can also ask at any time for a person to review the result, explain your situation and correct your details, by writing to legal@llavely.com or from "Help".

What the advertiser sees. Only the result (for example, "Identity verified", "Income verified" or the rent-to-income ratio for their property), never the document.

Retention. We delete the file once it has been verified and keep only the result (section 10). The provider acts as a processor and may not use your documents for its own purposes, such as training its systems [to be confirmed contractually].

4.3. Joint profile: people renting with you

If several of you are renting together (a couple, a family or a flat share), the account holder can add up to three more people who will sign the tenancy agreement: their full name, email address, employment status and net income, and upload their ID document and proof of income.

Each person's confirmation. We email each person so they can confirm that they agree. Until they confirm, we do not review their documents and no advertiser sees their name. If they say no, or do not reply within [30] days, we delete their details and documents. Anyone who adds another person must have that person's permission to give us their details.

Legal basis. For the account holder, performance of the contract (6.1.b). For each person added, their consent (6.1.a), given through the link in the email, which they can withdraw at any time by writing to legal@llavely.com (we then delete their details and documents from the joint profile).

What the advertiser sees. The joint name according to the privacy setting chosen (for example, "Javier R. and Laura M."), the verification results and the rent-to-income ratio calculated with the sum of the verified incomes of those signing. Never the documents or anyone's age.

Retention. As for the rest of the verification: we delete the files once verified and keep only the result while the joint profile is active.

5. Profiling and automated decisions

Llavely uses some automatic calculations. We explain what they are, what logic they follow and why no decisions are taken based solely on automated processing that produce legal effects for you or similarly significantly affect you (art. 22 GDPR).

5.1. Affinity index (tenants)

What it is. A score indicating how well a tenant profile matches a specific property. It is shown to the advertiser to help them decide whom to invite.

What it takes into account [to be completed/adjusted with the technical team]:

• Match of area, type of property, number of rooms and dates.
• Relationship between the rent of the property and the tenant's budget.
• If income has been verified, the rent-to-income ratio.
• Compatibility of pets and number of occupants with what the property allows.
• Verification level of the profile (identity, income).

What it does NOT take into account. The index does not use nationality, racial or ethnic origin, sex, age, marital status, religion, disability, health, sexual orientation or any other protected characteristic, nor data that could act as a proxy for them. Nor does it take into account whether you have marked "I'm interested" on a property: that mark is only shown to the advertiser as a discreet tag ("Interested in your flat") and does not change the order.

Who decides. The index is for guidance only. The advertiser decides whom to invite and with whom to sign, can see all profiles that match their search (not just those with the highest score) and sees the main reasons for the score. The index does not automatically exclude anyone.

Your rights. You can see the factors that influence your index [to be defined: in your dashboard], ask for explanations, point out errors in your data and object to this processing by writing to legal@llavely.com.

Legal basis. Legitimate interest (art. 6.1.f) of Llavely and of advertisers in an efficient search, and performance of the service you have contracted (art. 6.1.b).

5.2. "Fair price" meter (landlords and sellers)

What it is. An indicator that compares the price you are asking with market references: the Sistema Estatal de Referencia del Precio del Alquiler de Vivienda (State Reference System for Residential Rental Prices, the official index) and other public or aggregated market data, citing its source.

Effects. If your price is within the range considered fair, your advert shows the "Fair price" badge, which is highlighted in invitations. If it is not, no negative badge is shown; your advert remains published. In sales there are no public results: you set the price yourself with the valuation against the market that we give you, and we tell the invited buyers whether the price is fair.

Who decides. You set the price freely. The meter is for guidance only and is not a formal valuation. You can ask us for a review if you believe the calculation is wrong.

Legal basis. Legitimate interest (6.1.f) in offering transparent price information to tenants and buyers.

5.3. Scam detection in the chat

What we analyse. An automated system reviews chat messages for typical scam patterns, for example:

• requests for payment before the viewing or the signing (Bizum, bank transfers, money transfers, gift cards, cryptocurrencies),
• account numbers, links to external websites or to other messaging apps,
• requests for sensitive documents outside the Platform's channels,
• other known fraud indicators [to be defined].

