Esta página ainda não está disponível em português. Mostramos a versão em inglês.

PropertyList.es - Privacy Policy

Effective date: 12 November 2026

Introduction

PropertyList (“PropertyList,” “we,” “us,” “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose information when you use our platform. By accessing or using our website and services, you agree to this Privacy Policy. This policy complies with the General Data Protection Regulation (GDPR) and Spanish data protection laws and applies to all products and services offered by PropertyList on PropertyList.es.
We comply with the EU GDPR for all EU/EEA data subjects and analogous national laws where applicable, including the UK Data Protection Act 2018 (UK GDPR). Foreign agencies and their clients remain subject to these data protection requirements.

Who we are

PropertyList.es is operated by PropertyList, Calle Ancla 1, 29670 Marbella (Málaga), Spain. Email: [email protected]. PropertyList is responsible for the personal data described in this policy, except where it processes data on behalf of a Member under clause 4.4 of the Terms, in which case the Member is responsible and PropertyList acts as its processor.

Information We Collect

1. Personal Data

We may collect personal data that you voluntarily provide to us, including:

Name
Email address
Phone number
Business or company details
Business address
Photographs and logos for profile customisation
IP address

Legal Basis:

Consent: For marketing communications and profile customisation.

Contractual Necessity: To create your account, provide the services and manage your account.

2. Usage Data

We may collect the following data automatically when you use our platform:

IP address
Browser type and version
Operating system
Access dates and times
Pages viewed
Clickstream data
Property view counts to generate reports

Legal Basis:

Legitimate Interests: To enhance platform functionality and user experience.

3. Cookies and Tracking Technologies

We use cookies, pixels, and similar tracking technologies to improve your experience. Cookies may include:

Essential Cookies: Necessary for platform operation.
Analytical Cookies: For user behaviour analysis (e.g., property views).
Advertising Cookies: To display relevant ads (if applicable).
Consent Mechanism: A cookie banner will appear when you first visit, allowing you to accept or reject cookies.

Verification of Professional Activity

In order to maintain the integrity of our professional network, PropertyList may request verification of your real estate activity before granting access to certain services, groups, or features.

For this purpose, we may ask you to provide one or more of the following documents: IAE certificate showing real estate activity, RAIA registration (Registro de Agentes Inmobiliarios de Andalucía), or Modelo 036/037 (Alta en Hacienda).

The legal basis for processing this information is our legitimate interest in ensuring that users participating in our platform are legally registered real estate professionals (Article 6.1.f of the GDPR).

The documents provided will be used exclusively for verification purposes, will be handled confidentially and securely, and will be deleted once the verification process is complete.

No information from these documents will be shared with third parties except where legally required.

In addition to tax and registration documents, PropertyList may request a copy of your Professional Indemnity Insurance certificate. This document is used solely to verify your eligibility to operate as a protected professional within our network. Consistent with our security protocols, this document will be handled confidentially and deleted once the verification process is complete.

How We Use Your Information

We use the data we collect for the following purposes:

To provide and maintain our services (Contractual Necessity)
To manage user accounts and profiles (Contractual Necessity)
To send important updates and marketing materials (Consent)
To process transactions and manage orders (Contractual Necessity)
To analyse platform performance and improve services (Legitimate Interests)
To enforce our Terms and Conditions (Legitimate Interests)
To respond to legal requests and prevent harm (Legal Obligation)

To protect agent assets: We do not access or reallocate leads that an agent brings to the platform themselves through their own marketing. Only public portal leads can be reallocated, and only under the purchase model described in clause 6.1(b) of our Terms and Conditions.

To facilitate internal dispute resolution and IP enforcement: We may process listing data, timestamps, and account activity to investigate claims of intellectual property infringement (e.g., photo theft) or commission sharing disputes between members. This is done under our Legitimate Interest to maintain a fair and professional marketplace.

Data Storage, Security, and Retention

1. Storage

The platform, its databases and the files uploaded to it are hosted by DigitalOcean, LLC on servers in Frankfurt, Germany (DigitalOcean region fra1), inside the European Economic Area (EEA). Backups, our internal operations system and the program that runs our WhatsApp groups (see How we run our WhatsApp groups) are hosted by Contabo GmbH in its data centre in Lauterbourg, France, inside the EEA. Other transfers outside the EEA are described under International Data Transfers.

2. Security

PropertyList.es adopts a ‘Data Protection by Design and by Default’ approach in compliance with GDPR. This means that we have implemented appropriate technical and organisational measures to ensure that only personal data necessary for each purpose is processed, and that data is processed with the highest standards of security and privacy.

We employ advanced cybersecurity measures, including:

Encryption of sensitive data
Regular server monitoring
Use of CloudFlare for enhanced security

Note: While we strive to protect your data, no system is completely secure.

To protect our members’ proprietary listing data and images, we employ active monitoring for automated scraping, data mining, and bot activity. We process IP addresses and traffic patterns to identify and block unauthorised attempts to harvest agent data. This ensures that your listings are not being exported to unauthorised third-party platforms without your consent.

