Alki Rooms
Privacy policy
Your data is yours. Here's what we collect, why, for how long, and how you take back control in one click.
On this page
# 1. Data controller
- Controller
- [PLACEHOLDER · LEGAL_TITULAR]
- Tax ID (CIF)
- [PLACEHOLDER · LEGAL_CIF]
- Registered address
- [PLACEHOLDER · LEGAL_DOMICILIO]
- Privacy email
- antonio@alki.es
- Data Protection Officer
- Not appointed (the cases under Art. 37 GDPR do not apply).
# 2. What data we process and why
We process your personal data for the following purposes, each with its legal basis and retention period:
2.1 · Handling enquiries
Data: name, phone, email, nationality and occupation. Purpose: to answer your enquiries and manage your interest in a room.
Legal basis: your consent and pre-contractual measures (Arts. 6.1.a and 6.1.b GDPR). Retention: 2 years without a contract; 6 additional years if you rent.
2.2 · Managing the contractual relationship
Data: ID/residence card/passport, date of birth, financial data and a copy of your ID. Purpose: to formalise and manage the rental contract.
Legal basis: performance of the contract and legal obligations (Arts. 6.1.b and 6.1.c GDPR). Retention: up to 6 years after the relationship ends.
2.3 · Landlord acquisition
Data: contact, property and financial details. Purpose: to assess and manage collaboration agreements with landlords. Retention: same as the contractual relationship.
2.4 · Automated assessment (lead scoring)
We use an internal scoring system to prioritise and better handle requests. It produces no legal effects or automated decisions that significantly affect you.
You have the right to request human review of any assessment by writing to antonio@alki.es.
2.5 · Newsletter
We only send communications to those who have given express consent. Legal basis: your consent (Art. 6.1.a GDPR), which you can withdraw at any time from the email itself.
2.6 · Digital marketing
If you accept advertising cookies, we may show you relevant ads on platforms such as Google Ads, Meta Ads or TikTok Ads. Legal basis: your consent managed through the cookie banner.
2.7 · Web analytics
We measure use of the Website with Plausible Analytics, a privacy-friendly tool that uses no cookies and collects no identifiable personal data. Legal basis: our legitimate interest in improving the Website (Art. 6.1.f GDPR).
# 3. Who we share your data with
We don't sell your data. It is only shared, as processors under the guarantees of Art. 28 GDPR, with the providers that serve us:
- Cloudflare — hosting, CDN and Website security.
- WhatsApp Business (Meta) — messaging channel with users.
- Plausible — cookieless web analytics.
- MapLibre / Protomaps — interactive room maps.
- Homming — rental management software.
- Idealista and property portals — listing publication.
- Anthropic — AI-based assistance.
- Supabase and Railway — database and backend infrastructure.
# 4. International transfers
Some providers have headquarters or servers in the United States. These transfers rely on the EU-US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission, ensuring protection equivalent to that of the European Economic Area.
# 5. Your rights
As the data subject, you may exercise these rights at any time:
- Access — know what data of yours we process.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — ask us to delete your data.
- Objection — object to certain processing.
- Restriction — ask us to freeze the processing.
- Portability — receive your data in a structured format.
- Withdrawal of consent — at any time, with no retroactive effect.
- Not to be subject to automated decisions with significant effects.
To exercise them, write to antonio@alki.es stating the right you wish to exercise and attaching a copy of your ID or passport. We will reply within a maximum of 30 calendar days.
If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (AEPD): www.aepd.es.
# 6. Children's data
The Website is intended for people over 18. We do not knowingly collect children's data; if we detect any, we will delete it.
# 7. Data security
We apply technical and organisational measures appropriate to the risk (encryption in transit, access control and data minimisation) to protect your information against unauthorised access, loss or alteration.
# 8. Changes to this Policy
We may update this Policy to reflect legal changes or changes in our processing. The version in force is always the one published on this page, with its last-updated date.
This is a courtesy translation. In case of any discrepancy, the Spanish version prevails.