PropertyList.es - Privacy Policy

Effective date: 19 August 2026

Introduction

http://PropertyList.es (“we,” “us,” “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose information when you use our platform. By accessing or using our website and services, you agree to this Privacy Policy. This policy complies with the General Data Protection Regulation (GDPR) and Spanish data protection laws and applies to all products and services offered by http://PropertyList.es.
We comply with the EU GDPR for all EU/EEA data subjects and analogous national laws where applicable, including the UK Data Protection Act 2018 (UK GDPR). Foreign agencies and their clients remain subject to these data protection requirements.

Information We Collect

1. Personal Data

We may collect personal data that you voluntarily provide to us, including:

Name
Email address
Phone number
Business or company details
Business address
Photographs and logos for profile customisation
IP address

Legal Basis:

Consent: For marketing communications and profile customisation.

Contractual Necessity: To create your account, provide the services and manage your account.

2. Usage Data

We may collect the following data automatically when you use our platform:

IP address
Browser type and version
Operating system
Access dates and times
Pages viewed
Clickstream data
Property view counts to generate reports

Legal Basis:

Legitimate Interests: To enhance platform functionality and user experience.

3. Cookies and Tracking Technologies

We use cookies, pixels, and similar tracking technologies to improve your experience. Cookies may include:

Essential Cookies: Necessary for platform operation.
Analytical Cookies: For user behaviour analysis (e.g., property views).
Advertising Cookies: To display relevant ads (if applicable).
Consent Mechanism: A cookie banner will appear when you first visit, allowing you to accept or reject cookies.

Verification of Professional Activity

In order to maintain the integrity of our professional network, PropertyList may request verification of your real estate activity before granting access to certain services, groups, or features.

For this purpose, we may ask you to provide one or more of the following documents: IAE certificate showing real estate activity, RAIA registration (Registro de Agentes Inmobiliarios de Andalucía), or Modelo 036/037 (Alta en Hacienda).

The legal basis for processing this information is our legitimate interest in ensuring that users participating in our platform are legally registered real estate professionals (Article 6.1.f of the GDPR).

The documents provided will be used exclusively for verification purposes, will be handled confidentially and securely, and will be deleted once the verification process is complete.

No information from these documents will be shared with third parties except where legally required.

In addition to tax and registration documents, PropertyList may request a copy of your Professional Indemnity Insurance certificate. This document is used solely to verify your eligibility to operate as a protected professional within our network. Consistent with our security protocols, this document will be handled confidentially and deleted once the verification process is complete.

How We Use Your Information

We use the data we collect for the following purposes:

To provide and maintain our services (Contractual Necessity)
To manage user accounts and profiles (Contractual Necessity)
To send important updates and marketing materials (Consent)
To process transactions and manage orders (Contractual Necessity)
To analyse platform performance and improve services (Legitimate Interests)
To enforce our Terms and Conditions (Legitimate Interests)
To respond to legal requests and prevent harm (Legal Obligation)

To protect agent assets: We do not access or reallocate leads that an agent brings to the platform themselves through their own marketing. Only platform-generated leads are subject to the response-time reallocation rules defined in our Terms and Conditions.

To facilitate internal dispute resolution and IP enforcement: We may process listing data, timestamps, and account activity to investigate claims of intellectual property infringement (e.g., photo theft) or commission sharing disputes between members. This is done under our Legitimate Interest to maintain a fair and professional marketplace.

Data Storage, Security, and Retention

1. Storage

All personal data is stored on secure servers within the European Economic Area (EEA). Any transfers of personal data outside the EEA will be made using EU-approved safeguards, such as Standard Contractual Clauses or based on adequacy decisions (e.g., transfers to the UK).

2. Security

PropertyList.es adopts a ‘Data Protection by Design and by Default’ approach in compliance with GDPR. This means that we have implemented appropriate technical and organisational measures to ensure that only personal data necessary for each purpose is processed, and that data is processed with the highest standards of security and privacy.

We employ advanced cybersecurity measures, including:

Encryption of sensitive data
Regular server monitoring
Use of CloudFlare for enhanced security

Note: While we strive to protect your data, no system is completely secure.

To protect our members’ proprietary listing data and images, we employ active monitoring for automated scraping, data mining, and bot activity. We process IP addresses and traffic patterns to identify and block unauthorised attempts to harvest agent data. This ensures that your listings are not being exported to unauthorised third-party platforms without your consent.

3. Retention

We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires. The periods below apply unless a longer period is required by law or by an open investigation, claim or dispute.

