Privacy policy
Reference translation. The legally binding version is the Spanish original.
Last updated: 22 August 2026
1. Data controller
Alberto Fuentes Márquez, Spanish tax ID 29616725Q, owner of the Colivea trading name, is responsible for personal data provided through the website, portals, email, telephone or Colivea operational channels.
- Activity: room rentals in shared flats
- Email: info@colivea.es
- Telephone: +34 681 870 093
- Postal address: Calle Doctor Delgado Carrasco 4, 21410 Isla Cristina (Huelva), Spain
2. Data we collect
- Availability and application forms: name, email, phone, expected move-in date, duration and room preference.
- Visit requests from prospective tenants: selected room, day and time, name and telephone number to arrange the appointment. Email is optional and is used only to send confirmation. Notes are optional and must be limited to visit logistics. To show a room we do not request age, employment, income, nationality, identity documents, payslips, a guarantor or solvency documents.
- Contract: if a rental is formalised, identification documents, bank details needed for deposit settlement and relevant address information.
- Separate house-rules acceptance: within a formal application, renewal or re-signing process we retain the name, telephone number, timestamp, document version and hash, reading time and progress, and objective confirmations. The IP address and browser are transformed into non-reversible HMAC evidence and are not stored in clear text. We do not request or retain answers about personality, private habits, employment or income in this acceptance.
- Animals, pre-screening and authorisation: whether animals will live in the room. For cats we collect the name and approximate age; breed is optional, and the form does not request microchip or registry numbers, weight or veterinary documents. For dogs and other animals requiring specific assessment, we may collect species, breed or cross components, age, weight, indoor adaptation, relevant behaviour, identification, registration, responsible person, health confirmations and dog liability-insurance details. We retain the policy version, its result and any additional refundable-security breakdown. Recognised assistance dogs use a separate route and the public form does not request the person's medical data.
- Communications: operational emails and messages exchanged with you. Internal tools may help organise conversations or prepare drafts under human supervision; they are not used to decide automatically whether you may visit a room.
- External visitors under contracts containing the visitor policy: name and first surname supplied by the tenant, host room, date, type, time, authorisation status and contract version. Where an exception or incident exists, only the relevant category, reason, operator and evidence are retained. We do not routinely request the visitor's relationship, identity-document copy, telephone number or email address.
- Security video surveillance, where installed: event-triggered image clips in the signposted common area, event date and time and, only where a specific incident is opened, the reason, interval reviewed, person accessing it and result. Audio, facial recognition, biometric processing and automated identification are not used.
- First-party web analytics, with consent: pages viewed, time and duration, language, device resolution, traffic source and a browser session identifier stored in localStorage. We do not use Google Analytics or advertising trackers.
- Contractual portal activity: if you are a current tenant, access to your portal and private operational links may be associated with your account to provide support under the rental relationship.
Analytics records are kept for a maximum of two years and are then purged automatically. Raw private-link tokens and query strings are not included in analytics events.
3. Purposes
- respond to enquiries and rental applications;
- arrange, confirm, reschedule or cancel a visit for objective scheduling, availability or safety reasons, recording the reason and keeping human review available;
- apply the published animal pre-screening rules and conduct human review where required;
- prepare and manage a rental contract where applicable;
- manage contractual visitor limits, authorise occasional access and review shared-living incidents without routine movement tracking;
- protect people, belongings and shared installations and reactively review a reported breakage, missing item or unauthorised external access where lawful video surveillance is installed;
- meet legal and tax obligations;
- send operational information such as receipts, notices and maintenance updates;
- improve the website using first-party analytics where consent has been given.
Commercial advertising is not sent without express consent.
4. Legal bases
- Article 6(1)(b) GDPR: steps requested before entering into a contract, including arranging a requested visit, and performance of the contract.
- Article 6(1)(c) GDPR: compliance with legal obligations.
- Article 6(1)(f) GDPR: proportionate security, support, fraud prevention, evidence preservation and organisation of shared living, after balancing the rights of affected people.
- Article 6(1)(a) GDPR: consent for optional analytics or any additional purpose requiring consent.