3. Retention

We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires. The periods below apply unless a longer period is required by law or by an open investigation, claim or dispute.

Account and profile data. While your account is open, then 12 months after it closes.
Listings and listing history. While published, then 24 months after removal.
Contacts, leads and correspondence you enter in the CRM. Yours to delete at any time. On account closure they are deleted 90 days afterwards. We process them on your instructions under clause 4.4 of the Terms.
Platform-generated leads and enquiries. 24 months from the last activity on the lead.
Contacts left at fairs and events. This line applies instead of the line on platform-generated leads and enquiries above: until the end of January 2027, or earlier if you withdraw your consent. Only the record of consent is then kept, for 3 years. See Contacts at fairs and events.
Property Services registrations. Up to 24 months after registration, or earlier if you ask us to remove you. See Property Services registrations.
Invoices, payments and the credit ledger. 6 years from the end of the accounting year, as required by Spanish commercial and tax law.
Records of consent. While the consent stands, then 3 years, so we can show it was given (except contacts at fairs and events and Property Services registrations: see those sections).
Support tickets and correspondence with MLS Support. 24 months from closure of the ticket.
Confidential reports. 12 months, as set out below.
WhatsApp groups. See How we run our WhatsApp groups.
Security and access logs. 12 months.
Analytics. Google Analytics data is kept for 14 months. Our own aggregated measurement is kept indefinitely and contains no personal data.
Backups. Overwritten in the ordinary backup cycle, no later than 35 days.

You have the right to request deletion of your personal data at any time, subject to the legal obligations above.

In the event of an account suspension or investigation for fraudulent activity, we may extend the retention period of relevant data (including listing history and communication logs) beyond the standard one-year limit. This data is retained as necessary to conclude investigations, prevent re-registration by banned users, or comply with legal and audit requirements

4. Data Breach Protocols

In the event of a data breach:

Immediate action will be taken, such as isolating affected servers.
We notify the Spanish supervisory authority (AEPD) without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Where the breach is likely to result in a high risk to your rights and freedoms, we notify you without undue delay.

We do not sell your personal data. We may share it only in the following cases:

Trusted third-party service providers, such as hosting, payment processors, and marketing service providers, who act as Data Processors on our behalf. These third parties are contractually obligated to safeguard your data and process it only as instructed by PropertyList.es. Our current processors are: DigitalOcean, LLC (hosting of the platform and databases, on servers in Frankfurt, Germany, inside the EEA), Contabo GmbH (backups, our internal operations system and the program that runs our WhatsApp groups, in Lauterbourg, France), Cloudflare (security, content delivery and DNS), Stripe (payments), Google (AI features via Gemini, app notifications and diagnostics via Firebase, and website measurement via Google Analytics and Search Console), Amazon Web Services EMEA SARL (sending our emails and handling bounces and complaints, through Amazon SES) and Apple (push notifications on iOS devices). We give at least 30 days’ notice before adding or replacing a processor, as set out in clause 4.4(g) of the Terms.

Legal Requests: Compliance with subpoenas or court orders (Legal Obligation).
Business Transactions: In the event of a merger, sale, or asset transfer (Legitimate Interests).
Trusted Partners: Hosting providers, payment processors, or analytics providers bound by Data Processing Agreements (DPAs).

Distribution of your listings and business contact details. If you enable an XML feed, API access, your MicroSite or a Website Builder site, the listing content and the business contact details attached to it (such as your name, agency name, business phone number and business email) are published or transmitted to the destinations you have enabled. These may include your own website, other property portals you connect the feed to, and third-party applications or AI assistants that access our published interfaces. We do this to provide the service you have asked for, and you control it by enabling or disabling the relevant integration or by contacting MLS Support. Separately, your own published Listings are sent to partner property portals, under your agency name and logo with a small “by PropertyList” mark, as set out in clause 3.4.10 of the Terms, unless you switch this off in your account for all your Listings, one portal or one Listing. Your business phone number, email and website are not sent. We do this on the basis of our legitimate interests in advertising your listings more widely (Legitimate Interests). We do not sell this data. Under clause 3.9 of the Terms, other Members may also market a Listing you have shared on the MLS; their marketing carries their own brand and contact details, and your agency name and business contact details are shown to them inside the Platform for the purpose of the collaboration rather than in their public posts. Marking a Listing “Do not share with other agents” withdraws it from that use.

Connecting AI assistants to your account (MCP and API keys)

You can connect AI assistants and other applications to PropertyList through our MCP server at https://mcp.propertylist.es/mcp (described for people at propertylist.es/mcp), for example ChatGPT, Claude or any client that speaks the Model Context Protocol. You connect by signing in to PropertyList from the assistant and approving the access it asks for (OAuth). With CRM access approved, the connection reaches only your own agency’s data, with your own CRM permissions; without it, the assistant can use the public tools only. You can end the connection at any time in the CRM under My Settings > Linked AI apps > Remove, which revokes the app’s access at once. The AI Assistant App Terms set out what a connected assistant can do.

