Privacy Policy

The controller responsible for the processing of your personal data is:

Only Apartments Real Estate S.L.
Carrer de Monsenyor Palmer, 1
07014 Palma, Illes Balears, Spain
Email: info@muvaway.com
Phone: +34 635 787 585

We process the following categories of personal data:

• Contact details you submit through our forms (name, email address, phone number, message, location of interest).
• Property information you share when requesting a valuation (address, size, condition, photos and any other details you provide).
• Owner listing documents when you submit a property for seasonal letting: proof of ownership or authority to let (nota simple or an equivalent land-register extract), a photo ID, the certificate of habitability and the energy certificate. These documents are stored in access-restricted storage for verification and are not published in the listing.
• Property media: photos, floor plans and videos are initially stored in access-restricted storage. Media approved for publication can be displayed publicly in the property listing. Personal documents such as IDs or proof of ownership do not belong in a floor plan or the public media gallery.
• Viewing requests when you book a viewing for one of our listings.
• Rental profile data you provide through our website or WhatsApp Flow, including household size, the primary tenant's name, children, pets (including pet photos you upload), employment status, occupation and monthly household net income.
• Identity document (ID card or passport) that you upload in your account after the owner has accepted your enquiry. We need it to identify the parties and draw up the seasonal rental contract (Art. 6 (1)(b) GDPR). The file is checked automatically for readability only; nobody is rejected automatically. Only MUVAWAY staff can open the file; the owner receives the contract with your name and document number, never the scan. If no contract is concluded, the file is deleted 30 days after the enquiry is declined or withdrawn, and in any case after 60 days without activity on the enquiry; the document number stays in the contract and the invoice for the statutory retention period.
• A complete saved rental profile is required before submitting a rental enquiry. You can edit or delete it in your account. Newly saved details and changes are shared with MUVAWAY for internal review. When you submit an enquiry, a copy of your saved profile is attached to that enquiry. Changes to existing enquiries require approval. Saving alone does not create an enquiry or notify an owner. Contracts and completed enquiries are not changed; consent for an enquiry is provided separately.
• Communications and appointment data, including WhatsApp messages, language, the property concerned, preferred and confirmed viewing times, and the outcome of a request.
• Messages on muvaway.com between tenants, owners and MUVAWAY. MUVAWAY staff can read conversations between a tenant and an owner in order to accompany the rental, answer questions and handle disputes or misuse (legitimate interest, Art. 6 (1)(f) GDPR). Every such conversation shows this. Messages are kept for the duration of the rental process and the statutory retention periods.
• Profile picture (optional). If you upload a profile picture in your account, tenants or owners you message on muvaway.com and the MUVAWAY team can see it. You can remove it in your account at any time.
• Technical data automatically collected by our hosting provider, such as IP address, browser type, device type and timestamps, used solely for security and basic site reliability.

We process your personal data only for clearly defined purposes:

• Responding to your enquiries, valuation requests and viewing bookings, based on your request prior to entering into a contract (Art. 6 (1)(b) GDPR).
• Providing our real estate services and related communication, based on contractual necessity (Art. 6 (1)(b) GDPR).
• Compliance with our legal obligations under Spanish tax, accounting and anti-money-laundering law, based on a legal obligation (Art. 6 (1)(c) GDPR).
• Improving the security and functioning of this website, based on our legitimate interest in operating a safe and reliable service (Art. 6 (1)(f) GDPR).
• Operating our CRM, matching enquiries with suitable rental properties, coordinating appointments, translating communications and providing AI-assisted customer service, based on pre-contractual steps (Art. 6 (1)(b) GDPR) and our legitimate interest in efficient and consistent client support (Art. 6 (1)(f) GDPR).

Our systems may compare your rental profile with objective property conditions, rank suitable properties and prepare replies. Unclear or potentially unsuitable cases are referred to a member of our team. We do not make a final rejection or another decision producing legal or similarly significant effects solely by automated means.

We do not sell your personal data. We share it only with service providers needed to operate the website and our business. Depending on the service, a provider acts as our processor or as an independent controller; we put the contractual data-protection arrangements required by law in place:

• Vercel Inc., website hosting and infrastructure, plus aggregate visit and performance statistics (only after you accept analytics cookies).
• Supabase, database, authentication and CRM infrastructure.
• WhatsApp / Meta, delivery of messages and WhatsApp Flows.
• OpenAI, AI-assisted classification and drafting of replies. Only information needed for the particular request is provided; OpenAI states that API data is not used to train its models by default.
• DeepL, translation of listing details and communications.
• Google, Google Calendar for appointment coordination; Google Maps (loads only after you accept cookies); Google Places address suggestions in the owner form, routed through our server so your browser never contacts Google — only the typed address text is forwarded; Google Ads conversion measurement (only after you accept analytics cookies).
• Cloudflare, Inc., Turnstile bot protection on our public forms. It runs without advertising cookies; Cloudflare processes technical connection data for this security check.
• Resend, delivery of contact, valuation and viewing request emails, and of email notices about new messages on muvaway.com. These notices contain a short note and a link to your messages, never the message content.
• Push services of your browser (Google, Apple, Mozilla or Microsoft), only if you turn on push notifications for messages on a device. They deliver an empty signal to that device; the notice shown contains no message content.
• Telegram, restricted internal alerts when a member of our team needs to review or approve a case.
• Microsoft Ireland Operations Ltd., Microsoft Clarity: analysis of website use including heatmaps and session recordings of page interactions. Runs only after you accept analytics cookies; keystrokes in form fields are not recorded.

We apply data minimisation. In particular, AI-assisted replies receive only the CRM facts required to answer the question; exact property addresses, owner identities and internal assessment notes are not disclosed unless necessary and authorised.

Some of these providers may transfer data outside the European Economic Area. In that case, the transfer is protected by the appropriate safeguards required by the GDPR (such as the European Commission's Standard Contractual Clauses).

We keep your personal data only as long as necessary for your enquiry, active property search, viewing coordination or client relationship, and thereafter only where required to establish, exercise or defend legal claims or comply with law. You may ask us to update or delete a stored rental profile when it is no longer required. Contract-related data is kept for the retention periods required by Spanish accounting, tax and anti-money-laundering law — generally up to six years for commercial and tax records.

If you delete your account, enquiry and search data (favourites, saved searches, contact requests and rental applications that have not led to a contract) are removed immediately. Bookings, invoices, contracts and the documents submitted with a property listing are business records: they remain stored for the statutory retention periods and are deleted afterwards; only the link to your former account is removed right away.

Under the GDPR you have the right to:

• access the personal data we hold about you,
• request correction of inaccurate data,
• request deletion of your data, where applicable,
• request restriction of processing,
• object to processing based on our legitimate interest,
• request portability of the data you have provided to us,
• withdraw any consent at any time, without affecting prior lawful processing.
• not be subject to a decision with legal or similarly significant effects based solely on automated processing.

To exercise any of these rights, please contact us at info@muvaway.com. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, www.aepd.es).

Exercising these rights is free of charge. We normally respond within one month and may ask for proof of identity where necessary to protect your data.

We keep the website as cookie-light as possible: strictly necessary technology runs without consent, while embedded maps, address suggestions, analytics and conversion measurement only start after you accept cookies. For details on the cookies used and how to manage them, please see our Cookies Policy.

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or alteration. Communication with this website is encrypted via HTTPS.

We may update this Privacy Policy from time to time to reflect changes in our services or in applicable law. The latest version will always be available on this page, with the "Last updated" date at the top.

For any question regarding this Privacy Policy or the processing of your personal data, please write to us at info@muvaway.com.