2.2 Automatically collected data

a) Registration as a tenant via Facebook/Google: When you register via Facebook or Google, we collect your name, email, date of birth and gender directly from that platform.

b) Google Analytics: While you browse or interact with the content of our website or App, we collect certain dissociated data and information via Google Analytics, such as the IP address of your device, the type of device and browser used, the size of your screen, the geographic location, the language used, websites visited and the time and date they were visited.

For more information on the automatically collected data, please refer to our Cookies Policy.

3. What shall we use your personal data for?

3.1 To provide our services

• To manage the creation of your user account as a tenant and allow you to use or modify it. In order to save your search preferences, receive alerts and make booking requests, you need to have a user account and identify yourself as a user. Furthermore, to show the landlord that you are the suitable tenant, we give you the option to write a short description about yourself. In addition, normally in the case of Germany and France, we may request you to proof your identity, residency and solvency so that the landlord can accept your booking request.
• To manage the creation of your user account as a landlord and allow you to use or modify it. In order to manage the advertisements of your property or properties and receive booking requests, you need to have an account and identify yourself as a user. Furthermore, we need your data to schedule the visit to your property by our Homecheckers team, in case you opt for this service. They create digital floor plans, record videos and take photos that are then displayed in our advertisements.
• To allow the payment of the booking via our platform, if you are the tenant; and to manage the collection, if you are the landlord.
• (Spain and United Kingdom) To enable both parties to easily sign the lease agreement through our platform. To do so, you shall provide the requested data.
• To get in touch with you in order to provide you with relevant information about your booking request. We may contact you by email, phone, or SMS, depending on the reason for such communication.
• To offer you the best attention and assistance. Our Help Center will help you at any time by answering any doubts, addressing your comments and suggestions, or solving your claims. To provide you with such help, we need to have access to your personal data.
• To solve claims, help tenants find another property when the booking request has not been accepted by the landlord, and mediate in disputes that may arise between tenant and landlord. Our Customer Experience Team collects the relevant information and data to solve claims and mediate in disputes.
• Any other matter related to the provision of our services.

3.2 To keep you updated about our news, promotions and contests

We shall use your Personal Data to send you news, products and promotions related to Spotahome. In any case, please bear in mind that you may unsubscribe from these communications at any time. To do so, simply click on the “Unsubscribe” link in any of such communications.

Our Marketing Team is highly proactive and regularly launches campaigns, promotions, contests and raffles, and other promotional actions, and you shall provide certain data in order to participate.

3.3 To prevent potential fraud

In order to create a trustworthy environment for you, Spotahome, its partners and providers, we may use your personal data for the detection and prevention of fraud and other illegal or unwanted activities. Similarly, we may use personal data for risk assessment and security purposes, including the authentication of users and properties. For such purposes, we may have to stop certain bookings or put on hold the requests until we have finished our assessment.

To the extent permitted by applicable law, we may receive additional information about you from third party service providers and/or partners, and combine it with information we have about you. For instance, we may verify or authenticate all personal/business identifiable data such as your name and last name(s), date of birth, mobile number, address, ID, etc. To do so, we will conduct checks against databases and other information sources from third parties such as fraud prevention agencies, telecom providers and identity verification solution providers. Similarly, we may verify your mobile number with your mobile provider to prevent SIM swap fraud and we may verify the authenticity of the photos of your properties through third party providers.

Furthermore, we use third parties to process payments or provide billing collection services. When a payment concern or issue is raised for the payment of your booking at Spotahome by either you or by the holder of the debt / credit card used to make the payment, we need to share certain details related to the booking request with the payment service provider and the relevant financial institution to handle the request. This may also include a copy of your booking request confirmation or the IP address used to make it and other relevant information. We may share information with relevant financial institutions, if we consider it strictly necessary for fraud detection and prevention purposes.

Likewise, we also use for fraud prevention purposes the details about how you use and interact with our website, app or services, including the device you use. This helps us carry out security and fraud monitoring apart from improving the service you get from us. You authorize your wireless operator, to disclose your mobile number, name, address, email, network status, customer type, customer file, customer role , billing type, mobile device identifiers (IMSI and IMEI) and other subscriber status and device details, if available, to our third-party service provider, solely to verify your identity and prevent fraud for the duration of the business relationship between our marketplace and who we digitally introduce you to i.e. tenants / landlords. Specifically: AT&T, Sprint, T-Mobile, US Cellular, Verizon, or any other branded wireless operator – a user whose phone is registered in the USA. Telus, Bell, Rogers, or any other branded wireless operator – a user whose phone is registered in the Canada.