When you use a connected assistant, the data it reads or writes on your behalf is transmitted to the assistant’s provider in order to answer you. Depending on what you ask, that can include your listings and the records you hold in your CRM: contacts, leads, pipeline entries and notes, which may contain the personal data of your own clients.

The assistant’s provider (for example Anthropic for Claude, or OpenAI for ChatGPT) is not our processor. It receives that data because you chose to connect it and to use it, and it processes what it receives under its own terms and privacy policy. We do not control what a provider does with data once your assistant has received it, so choose assistants whose terms you are comfortable with.

Where your CRM records contain your clients’ personal data, you are responsible for making sure you can lawfully share them with the assistant you connect, as set out in the section on user responsibilities below.

The public tier of these interfaces needs no account and returns only published listing and market data; no personal data from any CRM is available through it.

Buyers can also send an enquiry to a listing agency through an AI assistant. If you do, we receive the details you choose to provide (such as your name, contact details and message) and pass them to the listing agency, exactly as if you had enquired on the portal: for a resale listing, the agency sees your message, with phone numbers, email addresses and other contact details removed, before it buys the lead, and your name and contact details once it buys it, and if it does not buy it within 48 hours of the enquiry arriving, your enquiry may go to another agency with the same or a similar property; the sections on how we use your information and on lead confidentiality apply.

When you remove a connected app, every access and refresh token it holds is revoked and its next request is refused. Records it created or changed in your CRM stay there as part of your CRM data. Our log of the tool calls it made (which tool, when, and whether it succeeded) is kept for 90 days for security and billing, then deleted. Data the assistant’s provider has already received stays with that provider under its own terms.

Introductions to third-party service providers

Some services offered through PropertyList.es are carried out by an independent company rather than by us. 3D walkthroughs and other filming at a property work this way. If you ask us about one of these services, this is what happens to your data.

What we share. The details you enter on the request form: your name, your agency, your email address, your phone number, the type of property, the town, and anything you write in the message field. We do not share your credit balance, your listings, your contacts or your CRM data.

Who we share it with. The provider who covers your area. The provider is identified to you by name, with its tax identification number, when it sends you its quotation, before you enter into any contract. We may work with more than one provider and may change provider.

Their role, and ours. The provider is an independent data controller of the details we pass on, not a processor acting on our instructions. It decides how it uses them, it contracts with you directly, and it is responsible for its own privacy notice and for answering your data protection requests about its copy of your data. Clause 4.4 of the Terms, which covers processing on your behalf, does not apply to the provider’s processing.

Why we may do it. Because you asked us to: passing your request on is the step you requested, so we rely on the necessity of taking steps at your request before entering into a contract (Article 6(1)(b) of the GDPR), and on our legitimate interest in operating an introduction service (Article 6(1)(f)). You are told before you submit the form that your details go to the provider, and nothing is sent if you do not submit it.

How long we keep our copy. We keep the request for 24 months so we can see what was asked for and follow it up, then delete it. The provider keeps its own copy under its own policy, and we do not control that. You can ask us to delete our copy at any time using the contact details at the foot of this policy, and we will tell the provider you have asked.

We are paid for this. The provider pays us a fee in connection with introductions made through the platform. It is paid out of the price you pay the provider and is not added to it. Clause 3.10 of the Terms sets this out.

Lead Confidentiality

1. Agent-Sourced Leads (Private Assets)

• Policy: PropertyList acknowledges that leads brought into the platform directly by an agent (through their own external marketing, personal networks, or private tools) are the exclusive professional assets of that agent.

• Protection: PropertyList does not sell, share or distribute these leads, and does not use them for our own marketing. We access them only where necessary to provide, secure or support the service, for example to investigate a fault you report to us, or to comply with a legal obligation. They remain under the control of the agent who provided them.

2. PropertyList-Generated Leads (Platform Allocation)

• Allocation: Leads generated by the PropertyList.es platform are initially allocated to the agent holding the primary listing.

• Reallocation: Public portal leads for resale listings, including enquiries that reach us through a partner portal, are paid leads under clause 6.1(b) of our Terms and Conditions. Leads for rental listings are free. Before buying a paid lead, the listing agent sees which property the enquiry concerns, the enquirer’s message, its language and the channel it came through (Legitimate Interests: so that the agency can decide whether to take on the enquiry). We remove phone numbers, email addresses and other contact details from the message automatically; anything else written in it, including a name if the enquirer signs the message, may be seen before the lead is bought, and a contact detail written in an unusual form may not be caught. The name and contact details given with the enquiry are shown once the agency buys the lead. If the listing agent does not buy a paid lead within 48 hours of the enquiry arriving, the lead may be offered to another Member with the same or a similar property so that the end user receives a response. That Member sees which property the enquiry concerns, the message with contact details removed, its language, the channel it came through, which agency the enquiry first went to and, if it buys the lead, the enquirer’s name and contact details. If you send an enquiry on the portal or through a partner portal, this means it can reach an agency other than the listing agency, so that you get a reply (Legitimate Interests). A lead that has been bought is never reallocated.

