Privacy Policy

The controller responsible for the processing of your personal data is:

Only Apartments Real Estate S.L.
CIF B26926378 · MUVAWAY is a trade name of Only Apartments Real Estate S.L.
Carrer de Monsenyor Palmer, 1
07014 Palma, Illes Balears, Spain
Email: info@muvaway.com
Phone: +34 666 261 975

We process the following categories of personal data:

• Contact details you submit through our forms (name, email address, phone number, message, location of interest).
• Property information you share when requesting a valuation (address, size, condition, photos and any other details you provide).
• Owner listing documents when you submit a property for seasonal letting: proof of ownership or authority to let (nota simple or an equivalent land-register extract), a photo ID, the certificate of habitability and the energy certificate. These documents are stored in access-restricted storage for verification and are not published in the listing. If you let commercially (e.g. as a company, property manager or agency), we additionally collect your company name, tax number (NIF/CIF), business address and, where applicable, your trade register details under Art. 30 of the EU Digital Services Act (Regulation (EU) 2022/2065; Art. 6(1)(c) GDPR) and store them for up to 6 months after the end of our contractual relationship.
• Property media: photos, floor plans and videos are initially stored in access-restricted storage. Media approved for publication can be displayed publicly in the property listing. Personal documents such as IDs or proof of ownership do not belong in a floor plan or the public media gallery.
• Viewing requests when you book a viewing for one of our listings.
• Rental profile data you provide through our website or WhatsApp Flow, including household size, the primary tenant's name, children, pets (including pet photos you upload), employment status, occupation and employer, monthly household net income, who pays the rent (you, your employer, parents or a guarantor), children's ages, the reason for your temporary stay and any free-text description. We do not ask for health details; please do not include any, and choose "other reason" for personal reasons. If you give details about other household members, please let them know.
• Identity document (ID card or passport) that you upload in your account after the owner has accepted your enquiry. We need it to identify the parties and draw up the seasonal rental contract (Art. 6 (1)(b) GDPR). The file is checked automatically for readability only; nobody is rejected automatically. Only MUVAWAY staff can open the file; the owner receives the contract with your name and document number, never the scan. If no contract is concluded, the file is deleted 30 days after the enquiry is declined or withdrawn, and in any case after 60 days without activity on the enquiry; the document number stays in the contract and the invoice for the statutory retention period.
• Identity check for tenants and owners (ID document and selfie) once a booking exists and before the tenancy contract is prepared. Either via Stripe Identity (Stripe Payments Europe Ltd., processor; document and selfie stay with Stripe; we store the result plus name, document type, issuing country and ID number, because they belong in the tenancy contract; Stripe compares your selfie with the ID photo automatically, which is biometric data under Art. 9 GDPR, so this route only starts with your explicit consent, which you can withdraw at any time) or as an upload into restricted storage that only MUVAWAY staff can open. The other side only sees that you are confirmed. Uploaded files are deleted after the review, at the latest after 60 days.
• A complete saved rental profile is required before submitting a rental enquiry. You can edit or delete it in your account. Newly saved details and changes are shared with MUVAWAY for internal review. When you submit an enquiry, a copy of your saved profile is attached to that enquiry. Changes to existing enquiries require approval. Saving alone does not create an enquiry or notify an owner. Contracts and completed enquiries are not changed; consent for an enquiry is provided separately.
• Communications and appointment data, including WhatsApp messages, language, the property concerned, preferred and confirmed viewing times, and the outcome of a request.
• Messages on muvaway.com between tenants, owners and MUVAWAY. MUVAWAY staff can read conversations between a tenant and an owner in order to accompany the rental, answer questions and handle disputes or misuse (legitimate interest, Art. 6 (1)(f) GDPR). Every such conversation shows this. Conversations are anonymised 3 years after the rental period or the last message, or after 6 years if the conversation led to a booking (commercial records).
• Profile picture (optional). If you upload a profile picture in your account, tenants or owners you message on muvaway.com and the MUVAWAY team can see it. You can remove it in your account at any time.
• Payment data for payments through Stripe (fees, rent advance, rent, deposit): amount, date, status and payment reference. Card details are processed by Stripe itself, not by us. Owners receive payouts through a Stripe account; Stripe verifies identity, tax number and bank account. Bank transfers to and from our business account (Revolut).
• Rental execution records such as the signed contract and signature records, the handover and inventory report including photos, and proof that the deposit was lodged with IBAVI.
• Partner programme If you use a partner code, the code is stored with your enquiry and booking to apply the discount; the partner does not see your data. For partners themselves we process name, contact details, tax number (NIF), IBAN, tax status and commissions for self-billing and tax reporting (Art. 6 (1)(b) and (c) GDPR).
• Enquiries from property portals If you contact us through a portal such as idealista, we receive your name, contact details and message from that portal (Art. 14 GDPR).
• Usage statistics without consent We count listing views using a keyed, shortened hash of IP address and browser, only as totals per listing (legitimate interest in measuring listing reach, Art. 6 (1)(f) GDPR; you may object at info@muvaway.com). QR code scans are only counted after you accept cookies.
• Push subscription if you turn on push notifications on a device.
• Technical data automatically collected by our hosting provider, such as IP address, browser type, device type and timestamps, used solely for security and basic site reliability.