What happens. If a pattern is detected, an automatic warning is shown to the user (for example, "Never pay before viewing the property"). The system does not block anyone on its own. If the risk is high or there is a report, a member of the team may review the conversation and, in serious cases, block the account immediately as a precautionary measure; that decision is always reviewed by a person and reasons are given (art. 17 DSA).

What we do not do. The Llavely team does not read your conversations routinely: it only accesses them when there is a high-risk alert, a report, a support request from you or a legal requirement. We do not use the content of chats for advertising.

Your telephone number is not shared with the other party until you decide to do so.

Legal basis. Legitimate interest (6.1.f) of Llavely and of users in preventing fraud (recital 47 GDPR) and in the security of the Platform.

5.4. Automatic document verification

The automatic selfie comparison and the validation of documents (identity, payslips) may produce an automatic result. If the result is negative or doubtful, a member of the team reviews it before refusing verification, and you can always ask for a manual review or use the alternative in section 4.

---

6. Prevention of money laundering

In sales transactions in which Llavely acts as a property intermediary (and in tenancies with a monthly rent of €10,000 or more), Llavely is an obliged entity under Ley 10/2010, of 28 April, on the prevention of money laundering and terrorist financing (art. 2.1.l).

Therefore, as required by law (art. 6.1.c GDPR):

• We identify buyers and sellers and, where applicable, their beneficial owner (arts. 3 and 4 Ley 10/2010). We check the buyer's DNI or NIE before each viewing.
• Before the reservation or the arras, we request information on the professional or business activity and the source of funds, and we check it (art. 5 et seq.).
• All payments, including the 1% deposit, are made by bank transfer, so that they can be traced.
• We check whether you are a politically exposed person and screen you against international sanctions lists.
• We analyse transactions and, if we detect any indications of money laundering, we are obliged to report them to SEPBLAC (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales, the Executive Service of the Commission for the Prevention of Money Laundering). The law prohibits us from informing you that a report has been made (art. 24 Ley 10/2010).
• We keep the documentation for 10 years from the end of the business relationship or the execution of the transaction (art. 25 Ley 10/2010).

Restriction of rights. In the context of these obligations, the law restricts some of your data protection rights (art. 32 Ley 10/2010): for example, the right of access will not be granted in respect of reports to SEPBLAC.

---

7. With whom do we share your data?

7.1. With other users

In sales:

• The seller sees, in their portal, your name, the date of your viewing, our team's feedback on it and the offers you make. We never show them your DNI, your bank details or the documents on the source of your funds.
• The invited buyer sees the photos, the video, the floor plan, the virtual tour, the price and the property details; the exact address, once the viewing is confirmed.
• If you reach an agreement, each party learns the other's details that must appear in the arras and in the deed.

In lettings:

• With advertisers (landlords and agencies), the part of your profile that you decide to show when accepting an invitation and, if you mark "I'm interested" on their property, the tag "Interested in your flat" next to your profile. We never give them your payslips or your documents: only the result (e.g. "income verified", rent-to-income ratio, "identity verified").
• With tenants, the necessary details of the advert and the advertiser (display name and verifications). Published properties can be seen on the website without the exact address, which is only shared when the viewing is confirmed.
• Your telephone number, only when you decide to share it.
• For now, Llavely does not request or publish reviews.

Whoever receives this data is responsible for its use and may only use it for the specific transaction.

With our partner lawyers, for the legal services relating to sales and inheritances (section 3.7).

7.2. With providers that process data on Llavely's behalf (processors)

We work with providers that help us provide the service. They have signed a data processing agreement (art. 28 GDPR), only use the data in accordance with our instructions and apply appropriate security measures.