• Enquiries through partner portals: If you enquire about a listing on a partner property portal, that portal sends us your enquiry (your name, contact details and message). We pass it to the listing agency in the same way as an enquiry made on our own portal, including the reallocation described above. We do this on the basis of our legitimate interests in getting your enquiry answered.

Contacts at fairs and events

When you leave your details with us at a fair or event, for example at our Sun&Tech counter or through the form at info.propertylist.es/sun-tech/, we collect your name, your email and your profile (agent, investor, buyer, property services or other), and, if you give them, your company and your message. Name, email and profile are required; the rest is optional, and so is the box asking whether we may email you after the fair. We only keep your details if you send us a message or tick that box; if you do neither, we do not store them. We also keep a record of your consent: the date and time, the version of the consent text and which boxes you ticked. To limit abuse of the form we use the IP address of your connection; as elsewhere in this policy, IP addresses are kept in our security logs for 12 months.

Controller. PropertyList, Calle Ancla 1, 29670 Marbella (Málaga), Spain. Email: [email protected]. We have not appointed a data protection officer; write to the same address.
Why and on what legal basis. To answer your message: our legitimate interest in replying to people who contact us (Article 6(1)(f) of the General Data Protection Regulation). To email you about PropertyList after the fair: only if you tick the second box, and then on your consent (Article 6(1)(a)). You can object to the first at any time, and withdraw the second at any time, by writing to [email protected] or replying to any of our emails. Withdrawing does not affect the lawfulness of the processing before it.
Who receives your data. Only the PropertyList team sees it. We do not sell your data; we share it only with these providers and where the law requires it: DigitalOcean (Frankfurt, Germany, inside the EEA: hosting and database); Amazon Web Services EMEA SARL (Ireland, inside the EEA: sending the internal alert email, which contains no personal details); Cloudflare (network protection and delivery of the website; it may process data outside the EEA, under the safeguards described under International Data Transfers); and Contabo GmbH (Lauterbourg, France, inside the EEA: backups).
What we do not do. We take no automated decisions about you and do no profiling. We do not send you a confirmation email, and we do not email you unless you ticked the second box.
How long. We delete these details, including from our internal records, at the end of January 2027, or earlier if you withdraw your consent; backup copies are overwritten in the following weeks. After that we keep only the record of your consent (date and time, consent version and the boxes you ticked) for 3 years, so that we can show it was given. IP addresses in security logs follow the 12 months set out above.
Your rights. Access, rectification, erasure, objection, restriction and portability, by writing to [email protected]. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Property Services registrations

If you registered your interest as a service provider at info.propertylist.es/property-services/ before Property Services opened, we collected the services you offer and your email, and, if you gave them, your business name, where you work and your WhatsApp number. We also keep the date and the language of the page. That form is now closed. While it was open, the server held the IP address of your connection in its working memory, never on disk, to count submissions per hour; it was cleared when the server restarted and was never stored with your registration. As elsewhere in this policy, IP addresses in our security logs are kept for 12 months.

Controller. PropertyList, Calle Ancla 1, 29670 Marbella (Málaga), Spain. Email: [email protected]. We have not appointed a data protection officer; write to the same address.
Why and on what legal basis. To email you that Property Services has opened and what it costs: you asked for this by registering, and we rely on that consent (Article 6(1)(a) of the General Data Protection Regulation); it is also why the email is allowed under article 21 of Spain's Ley 34/2002 (LSSI). You can withdraw it at any time by writing to [email protected] or replying to our email; withdrawing does not affect the lawfulness of the processing before it. To count which services and towns were waiting, so we knew what to build first, and to let the moderators of the Property services WhatsApp group match a number that asks to join with its registration: our legitimate interest in planning the service and running the group (Article 6(1)(f)). You can object to this at any time at the same address.
Who receives your data. The PropertyList team, and the moderators of the Property services WhatsApp group, who see the services, business name, area and WhatsApp number of a registration so they can deal with requests to join. We do not sell your data, and apart from those moderators we do not pass it to agents or other providers. We share it only with these providers and where the law requires it: DigitalOcean (Frankfurt, Germany, inside the EEA: hosting and database); Amazon Web Services EMEA SARL (Ireland, inside the EEA: sending the internal alert email, which contains no personal details); Cloudflare (network protection and delivery of the website; it may process data outside the EEA, under the safeguards described under International Data Transfers); and Contabo GmbH (Lauterbourg, France, inside the EEA: backups). If you join the WhatsApp group, the section How we run our WhatsApp groups also applies.
What we do not do. We take no automated decisions about you and do no profiling. That registration created no account and no charge, and we send you no marketing beyond the opening notice and the price.
How long. Up to 24 months after you registered, or earlier if you ask us to remove you. Backup copies are overwritten in the following weeks. If you go on to create a provider profile, the rest of this policy applies to it.
Your rights. Access, rectification, erasure, objection, restriction and portability, by writing to [email protected]. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

