Privacy Policy

The controller responsible for the processing of your personal data is:

Only Apartments Real Estate S.L.
Carrer de Monsenyor Palmer, 1, Ponent
07014 Palma, Illes Balears, Spain
Email: info@onlyapartmentsre.com
Phone: +34 635 787 585

We process the following categories of personal data:

• Contact details you submit through our forms (name, email address, phone number, message, location of interest).
• Property information you share when requesting a valuation (address, size, condition, photos and any other details you provide).
• Viewing requests when you book a viewing for one of our listings.
• Rental profile data you provide through our website or WhatsApp Flow, including household size, the primary tenant's name, children, pets, employment status, occupation and monthly household net income.
• Communications and appointment data, including WhatsApp messages, language, the property concerned, preferred and confirmed viewing times, and the outcome of a request.
• Technical data automatically collected by our hosting provider, such as IP address, browser type, device type and timestamps, used solely for security and basic site reliability.

We process your personal data only for clearly defined purposes:

• Responding to your enquiries, valuation requests and viewing bookings, based on your request prior to entering into a contract (Art. 6 (1)(b) GDPR).
• Providing our real estate services and related communication, based on contractual necessity (Art. 6 (1)(b) GDPR).
• Compliance with our legal obligations under Spanish tax, accounting and anti-money-laundering law, based on a legal obligation (Art. 6 (1)(c) GDPR).
• Improving the security and functioning of this website, based on our legitimate interest in operating a safe and reliable service (Art. 6 (1)(f) GDPR).
• Operating our CRM, matching enquiries with suitable rental properties, coordinating appointments, translating communications and providing AI-assisted customer service, based on pre-contractual steps (Art. 6 (1)(b) GDPR) and our legitimate interest in efficient and consistent client support (Art. 6 (1)(f) GDPR).

Our systems may compare your rental profile with objective property conditions, rank suitable properties and prepare replies. Unclear or potentially unsuitable cases are referred to a member of our team. We do not make a final rejection or another decision producing legal or similarly significant effects solely by automated means.

We do not sell your personal data. We share it only with service providers needed to operate the website and our business. Depending on the service, a provider acts as our processor or as an independent controller; we put the contractual data-protection arrangements required by law in place:

• Vercel Inc., website hosting and infrastructure, plus aggregate visit and performance statistics (only after you accept analytics cookies).
• Supabase, database, authentication and CRM infrastructure.
• WhatsApp / Meta, delivery of messages and WhatsApp Flows.
• OpenAI, AI-assisted classification and drafting of replies. Only information needed for the particular request is provided; OpenAI states that API data is not used to train its models by default.
• DeepL, translation of listing details and communications.
• Google, Google Calendar appointment coordination and Google Maps.
• Resend, delivery of contact, valuation and viewing request emails.
• Telegram, restricted internal alerts when a member of our team needs to review or approve a case.
• Microsoft Ireland Operations Ltd., Microsoft Clarity: analysis of website use including heatmaps and session recordings of page interactions. Runs only after you accept analytics cookies; keystrokes in form fields are not recorded.

We apply data minimisation. In particular, AI-assisted replies receive only the CRM facts required to answer the question; exact property addresses, owner identities and internal assessment notes are not disclosed unless necessary and authorised.

Some of these providers may transfer data outside the European Economic Area. In that case, the transfer is protected by the appropriate safeguards required by the GDPR (such as the European Commission's Standard Contractual Clauses).

We keep your personal data only as long as necessary for your enquiry, active property search, viewing coordination or client relationship, and thereafter only where required to establish, exercise or defend legal claims or comply with law. You may ask us to update or delete a stored rental profile when it is no longer required. Contract-related data is kept for the retention periods required by Spanish accounting, tax and anti-money-laundering law.

Under the GDPR you have the right to:

• access the personal data we hold about you,
• request correction of inaccurate data,
• request deletion of your data, where applicable,
• request restriction of processing,
• object to processing based on our legitimate interest,
• request portability of the data you have provided to us,
• withdraw any consent at any time, without affecting prior lawful processing.

To exercise any of these rights, please contact us at info@onlyapartmentsre.com. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, www.aepd.es).

We aim to keep our website as cookie-light as possible. We use only what is strictly necessary to provide the service and, where applicable, to load embedded maps. For details on the cookies used and how to manage them, please see our Cookies Policy.

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or alteration. Communication with this website is encrypted via HTTPS.

We may update this Privacy Policy from time to time to reflect changes in our services or in applicable law. The latest version will always be available on this page, with the "Last updated" date at the top.

For any question regarding this Privacy Policy or the processing of your personal data, please write to us at info@onlyapartmentsre.com.