3.4 To claim amounts owed to the company

In cases of non-payment, the data related to the debt and the user may be communicated to third companies specialized in the recovery of unpaid amounts. These third companies are duly licensed and accredited to manage the breach of monetary obligations. Likewise, the referred third companies are contractually obliged to protect your personal information, having access to it and to carry out the assigned tasks.

3.5 To improve our service

At Spotahome we are constantly working to improve our App and Website. This is why we run tests, carry out user interviews, conduct researches and analytical studies, as well as develop new products to improve the quality of our service. By doing so, we are able to optimize it, improve its usability, make it more functional and adapt it to your needs. In many occasions, these activities imply the usage of some of your personal data or dissociated data obtained, for example, via Google Analytics.

Furthermore, through the satisfaction survey, we analyse the existent room for improvement to offer you a better experience and avoid recurring problems or bad experiences.

3.6 To manage your application in our recruitment processes

In order for you to apply for any of the job positions published on our website, and for us to be able to manage the recruitment process, you need to provide some data.

4. What is the legal basis for this data processing?

We process your data for the different purposes stated above on the following legal grounds:

4.1 Contractual relationship It is the relationship that applies when you use our service (3.1).

4.2 Legitimate interest: To prevent potential fraud (3.3).

4.3 Your consent: If you are a user who is registered as a tenant or as a landlord, you have authorised us to process your personal data for the remaining purposes by clicking the box on the registration form. In the case of “work with us” you give consent by filling in the corresponding form.

5. How long do we keep your data for?

In general terms, data required for the provision of the service shall be kept for as long as they are necessary for this purpose or until you expressly request us to delete them. Nevertheless, such data shall be retained for a period of 6 years at the disposal of public authorities, judges, and courts for determining and defending any possible liabilities arising from the processing.

We may keep some of your personal data to the extent necessary for our legitimate interests such as to detect and prevent fraud. Data collected for this purpose shall remain retained for a period of 10 years at the disposal of public authorities, judges, and courts for determining and defending any possible liabilities arising from the processing.

Data used to send you news and promotions shall be used until you request us to stop using them. Please note that you can request us to stop sending you news, personalised offers, and promotions at any time by simply clicking on the “Unsubscribe” link in any of our communications.

Data regarding your job application in our selection processes shall be kept for a period of 6 months and we shall request your permission to keep them for another 6 months. If you do not agree, such data shall be deleted from our system.

Finally, data required to improve our service shall be kept for a maximum of 1 year.

6. With whom do we share your data?

6.1 With tenants and landlords

In order to manage booking requests and subsequent stays, certain information needs to be shared with other platform users, including your personal data. This is necessary for the due performance of your contract with us, as indicated below:

As a tenant, every time you send a booking request we share certain information about you with the potential landlord, such as your profile and documents proving your identity, residency and solvency (the last two only apply in France and Germany). When your booking is confirmed, we share your contact details with the landlord.

As a landlord, every time you have a confirmed booking, we share with the tenant your full name, contact details and full address of the property to coordinate the booking.

6.2 With our Homecheckers team

If you are a landlord, to schedule the visit to your property with our Homecheckers team (they record videos, take photos and create digital floor plans which are then displayed in our ads) it is necessary to share with them your contact details and full address of the property. All the members of the team have signed the pertinent contract for the processing.

6.3 With companies of the SPOTAHOME Group

We need to give or allow access to your personal data to certain entities of the Spotahome group for service purposes. The entities comprising the Spotahome Group are listed below:

• COKIDOO STUDIOS SLU (ES)
• SPOTAHOME LTD (UK)
• SPOTAHOME SARL (FR)
• SPOTAHOME PORTUGAL, UNIPESSOAL, LDA. (PT)
• SPOTAHOME GERMANY GmbH (DE)
• SPOTAHOME ITALY S.R.L. (IT)

6.4 With necessary providers for the provision of the service

Providers who assist us with various issues related to the services. These providers may be located within or outside the European Economic Area (“EEA”). If they are located outside the EEA, we ensure that the country of destination is declared to have an appropriate level by the European Commission. In the case of the USA, we ensure that the entities are attached to the Privacy Shield.