Account and profile data. While your account is open, then 12 months after it closes.
Listings and listing history. While published, then 24 months after removal.
Contacts, leads and correspondence you enter in the CRM. Yours to delete at any time. On account closure they are deleted 90 days afterwards. We process them on your instructions under clause 4.4 of the Terms.
Platform-generated leads and enquiries. 24 months from the last activity on the lead.
Invoices, payments and the credit ledger. 6 years from the end of the accounting year, as required by Spanish commercial and tax law.
Records of consent. While the consent stands, then 3 years, so we can show it was given.
Support tickets and correspondence with MLS Support. 24 months from closure of the ticket.
Confidential reports. 12 months, as set out below.
WhatsApp group membership and moderation records. 12 months after you leave the group.
Security and access logs. 12 months.
Analytics. Google Analytics data is kept for 14 months. Our own aggregated measurement is kept indefinitely and contains no personal data.
Backups. Overwritten in the ordinary backup cycle, no later than 35 days.

You have the right to request deletion of your personal data at any time, subject to the legal obligations above.

In the event of an account suspension or investigation for fraudulent activity, we may extend the retention period of relevant data (including listing history and communication logs) beyond the standard one-year limit. This data is retained as necessary to conclude investigations, prevent re-registration by banned users, or comply with legal and audit requirements

4. Data Breach Protocols

In the event of a data breach:

Immediate action will be taken, such as isolating affected servers.
We notify the Spanish supervisory authority (AEPD) without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Where the breach is likely to result in a high risk to your rights and freedoms, we notify you without undue delay.

We do not sell your personal data. We may share it only in the following cases:

Trusted third-party service providers, such as hosting, payment processors, and marketing service providers, who act as Data Processors on our behalf. These third parties are contractually obligated to safeguard your data and process it only as instructed by PropertyList.es. Our current processors are: DigitalOcean (hosting of the platform and databases, within the European Economic Area), Cloudflare (security, content delivery and DNS), Stripe (payments), Google (AI features via Gemini, app notifications and diagnostics via Firebase, and website measurement via Google Analytics and Search Console) and Apple (push notifications on iOS devices). We give at least 30 days’ notice before adding or replacing a processor, as set out in clause 4.4(g) of the Terms.

Legal Requests: Compliance with subpoenas or court orders (Legal Obligation).
Business Transactions: In the event of a merger, sale, or asset transfer (Legitimate Interests).
Trusted Partners: Hosting providers, payment processors, or analytics providers bound by Data Processing Agreements (DPAs).

Distribution of your listings and business contact details. If you enable an XML feed, API access, your MicroSite or a Website Builder site, the listing content and the business contact details attached to it (such as your name, agency name, business phone number and business email) are published or transmitted to the destinations you have enabled. These may include your own website, other property portals you connect the feed to, and third-party applications or AI assistants that access our published interfaces. We do this to provide the service you have asked for, and you control it by enabling or disabling the relevant integration or by contacting MLS Support. We do not sell this data. Under clause 3.9 of the Terms, other Members may also market a Listing you have shared on the MLS; their marketing carries their own brand and contact details, and your agency name and business contact details are shown to them inside the Platform for the purpose of the collaboration rather than in their public posts. Marking a Listing “Do not share with other agents” withdraws it from that use.

Lead Confidentiality

1. Agent-Sourced Leads (Private Assets)

• Policy: PropertyList acknowledges that leads brought into the platform directly by an agent (through their own external marketing, personal networks, or private tools) are the exclusive professional assets of that agent.

• Protection: PropertyList does not sell, share or distribute these leads, and does not use them for our own marketing. We access them only where necessary to provide, secure or support the service, for example to investigate a fault you report to us, or to comply with a legal obligation. They remain under the control of the agent who provided them.

2. PropertyList-Generated Leads (Platform Allocation)

• Allocation: Leads generated by the PropertyList.es platform are initially allocated to the agent holding the primary listing.

• Reallocation Rule: To maintain a high-quality experience for the end-user (buyer or renter), if the primary listing agent does not respond to a platform-generated lead within 72 hours, PropertyList reserves the right to reallocate that lead to agents with duplicate or similar listings.

• Purpose: This ensures that the buyer/renter is not ignored and receives a professional answer, even if the original agent is inactive.

User Rights

Under GDPR, you have the following rights:

Access: View the personal data we hold about you.
Correction: Rectify inaccurate or incomplete data.
Deletion (“Right to Be Forgotten”): Request erasure of your personal data.
Portability: Obtain a copy of your data in a portable format (when technically feasible).
Restriction: Limit how your data is processed.
Objection: Object to data processing based on legitimate interests or direct marketing.
Withdraw consent: Where we rely on your consent, withdraw it at any time. This does not affect processing carried out before you withdrew it.

You have the right to object to the processing of your personal data, including for direct marketing purposes. If you wish to exercise this right, please contact MLS Support or email us at [email protected]

We will consider your objection and respond in a timely manner. If we are unable to process your data based on your objection, we will inform you accordingly.