User Rights

Under GDPR, you have the following rights:

Access: View the personal data we hold about you.
Correction: Rectify inaccurate or incomplete data.
Deletion (“Right to Be Forgotten”): Request erasure of your personal data.
Portability: Obtain a copy of your data in a portable format (when technically feasible).
Restriction: Limit how your data is processed.
Objection: Object to data processing based on legitimate interests or direct marketing.
Withdraw consent: Where we rely on your consent, withdraw it at any time. This does not affect processing carried out before you withdrew it.

You have the right to object to the processing of your personal data, including for direct marketing purposes. If you wish to exercise this right, please email us at [email protected]

We will consider your objection and respond in a timely manner. If we are unable to process your data based on your objection, we will inform you accordingly.

How to Exercise Your Rights: Email [email protected] to make a request.

WhatsApp Group Participation and Data Use

If you choose to participate in our official WhatsApp groups, certain personal data may be used in line with group communication and moderation policies. This includes:

Displaying your name, business name, and phone number as part of messages
Sharing your listing details, business logos, or images if voluntarily submitted

By participating in our WhatsApp groups, you acknowledge that messages you send may be visible to other group members and that PropertyList.es may moderate or remove content that violates our Terms & Conditions.

We will never share your data beyond the scope of group administration and our own marketing of the platform. As set out in clause 3.2 of the Terms, that marketing may feature member listings, agency names and logos, and screenshots of the platform, in materials such as tutorials, demonstrations, case studies and advertising. Your WhatsApp participation is optional and can be discontinued at any time by leaving the group or requesting removal through MLS Support. How we keep and use member lists and messages is explained under How we run our WhatsApp groups below.

Members are reminded that while PropertyList moderates these groups, we cannot control how other participants use the contact information (name and phone number) visible in the group. Agents are encouraged to use professional-only phone numbers and are strictly prohibited from ‘harvesting’ other members’ data from these groups for external marketing purposes

How we run our WhatsApp groups

A PropertyList phone number is a member of our WhatsApp groups. A program on our server, which we call the reader, is linked to that number.

Member lists of our groups. For each PropertyList group, the reader keeps the list of members that WhatsApp gives to our number because our number is in the group: each member's WhatsApp identifier, the phone number it belongs to, and the name the member shows on WhatsApp.

Which registered agents are in which group. Once a day we compare those member lists with the phone numbers on PropertyList accounts. Our internal system stores the result: which registered agents are, or may be, in which group. Where two accounts share a phone number we cannot tell which of them is in the group, so both are marked as possible members. The comparison stores nothing about numbers that match no account.

Group messages. Messages posted in our groups reach the reader as they are sent. Once a day, the reader deletes its copy of them, together with the encryption keys for those messages. Before deleting them, we keep market figures from posts about properties and property requests: for each month, area, sale or rental, property type and number of bedrooms, the number of different prices and the typical price, and from 10 different prices, the range in which the middle half of the prices fall. We do not keep the day, the group, the sender or the message text, and we publish a figure only when it is based on at least 5 different prices. Until the month ends, the prices behind these figures are held in a working file on our server, without the day, group, sender or text. The WhatsApp app on our phone keeps the group chats, as on any member's phone.

Groups we do not run. Our number may also be in some WhatsApp groups that PropertyList does not run. The reader keeps their messages and member lists only until its daily deletion.

One-to-one messages. Messages sent to or from our number in individual chats are kept by the reader and copied to our internal system, where they are linked to the sender's PropertyList record if the sender is a registered agent. We use them to see and answer replies, and to keep track of our conversations with each agent.

People without an account who write to us. If someone without a PropertyList account writes to our number, we keep their number, name and message to review it. A message we have not dealt with is held in our review list for up to 30 days. If we decide not to follow up, we may keep the number on a list of numbers we do not follow up, so that it is not held for review again.

If you ask us to message you. If we invite members of a group to reply YES so that we send them listings and updates one-to-one, and you reply YES, we keep your number, name and reply as a record of your consent, and we use them to send you those messages. Our legal basis is your consent (Article 6(1)(a) of the GDPR). You can withdraw it at any time by replying STOP or by writing to us; we then stop and record that you withdrew. Withdrawing does not affect messages sent before. We keep the record of your consent as set out under Records of consent in the retention list above.

Connection data. To stay linked to WhatsApp, the reader also holds the technical data WhatsApp needs: the encryption keys for our number, the contact names and numbers WhatsApp syncs to a linked device from our phone, and a table that turns WhatsApp identifiers into phone numbers. This can include people we have been in a group or a chat with, including people who have since left a group. We use it to keep the connection working and to turn member identifiers into phone numbers for the daily comparison above.