Short notice for visitors (Article 14 GDPR)
If you visit a Colivea tenant, the tenant gives us your name and first surname, date, visit type and time. The controller and contact details are stated above. We use the data to manage occasional access and the shared-living rule and, only if an incident occurs, to retain relevant evidence. The tenant's processing is necessary for their contract; for you as a visitor, the legal basis is our proportionate legitimate interest in organising shared living and protecting residents. We do not use visitor data for advertising or solely automated decisions producing legal effects.
We do not request your relationship with the host or an identity-document copy. An ordinary record is deleted or pseudonymised 90 days after the visit. A longer period requires a specific incident or claim and is limited to relevant evidence. You may exercise access, rectification, erasure, objection and restriction rights at info@colivea.es and complain to the AEPD. The host must give you this notice before submitting the declaration.
Full security video-surveillance notice
Colivea does not permit active video surveillance inside rented homes, including internal shared areas such as the entrance hall, corridors, living room, dining room or kitchen. A clause, sign or signature does not make such processing lawful. If the property inventory identifies an active internal device, contract signing is blocked until removal or the effective and verifiable cessation of all capture, recording and access is documented.
Video surveillance may only be assessed where it is lawfully installed in a building common area outside the interior of the homes. In that case, the controller and rights channel are identified on the sign and in the location-specific notice. The legal basis must follow the applicable balancing assessment and does not arise from merely signing a rental contract.
The field of view must be limited to access points and shared assets or installations requiring protection, without capturing home interiors, private areas, neighbouring homes or unrelated spaces. A warning sign is displayed before entering the captured area. The system must not record audio, perform facial or biometric recognition, identify people automatically, or routinely monitor cleaning, visitors, shared-living behaviour, schedules or habits.
Ordinary clips are automatically deleted within a maximum of 30 days. Ordinary human access is limited to the controller and requires an identified incident, a documented reason and the minimum time interval, with an access record. Only the relevant extract may be preserved. Images are not circulated in groups or used to expose a person publicly.
The cloud provider processes clips as a service provider under the applicable terms. Images may be disclosed, where a sufficient legal basis exists and only for the incident, to law-enforcement bodies, courts, insurers or professionals handling it. You may exercise access, erasure, restriction and objection rights at the email above and complain to the AEPD. Third-party rights will be protected when responding to an access request.
5. Retention
- Prospective-tenant visits and linked enquiries: deletion or pseudonymisation 90 days after the visit or cancellation. Only relevant evidence may be retained longer for a specific documented claim, obligation or investigation.
- Other unsuccessful enquiries and animal pre-screening data: while active and then for the operational or specific claim period stated in the relevant channel.
- Contract and accounting evidence: during the relationship and afterwards with restricted access for the applicable legal-preservation or limitation period.
- Ordinary external-visitor records: deletion or pseudonymisation 90 days after the visit; only relevant evidence may be retained for a documented open incident or claim.
- Lawful video-surveillance clips from outside the home interior: automatic deletion within 30 days; an incident extract is limited to necessary evidence and reviewed until handover or closure.
- Tax records: for the period required by applicable tax law.
- First-party analytics: maximum two years.
6. Recipients
Data is not sold. It may be disclosed where necessary to:
- tax authorities and public bodies where required by law;
- Rentila and internal Colivea systems used to register enquiries, leads, contracts, receipts and incidents;
- tax and accounting advisers under confidentiality obligations;
- hosting, communications, signing, security, support or drafting-assistance providers acting under appropriate data-processing terms.
International transfers outside the European Economic Area are not made unless the provider offers the safeguards required by law.
7. Automated decisions
We do not grant, refuse, delay or cancel visits through a profile score or solely automated decision. Age, employment, income, budget, nationality, origin and links with Huelva are not criteria for access to the visit schedule. A cancellation requires a recorded objective reason and can be reviewed by a person.
We do not make decisions on signing, changing or ending a contract based solely on automated processing. The later animal form applies published compatibility rules and provides human review for uncatalogued cases or possible errors.
8. Your rights
You may request access, correction, deletion, restriction, portability or objection by emailing info@colivea.es with “DATA” in the subject line.
If you believe your request has not been handled correctly, you may contact the Spanish Data Protection Agency (AEPD).
9. Security
Reasonable technical and organisational safeguards are used, including TLS encryption, restricted access, protected backups and password controls.
10. Changes
Updates will be published on this page with the relevant date.