How to Exercise Your Rights: Contact MLS Support to make a request.

WhatsApp Group Participation and Data Use

If you choose to participate in our official WhatsApp groups, certain personal data may be used in line with group communication and moderation policies. This includes:

Displaying your name, business name, and phone number as part of messages
Sharing your listing details, business logos, or images if voluntarily submitted

By participating in our WhatsApp groups, you acknowledge that messages you send may be visible to other group members and that PropertyList.es may moderate or remove content that violates our Terms & Conditions.

We will never share your data beyond the scope of group administration and our own marketing of the platform. As set out in clause 3.2 of the Terms, that marketing may feature member listings, agency names and logos, and screenshots of the platform, in materials such as tutorials, demonstrations, case studies and advertising. Your WhatsApp participation is optional and can be discontinued at any time by leaving the group or requesting removal through MLS Support.

Members are reminded that while PropertyList moderates these groups, we cannot control how other participants use the contact information (name and phone number) visible in the group. Agents are encouraged to use professional-only phone numbers and are strictly prohibited from ‘harvesting’ other members’ data from these groups for external marketing purposes

User Responsibilities and Legal Compliance

All users are solely responsible for ensuring that the information they publish or share via PropertyList.es and associated WhatsApp groups complies with all applicable laws and regulations in their respective jurisdictions. This includes, but is not limited to:

Real estate marketing laws and licensing requirements
Consumer protection and advertising standards
Data protection laws (e.g. obtaining consent for sharing third-party data or images)
Anti-discrimination regulations in housing and services
Copyright and intellectual property rights for media or branding elements

By submitting content to our platform or WhatsApp groups, users confirm that they have the legal right to distribute such content and that it does not violate any local, national, or international laws. PropertyList.es assumes no liability for unlawful, misleading, or non-compliant content posted by users.

We reserve the right to remove any content that we believe may breach legal standards or our platform’s Terms & Conditions.

While we reserve the right to remove content without notice, for non-fraudulent clerical errors (such as a pricing typo), PropertyList may provide a 24 - 48 hour ‘Notice and Cure’ window for the member to rectify the error before sanctions are applied.
EU/EEA residents may exercise their rights with PropertyList.es or, if preferred, with their national supervisory authority. Users may also contact the Spanish AEPD for any concerns regarding data protection.

International Data Transfers

We store and process your personal data primarily within the European Economic Area (EEA). Some of our service providers process limited personal data outside the EEA, including: Google (as our AI provider for Instant Listing, for app notifications and diagnostics via Firebase, and for website measurement via Google Analytics and Search Console), Apple (for notifications on iOS devices), Stripe (for credit payments made on our website), and Cloudflare (for security and content delivery). Where personal data is processed outside the EEA, we rely on EU-approved safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision. A list of our processors and the safeguards in place is available on request.

Children’s Data

Our platform is not intended for users under the age of 18. We do not knowingly collect data from minors. Parental consent is required for users under this age.

Cookies Policy

We use cookies for the following purposes:

Before placing cookies on your device, we will request your consent via a cookie banner when you first visit our website. You may choose to accept or reject the use of cookies at any time. You can modify your cookie preferences or disable cookies through your browser settings.

Essential Functionality: Ensure smooth platform operation.
Analytics: Measure performance and usage patterns.
Managing Cookies: You can manage your preferences through browser settings or the cookie banner on our website.

Non-essential cookies (analytics, marketing) will only be used after the user provides explicit consent via our cookie banner. Users may withdraw consent at any time via the banner or their browser settings. Essential cookies required for platform operation will always remain active.
This cookie consent framework applies to all users, including agencies and clients accessing the platform from outside Spain, within the EU/EEA.

Mobile Application

When you use the PropertyList mobile app, we process the additional data below. Device permissions are requested only with your consent and can be changed at any time in your device settings; the app remains usable if you decline, though some features will not work.

Camera and photo library. So you can take or choose property photographs for a listing (for example, the Instant Listing feature). Photographs you add are uploaded to our servers to create and display your listing. Legal basis: performance of our service to you.

Microphone and voice recordings. So you can record a short spoken description of a property. Instant Listing uses your recording, together with your photos, to draft the listing. The audio and a text transcription of it are processed for this purpose. We use Google (Gemini) as our AI service provider, acting as our data processor under a data-processing agreement, to transcribe your recording and generate the listing text and details. We do not use your recordings for any other purpose. Legal basis: performance of our service to you.

Location. If you enable it, we use your device location to: (a) record the location of a "for sale" sign when you save one, and (b) let you search for properties near you ("search near me"). You can decline or revoke this permission at any time in your device settings, and the rest of the app stays usable. Legal basis: consent.