What we use it for.

Running the groups: checking who is a registered member, giving priority to members who share their listings when a group is full (Terms, clause 5.6.1), and removing members whose account has closed or who no longer meet the group rules.
Answering and recording one-to-one messages.
Sending listings and updates to people who have asked for them, as described above.
Monthly market figures, as described above.

We do not sell this personal data.

Why we may do this. Apart from the consent described above, we rely on our legitimate interest in running the groups safely and fairly, and in answering the people who write to us (Article 6(1)(f) of the GDPR). Where the person writing to us is a PropertyList user, we also rely on our contract with them (Article 6(1)(b)).

Your right to object. You can object at any time to processing based on our legitimate interest (Article 21 of the GDPR), using the details in the Contact section of this policy.

If you are in one of our groups but have no PropertyList account. Your number did not come from you: WhatsApp gives it to our number because our number is in the group. We keep your number, WhatsApp identifier and WhatsApp name in the group's member list while you are in the group, so that we can run it. Your number and name can also stay in our connection data, as described above. Unless you write to us, we do not use your number to contact you. You have the same rights as anyone else under this policy, including access, erasure, restriction and objection, and you can ask to be removed from the group, using the details in the Contact section. While you remain in a group, WhatsApp keeps sending us its member list, so leaving the group is the way to stop it.

How long we keep it.

Member lists of our groups: while you are in the group. When you leave, you are removed from our copy the next time WhatsApp sends that group's member list, which happens when the group is active.
Which registered agents are in which group: rebuilt every day from the member lists above.
Group messages and the encryption keys for them: deleted by the reader once a day.
Messages and member lists from groups we do not run: deleted by the reader once a day.
Monthly market figures: 36 months. The working file of prices for the current month: deleted when the month's figures are published.
One-to-one messages: 24 months from the last message or call in that conversation. After that we delete the messages but keep a record that the conversation took place (its dates and topic) and, for someone without a PropertyList account, their name and number, for as long as we keep that person's record in our internal system.
Messages from people without an account that we have not dealt with: up to 30 days in our review list. Numbers we have decided not to follow up: kept on that list so that they are not held again.
Records of a YES request: as set out under Records of consent in the retention list above.
Connection data: while our number stays linked to the reader.

Who else is involved. WhatsApp Ireland Limited runs the WhatsApp service and has its own privacy policy for the data it holds. The reader and our internal system run on servers operated by Contabo GmbH in Lauterbourg, France, which acts as our processor.

User Responsibilities and Legal Compliance

All users are solely responsible for ensuring that the information they publish or share via PropertyList.es and associated WhatsApp groups complies with all applicable laws and regulations in their respective jurisdictions. This includes, but is not limited to:

Real estate marketing laws and licensing requirements
Consumer protection and advertising standards
Data protection laws (e.g. obtaining consent for sharing third-party data or images)
Anti-discrimination regulations in housing and services
Copyright and intellectual property rights for media or branding elements

By submitting content to our platform or WhatsApp groups, users confirm that they have the legal right to distribute such content and that it does not violate any local, national, or international laws. PropertyList.es assumes no liability for unlawful, misleading, or non-compliant content posted by users.

We reserve the right to remove any content that we believe may breach legal standards or our platform’s Terms & Conditions.

While we reserve the right to remove content without notice, for non-fraudulent clerical errors (such as a pricing typo), PropertyList may provide a 24 - 48 hour ‘Notice and Cure’ window for the member to rectify the error before sanctions are applied.
EU/EEA residents may exercise their rights with PropertyList.es or, if preferred, with their national supervisory authority. Users may also contact the Spanish AEPD for any concerns regarding data protection.

International Data Transfers

Our production servers are in Frankfurt, Germany (DigitalOcean region fra1), with DigitalOcean, LLC, inside the European Economic Area (EEA). Backups, our internal operations system and the program that runs our WhatsApp groups are hosted inside the EEA, with Contabo GmbH in Lauterbourg, France. Some of our other service providers process limited personal data outside the EEA, including: Google (as our AI provider for Instant Listing, for app notifications and diagnostics via Firebase, and for website measurement via Google Analytics and Search Console), Apple (for notifications on iOS devices), Stripe (for credit payments made on our website), and Cloudflare (for security and content delivery). Where personal data is processed outside the EEA, we rely on EU-approved safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision. A list of our processors and the safeguards in place is available on request.

Children’s Data

Our platform is not intended for users under the age of 18. We do not knowingly collect data from minors. Parental consent is required for users under this age.

Cookies Policy

We use cookies for the following purposes:

Before placing cookies on your device, we will request your consent via a cookie banner when you first visit our website. You may choose to accept or reject the use of cookies at any time. You can modify your cookie preferences or disable cookies through your browser settings.

Essential Functionality: Ensure smooth platform operation.
Analytics: Measure performance and usage patterns.
Managing Cookies: You can manage your preferences through browser settings or the cookie banner on our website.