We process your personal data only for clearly defined purposes:

• Responding to your enquiries, valuation requests and viewing bookings, based on your request prior to entering into a contract (Art. 6 (1)(b) GDPR).
• Providing our real estate services and related communication, based on contractual necessity (Art. 6 (1)(b) GDPR).
• Compliance with our legal obligations under Spanish tax, accounting and anti-money-laundering law, based on a legal obligation (Art. 6 (1)(c) GDPR).
• Improving the security and functioning of this website, based on our legitimate interest in operating a safe and reliable service (Art. 6 (1)(f) GDPR).
• Operating our CRM, matching enquiries with suitable rental properties, coordinating appointments, translating communications and providing AI-assisted customer service, based on pre-contractual steps (Art. 6 (1)(b) GDPR) and our legitimate interest in efficient and consistent client support (Art. 6 (1)(f) GDPR).

Our systems may compare your rental profile with objective property conditions, rank suitable properties and prepare replies. Unclear or potentially unsuitable cases are referred to a member of our team. We do not make a final rejection or another decision producing legal or similarly significant effects solely by automated means.

When you submit an enquiry, the owner of the property receives your rental profile (household, occupation, income range, pets) in order to decide on it. A complete profile may be released automatically after a plausibility check; unclear profiles are reviewed by our team. For owners: submitted listing photos and details are checked with AI assistance; a clearly suitable listing may be published automatically, nothing is rejected automatically.

Providing contact and rental-profile data is necessary to process an enquiry; identity, payment and tax data are necessary to conclude and perform the contract or are required by law. Without them we cannot process your enquiry or contract. Optional details such as a profile picture are voluntary.

AI helps our team draft replies and task notes in the CRM. AI never sends a message on its own: every reply is reviewed and sent by a member of our team.

If you are an owner and receive payments through the platform, we may be obliged to report your identification data, tax number, bank account, property address, amounts and commissions to the Spanish tax administration (DAC7, Law 13/2023; Art. 6 (1)(c) GDPR). Partner commissions are reported where tax law requires it.

We do not sell your personal data. We share it only with service providers needed to operate the website and our business. Depending on the service, a provider acts as our processor or as an independent controller; we put the contractual data-protection arrangements required by law in place:

Other recipients: the other party of your rental (owners receive the tenant profile and, in the contract, identity details; tenants receive owner and contract details), each acting as an independent controller; the Balearic housing institute IBAVI (deposit); the Spanish tax administration; our tax advisor; third-party portals on which the owner has ordered a listing; and courts or authorities where required by law. Stripe, Revolut, Meta and Google Ads act as independent controllers for their own processing.

We apply data minimisation. In particular, AI-assisted replies receive only the CRM facts required to answer the question; exact property addresses, owner identities and internal assessment notes are not disclosed unless necessary and authorised.

Where a provider processes data outside the European Economic Area (marked USA above), the transfer relies on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

We keep your personal data only as long as necessary for your enquiry, active property search, viewing coordination or client relationship, and thereafter only where required to establish, exercise or defend legal claims or comply with law. You may ask us to update or delete a stored rental profile when it is no longer required. Contract-related data is kept for the retention periods required by Spanish accounting, tax and anti-money-laundering law — generally up to six years for commercial and tax records. In detail:

If you delete your account, enquiry and search data (favourites, saved searches, contact requests and rental applications that have not led to a contract) are removed immediately. Bookings, invoices, contracts and the documents submitted with a published property listing are business records: they remain stored for the statutory retention periods; only the link to your former account is removed right away. In chats your own messages are replaced by “[removed]” and your name is neutralised; the other party keeps the conversation as a record.

Under the GDPR you have the right to:

• access the personal data we hold about you,
• request correction of inaccurate data,
• request deletion of your data, where applicable,
• request restriction of processing,
• object to processing based on our legitimate interest,
• request portability of the data you have provided to us,
• withdraw any consent at any time, without affecting prior lawful processing.
• not be subject to a decision with legal or similarly significant effects based solely on automated processing.

To exercise any of these rights, please contact us at info@muvaway.com. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, www.aepd.es).

Exercising these rights is free of charge. We normally respond within one month and may ask for proof of identity where necessary to protect your data.

We keep the website as cookie-light as possible: strictly necessary technology runs without consent, while embedded maps, audience measurement, analytics, content-link measurement and conversion measurement only start after you accept cookies. Address suggestions run through our server without cookies. For details on the cookies used and how to manage them, please see our Cookies Policy.

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or alteration. Communication with this website is encrypted via HTTPS.

We may update this Privacy Policy from time to time to reflect changes in our services or in applicable law. The latest version will always be available on this page, with the "Last updated" date at the top.

For any question regarding this Privacy Policy or the processing of your personal data, please write to us at info@muvaway.com.

When enabled, we use PostHog Cloud EU for technical error diagnostics and — with your consent to “Statistics” — for the usage statistics of this website. We then collect pages viewed and time spent, buttons and links clicked, where you came from (search engine, campaign, referring site), an approximate location derived from your IP address (country, region, city), device and browser, plus a random identifier that lets a visit be recognised later. Addresses are cleaned first: access tokens, listing and account identifiers and search terms are removed; only campaign parameters remain. For portal, handover and exposé links we send no address at all. Names, email addresses, messages, form input and document contents never reach PostHog. With your additional consent to “Recording” we record sessions, meaning clicks, scrolling and page changes: input fields always stay masked, file uploads and areas marked as sensitive are not recorded, and account, portal and handover pages are excluded entirely. Server-side errors are sanitized and captured without identifying a person. The CRM runs error diagnostics only. You can withdraw statistics and recording at any time in the cookie settings.