7.3. With third parties that process the data as independent controllers

---

8. Artificial intelligence: transparency (Regulation (EU) 2024/1689, art. 50)

• Help chat. The help chat assistant is an artificial intelligence system, not a person. We tell you so at the start of each conversation and you can ask to be assisted by a person at any time: if a member of the team is online, they will assist you in the same chat; if not, we will reply to you by email. It does not decide anything about you.
• Phone and WhatsApp. If you call and the team cannot pick up, or if you message us on WhatsApp, you are attended by Coco, an artificial intelligence virtual assistant, not a person. She tells you so at the start. The call is transcribed in order to help you (we do not keep the audio). You can ask at any time for a member of our team to contact you. She makes no decisions about you.
• What data it uses. What you write and the Llavely help information prepared by our team. We recommend that you do not share sensitive data in the help chat (health, documents, passwords). We keep the conversation for 3 months from the last reply (section 3.1).
• Training. The provider of the model, Anthropic (Claude model), acts as a processor and does not use your conversations to train its models.
• Tenant verification. An artificial intelligence system checks all the documents tenants provide (identity, income and optional ones). If something does not add up, a member of the team reviews it, and you can always ask for a human review (section 4.2).
• Help with writing adverts. The AI can suggest text for a property listing based on the data entered by the advertiser. It is a suggestion: the advertiser reviews it, edits it and decides whether to publish it, and is responsible for the final content.
• Errors. The AI can make mistakes. Do not use it as legal or financial advice.

---

9. International transfers

We prefer providers that host data in the European Economic Area. If any provider processes data outside the EEA, we will only do so with one of the following safeguards:

• an adequacy decision of the European Commission (for example, for US companies certified under the EU-US Data Privacy Framework), or
• standard contractual clauses approved by the Commission (art. 46.2.c GDPR), with any supplementary measures that may be necessary.

You can request information on the safeguards applied by writing to legal@llavely.com.

---

10. Retention periods: summary

Once these periods have elapsed, the data is deleted or irreversibly anonymised.

---

11. Your rights

You can exercise the following rights at any time, free of charge:

How to exercise them. Write to legal@llavely.com or by post to Amerevo, S.L., Monte Esquinza, 9, 28010 Madrid, stating which right you wish to exercise. If you write from your account's email address, we will not normally need anything further; if we have reasonable doubts about your identity, we may ask you for additional information. You can view, correct or delete much of your data directly from your account.

Time limit. We will reply within one month, which may be extended by two further months in complex cases (we will let you know).

Limitations. Some rights may be restricted where we must keep data to comply with a legal obligation (for example, anti-money laundering or tax obligations) or for the defence of claims.

Complaint to the supervisory authority. If you believe we have not handled your rights properly, you may lodge a complaint with the Agencia Española de Protección de Datos (C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es · electronic office: sedeagpd.gob.es). We would be grateful if you would write to us first [or to our DPO] so that we can try to resolve the matter.

---

12. Minors

Llavely is intended only for people over 18. During identity verification we check the date of birth. If we find that an account belongs to a minor, we will close it and delete their data.

---

13. Security

We apply technical and organisational measures appropriate to the risk (art. 32 GDPR), including:

• Encryption of communications (HTTPS/TLS) and of stored documents.
• Passwords stored using secure hash functions (we never store your password as it is).
• Restricted access to verification and transaction documents (payslips, DNI, nota simple, source of funds, deposit receipts): only authorised staff and, in sales, the lawyers handling the transaction, with access logging.
• Access to the seller portal via personal links sent to the seller's email address, without a password.
• The 1% deposit is held in a separate bank account, which is not used for any other purpose.
• Separation of documents and results: advertisers only see results.
• Internal dashboard with role-based permissions; data exports (CSV) are limited to authorised staff and are logged.
• Automatic deletion of lettings verification documents after verification.
• Backups, regular testing and a security breach management procedure (notification to the AEPD within 72 hours and, where appropriate, to the people affected).
• Staff training and duty of confidentiality.

---

14. Changes to this policy

We may update this policy to reflect legal changes or changes to the service. We will always publish the current version with its date. If the changes are significant (for example, new purposes or new recipients), we will notify you in advance by email or on the Platform and, if the basis is consent, we will ask you for it again.

---

15. Contact

For any privacy matter: legal@llavely.com · Amerevo, S.L., Monte Esquinza, 9, 28010 Madrid.