Non-essential cookies (analytics, marketing) will only be used after the user provides explicit consent via our cookie banner. Users may withdraw consent at any time via the banner or their browser settings. Essential cookies required for platform operation will always remain active.
This cookie consent framework applies to all users, including agencies and clients accessing the platform from outside Spain, within the EU/EEA.

Mobile Application

When you use the PropertyList mobile app, we process the additional data below. Device permissions are requested only with your consent and can be changed at any time in your device settings; the app remains usable if you decline, though some features will not work.

Camera and photo library. So you can take or choose property photographs for a listing (for example, the Instant Listing feature). Photographs you add are uploaded to our servers to create and display your listing. Legal basis: performance of our service to you.

Microphone and voice recordings. So you can record a short spoken description of a property. Instant Listing uses your recording, together with your photos, to draft the listing. The audio and a text transcription of it are processed for this purpose. We use Google (Gemini) as our AI service provider, acting as our data processor under a data-processing agreement, to transcribe your recording and generate the listing text and details. We do not use your recordings for any other purpose. Legal basis: performance of our service to you.

Location. If you enable it, we use your device location to: (a) record the location of a "for sale" sign when you save one, and (b) let you search for properties near you ("search near me"). You can decline or revoke this permission at any time in your device settings, and the rest of the app stays usable. Legal basis: consent.

Notifications. With your permission, we send push notifications (for example, a new lead or activity on your listings). To deliver them we store a device push token and use the Apple Push Notification service and/or Google Firebase Cloud Messaging. You can turn notifications off at any time in your device settings. Legal basis: consent.

Device and diagnostic data. To keep the app secure, stable and working, we process technical data such as your device model, operating system and app version, language, and a device or installation identifier, along with crash and performance diagnostics provided by Google Firebase. Legal basis: our legitimate interest in operating and improving the app.

Payments. You buy credits on our website, not inside the app; payments are handled by our payment processor Stripe. The app itself does not collect your card or payment details.

App stores. When you download or install the app, Apple or Google processes data under their own privacy policies. The privacy disclosures we provide in the Apple App Store (App Privacy) and in Google Play (Data Safety) are consistent with this Privacy Policy.

Changes to this Privacy Policy

This Privacy Policy is reviewed periodically and may be updated. Changes will be posted on this page with a revised effective date. Significant updates will be communicated via email.

Contact Information

For questions about this Privacy Policy, or to exercise your rights, email [email protected] or write to PropertyList, Calle Ancla 1, 29670 Marbella (Málaga), Spain.

You may also file a complaint with the Spanish Data Protection Agency (AEPD) if you believe your rights have been violated.

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the relevant supervisory authority. You can contact the AEPD through their official website or by using the contact information provided on their platform.

Compliance and Audits

We regularly review our data protection practices through audits and consultations with legal experts to ensure compliance with GDPR and Spanish data protection laws.

Confidential Reports and Fraud Prevention

PropertyList operates a confidential channel through which users can report suspected scams, fraudulent listings, or problems with an agent or a property-related service. This section explains how we handle the personal data involved.

What we collect. When you submit a report, we collect the information you choose to provide, which may include your name and email address, a description of what happened, amounts and dates, any evidence or references you supply, and information identifying the agent, company, service provider or listing you are reporting (the reported party).

Lawful basis. We process this data on the basis of our legitimate interests, and those of our users and the public, in preventing fraud, protecting consumers and maintaining the integrity of the PropertyList network. Where a report concerns possible criminal conduct, we may also process it to comply with a legal obligation or to cooperate with the competent authorities.

How we use it. Reports are reviewed confidentially by our trust team. We do not publish reports or the identity of the person reporting, and we do not maintain a public list of reported parties. We do not act on a single unverified report in isolation; we look for corroborating evidence and give any reported party the opportunity to respond before taking any action under our Terms.

Retention. Confidential reports are retained for up to 12 months and then deleted, unless a longer period is necessary for an ongoing investigation, to establish, exercise or defend legal claims, or to comply with a legal obligation.

Rights of a reported party. A person or company that is the subject of a report has data-protection rights, including the right to be informed of and to access personal data we hold about them, and to request its rectification or erasure. We may restrict these rights where necessary to protect the confidentiality and safety of the person who made the report, to avoid prejudicing an investigation, or where otherwise permitted by law.

Sharing. We do not sell or publish report data. We may share it with the competent authorities in response to a lawful request or court order, and with our professional advisers where necessary to handle a report.

Site Analytics, Usage Data and Automated Processing

Analytics. On our information websites we use analytics to understand how visitors find and use our content so we can improve it. This includes Google Analytics and Google Search Console, together with our own first-party measurement of aggregate activity such as page views and clicks on links (for example, whether a visitor clicks through to the property portal). This usage data is aggregated and is not used to identify you personally. We also record automated visits by search-engine and AI-assistant crawlers. Our lawful basis is our legitimate interest in operating, securing and improving our services. You can control cookies through your browser and any cookie settings we provide (see our Cookies Policy above), and we do not sell this data.

