Privacy Policy

Data controller

Flatmeits does not have a Data Protection Officer (DPO), as it is not required to appoint one under Article 37 of the GDPR. For any data protection query, contact us at hola@flatmeits.com.

What data we collect and why

Student contact form

Data collected: name, email, phone (optional), university (optional), preferred accommodation type, message (optional) and website language.

Purpose: to manage your enquiry about Flatmeits student housing services and, where appropriate, send you relevant information about availability and services.

Legal basis: consent of the data subject (Article 6.1.a GDPR), given through the consent checkbox on the form.

Landlord contact form

Data collected: name, email, phone (optional), property address (optional), number of rooms (optional) and message (optional).

Purpose: to respond to enquiries from property owners interested in Flatmeits management services.

Legal basis: consent of the data subject (Article 6.1.a GDPR).

General contact form

Data collected: name, email and message.

Purpose: to respond to general enquiries about Flatmeits and its services.

Legal basis: consent of the data subject (Article 6.1.a GDPR).

Browsing data

Data collected: URL UTM parameters (source, medium and campaign), browser language and technical connection data (anonymised IP address via hash, solely for anti-spam purposes).

Purpose: to improve the quality of the web service, prevent form abuse and analyse traffic sources in aggregate.

Legal basis: legitimate interest of the controller (Article 6.1.f GDPR).

Data recipients

Personal data collected through the website forms is processed exclusively by the Flatmeits internal team. Data is hosted on Supabase servers (technology infrastructure provider) within the European Union. Supabase acts as data processor and provides adequate data protection guarantees.

Flatmeits does not sell or share personal data with third parties. Data will only be disclosed to third parties when required by law.

International transfers

Personal data is stored on servers within the European Economic Area (EEA). Should an international transfer become necessary in the future, Flatmeits will ensure it is carried out with the appropriate safeguards provided for in the GDPR.

Data retention periods

Contact forms: data is retained for a maximum of 12 months from receipt of the enquiry. If a commercial relationship is formalised, data is kept for the duration of the service and subsequently for the legally required periods.

Browsing and anti-spam data: technical records (IP hash, UTM parameters) are retained for a maximum of 6 months.

Your rights

Under the GDPR, you have the right to:

• Access: know whether Flatmeits processes your data and obtain a copy.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your data when it is no longer necessary.
• Objection: object to processing on grounds relating to your particular situation.
• Restriction: request restriction of processing in the cases provided for in the GDPR.
• Portability: receive your data in a structured format and transmit it to another controller.
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, send an email to hola@flatmeits.com stating the right you wish to exercise and attaching a copy of your ID. We will respond within 30 days.

If you believe your data is not being processed in accordance with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

Security measures

Flatmeits implements appropriate technical and organisational measures to ensure the security of personal data and prevent alteration, loss, unauthorised processing or improper access.

Changes to this policy

Flatmeits reserves the right to update this privacy policy to adapt it to legislative or case-law developments. Significant changes will be communicated through the website.