For service purposes, such providers have limited access to your personal data to perform certain tasks on our behalf and they are bound by contract to protect and use these data solely in accordance with our instructions. To this end, Spotahome has entered into pertinent data processing agreements and verified that these agreements meet the guarantees to implement adequate technical and organisational measures so that processing is carried out in accordance with the requirements of the GDPR, ensuring the protection of your rights.

For instance, service providers may help us with the following:

• To process payments. (We are assisted by third parties to process payments, handle payment issues / concerns or provide collection and billing services. We share information with relevant financial institutions if we consider it to be strictly necessary to detect and prevent fraud).
• To provide customer support services.
• To store information securely.
• To send commercial communications.
• To perform product development, maintenance, and error correction tasks.
• To prevent fraud.
• To collect and recovery debts.
• To verify or authenticate your identity and residency. (We share with third parties your personal identifiable data. These checks will place a soft search or footprint on your credit file. It is only visible to yourself and these third parties -our providers-. This does not impact your credit score or report. It is not a hard footprint which other organisations, such as banks make credit or lending decisions on.)

6.5 Competent Authorities

We shall disclose your personal data to government authorities as requested by law or as strictly necessary for the prevention, detection or prosecution of criminal acts and fraud, or as otherwise required by law. We shall have to disclose personal data to the competent authorities to protect and defend our rights or properties or the rights and properties of our collaborators or users.

7. Confidentiality and Security

Spotahome makes all reasonable efforts to keep the confidentiality of personal information processed through the Web and the App. We have strict security levels to protect the personal data processed from any inadvertent loss and unauthorised access, processing, or disclosure, considering the state of technology, nature, and risks to which the data are exposed. However, we shall not be responsible for your use of the data (including username and password) in Spotahome in platforms other than our Web or App.

8. What are your rights?

In accordance with the applicable legislation, you can exercise the rights detailed in this section free of charge and at any time. We may require you to verify your identity and residency before taking any action related to your request.

To exercise any of your rights you must send an email to privacy@spotahome.com.

Please note that we shall make everything to deal with your request as soon as possible, however we would like to advise you that the maximum period set forth in the GDPR to attend such requests is one month upon the date of the request.

For your information, you can exercise the following rights:

• Access: You have the right to know whether we are processing your personal data. If so, we shall give you access to the data we are processing, as well as the recipients of such data (if any), the storage period and the purpose of the processing, among other things.
• Rectification: You can request us to modify inaccurate or incomplete data. Your request shall include the data you are referring to and the correction to be made.
• Erasure: You can request us to erase the Personal Data we hold about you (i) when they are no longer necessary for the purpose for which we are using them; (ii) when you withdraw your consent, in the case they are solely processed for such purposes. Nevertheless, in certain cases we shall keep your data blocked for a certain period of time due to legal obligations.
• Portability: You can request us to deliver directly to you or to a third party, provided that it is technically possible, a structured file, of common use and readable by a computer system containing your personal data.
• Limitation: You can request us to temporarily restrict the use of your Personal Data (i) when you believe there is any type of inaccuracy in your data, until we verify or update them (please note that in the meantime you shall not be able to use the Service); (ii) when we no longer need your data to fulfil the purposes indicated in the aforementioned section 4 but you prefer us to keep them so that you can exercise or defend yourself against any legal claim; and (iii) when you do not agree with us using your data for any of the purposes listed in section 4.2 of this Privacy Policy, while we assess whether our legitimate interest in Spotahome prevails over your right to oppose to our use of these data.
• Objection:You have the right to object that we use your data to send you commercial communications. We inform you that we use automated data processing, therefore there is no option to object.

Lastly, we inform you that you can file a complaint with the competent data protection supervisory authority, which in your case is the Spanish Data Protection Agency.

9. Could this Privacy Policy be modified?

Yes! So please read this policy often to check if there is any update. Nevertheless, we send you an email if we make any material change.

Thanks a lot for reading!