Automated processing. Some features, such as property alerts and property matching, use your saved preferences to notify you automatically of listings that may be relevant to you. These do not produce legal or similarly significant effects for you, and we do not make decisions about you based solely on automated processing.

Data-protection contact. To ask a question about how we handle your personal data, or to exercise your rights (including access, rectification, erasure, restriction, objection or portability), please contact us using the details in the Contact section of this policy, marking your message for the attention of data protection. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

Version history

12 November 2026. Property Services registrations: the section now covers registrations made before Property Services opened, and the registration form is closed. Platform leads: portal leads for rental listings are free. Before buying a paid lead, an agency (the listing agency or, after 48 hours, another Member it is offered to) sees the enquirer’s message with phone numbers, email addresses and other contact details removed, as well as which property it concerns, its language and the channel it came through; the name and contact details are shown only once the agency buys the lead.
10 November 2026. Partner portals: your own published listings are sent to partner property portals unless you switch this off, and enquiries made through those portals are handled like enquiries on our portal, including reallocation. An agency offered a reallocated lead is told which agency the enquiry first went to.
10 November 2026. Platform leads: public portal leads become paid leads under clause 6.1(b) of the Terms and Conditions. A lead the listing agent does not buy within 48 hours of the enquiry arriving may be offered to another Member with the same or a similar property, who sees which property the enquiry concerns and, if it buys the lead, the enquirer’s name, contact details and message. The promise to announce this model by email at least 30 days before it applied is removed.
9 November 2026. Platform leads: the 72-hour reallocation rule is removed, to match clause 6.1(b) of the Terms and Conditions. No response-time condition applied to public portal leads on that date.
7 November 2026. New section: Property Services registrations. It explains what we keep when a service provider registers interest on the Property Services page, why, the legal basis, who sees it (including the moderators of the Property services WhatsApp group), the providers involved and how long we keep it. Retention list: new line for these registrations, and Records of consent now points to it. Until this date the internal alert email for these registrations carried the details given; it no longer does, and those earlier emails are being deleted.
2 November 2026. New section: Contacts at fairs and events. It explains what we keep when you leave your details at a fair such as Sun&Tech, the legal basis for answering you and for emailing you afterwards, who receives the data, and that we delete it at the end of January 2027. Retention list: new line for these contacts, and Records of consent now points to it. Storage, the list of processors and International Data Transfers corrected: the production servers are in Frankfurt, Germany (DigitalOcean, LLC, region fra1), inside the EEA; the reference to the United Kingdom adequacy decision for hosting is removed.
26 October 2026. New section: How we run our WhatsApp groups. It explains what the program linked to our groups’ phone number keeps (member lists, one-to-one messages and connection data), its daily deletion of group messages, the monthly market figures kept from posts, the daily comparison with registered accounts, how we handle YES replies asking for listings and updates, the legal basis, how long we keep it and your rights. The program has run since at least July 2026, before this notice. Contabo GmbH, already listed for our backups, also hosts our internal operations system and this program, in Lauterbourg, France. Restriction added to the list of rights in the data-protection contact.
13 October 2026. Processors: Amazon Web Services EMEA SARL added as the service that sends our emails (Amazon SES). It has done so since the end of September 2026, before this notice. Members may object under clause 4.4(g) of the Terms until 12 November 2026 by emailing [email protected].
7 October 2026. New section: Who we are (PropertyList, Calle Ancla 1, 29670 Marbella, [email protected]). Storage and International Data Transfers corrected: the production servers are in London, United Kingdom (DigitalOcean, LLC), outside the EEA, under the adequacy decision for the United Kingdom and DigitalOcean’s Standard Contractual Clauses; backups are kept by Contabo GmbH in Lauterbourg, France. Contabo added to the list of processors. Connecting AI assistants: the MCP server address, how to disconnect and what happens after, and the new AI Assistant App Terms. Requests and questions by email to [email protected].
26 August 2026. New section: Connecting AI assistants to your account (MCP and API keys). It explains what is transmitted to an assistant’s provider when an agency connects one to its CRM, the provider’s independent role, the public tier, buyer enquiries sent through assistants, and how to revoke a key.
19 August 2026. Distribution of your listings and business contact details: added the marketing of shared listings by other members under clause 3.9 of the Terms. Corrections following a full review: breach notification aligned with Articles 33 and 34 GDPR; account creation moved from consent to contractual necessity; right to withdraw consent added; retention wording corrected; the list of providers outside the EEA made non-exhaustive and Cloudflare and Google Analytics named; a retention schedule and a named list of processors published, following clause 4.4 of the Terms.
23 July 2026. Mobile Application section added; international transfers section corrected; paragraph on distribution of listings and business contact details added.
8 February 2025. Original version.