Notifications. With your permission, we send push notifications (for example, a new lead or activity on your listings). To deliver them we store a device push token and use the Apple Push Notification service and/or Google Firebase Cloud Messaging. You can turn notifications off at any time in your device settings. Legal basis: consent.

Device and diagnostic data. To keep the app secure, stable and working, we process technical data such as your device model, operating system and app version, language, and a device or installation identifier, along with crash and performance diagnostics provided by Google Firebase. Legal basis: our legitimate interest in operating and improving the app.

Payments. You buy credits on our website, not inside the app; payments are handled by our payment processor Stripe. The app itself does not collect your card or payment details.

App stores. When you download or install the app, Apple or Google processes data under their own privacy policies. The privacy disclosures we provide in the Apple App Store (App Privacy) and in Google Play (Data Safety) are consistent with this Privacy Policy.

Changes to this Privacy Policy

This Privacy Policy is reviewed periodically and may be updated. Changes will be posted on this page with a revised effective date. Significant updates will be communicated via email.

Contact Information

For questions about this Privacy Policy, contact MLS Support or email [email protected]

You may also file a complaint with the Spanish Data Protection Agency (AEPD) if you believe your rights have been violated.

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the relevant supervisory authority. You can contact the AEPD through their official website or by using the contact information provided on their platform.

Compliance and Audits

We regularly review our data protection practices through audits and consultations with legal experts to ensure compliance with GDPR and Spanish data protection laws.

Confidential Reports and Fraud Prevention

PropertyList operates a confidential channel through which users can report suspected scams, fraudulent listings, or problems with an agent or a property-related service. This section explains how we handle the personal data involved.

What we collect. When you submit a report, we collect the information you choose to provide, which may include your name and email address, a description of what happened, amounts and dates, any evidence or references you supply, and information identifying the agent, company, service provider or listing you are reporting (the reported party).

Lawful basis. We process this data on the basis of our legitimate interests, and those of our users and the public, in preventing fraud, protecting consumers and maintaining the integrity of the PropertyList network. Where a report concerns possible criminal conduct, we may also process it to comply with a legal obligation or to cooperate with the competent authorities.

How we use it. Reports are reviewed confidentially by our trust team. We do not publish reports or the identity of the person reporting, and we do not maintain a public list of reported parties. We do not act on a single unverified report in isolation; we look for corroborating evidence and give any reported party the opportunity to respond before taking any action under our Terms.

Retention. Confidential reports are retained for up to 12 months and then deleted, unless a longer period is necessary for an ongoing investigation, to establish, exercise or defend legal claims, or to comply with a legal obligation.

Rights of a reported party. A person or company that is the subject of a report has data-protection rights, including the right to be informed of and to access personal data we hold about them, and to request its rectification or erasure. We may restrict these rights where necessary to protect the confidentiality and safety of the person who made the report, to avoid prejudicing an investigation, or where otherwise permitted by law.

Sharing. We do not sell or publish report data. We may share it with the competent authorities in response to a lawful request or court order, and with our professional advisers where necessary to handle a report.

Site Analytics, Usage Data and Automated Processing

Analytics. On our information websites we use analytics to understand how visitors find and use our content so we can improve it. This includes Google Analytics and Google Search Console, together with our own first-party measurement of aggregate activity such as page views and clicks on links (for example, whether a visitor clicks through to the property portal). This usage data is aggregated and is not used to identify you personally. We also record automated visits by search-engine and AI-assistant crawlers. Our lawful basis is our legitimate interest in operating, securing and improving our services. You can control cookies through your browser and any cookie settings we provide (see our Cookies Policy above), and we do not sell this data.

Automated processing. Some features, such as property alerts and property matching, use your saved preferences to notify you automatically of listings that may be relevant to you. These do not produce legal or similarly significant effects for you, and we do not make decisions about you based solely on automated processing.

Data-protection contact. To ask a question about how we handle your personal data, or to exercise your rights (including access, rectification, erasure, objection or portability), please contact us using the details in the Contact section of this policy, marking your message for the attention of data protection. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

Version history

19 August 2026. Distribution of your listings and business contact details: added the marketing of shared listings by other members under clause 3.9 of the Terms. Corrections following a full review: breach notification aligned with Articles 33 and 34 GDPR; account creation moved from consent to contractual necessity; right to withdraw consent added; retention wording corrected; the list of providers outside the EEA made non-exhaustive and Cloudflare and Google Analytics named; a retention schedule and a named list of processors published, following clause 4.4 of the Terms.
23 July 2026. Mobile Application section added; international transfers section corrected; paragraph on distribution of listings and business contact details added.
8 February 2025. Original version.