Privacy policy

Aurea Alta Living S.L. (brand “vivo360”) Camí del Raiguer 115, 07320 Santa Maria del Camí, Spain CIF: B13972112 Email for privacy enquiries: privacidad@myvivo360.app

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (Ley Orgánica 3/2018, LOPDGDD).

Database, user accounts and files (for example contact enquiries, property data, photos and documents) are stored with our platform provider Lovable (Lovable Labs Incorporated AB, Sweden) in a data centre in the EU (Ireland, region eu-west-1).

Individual services from providers based in the United States are used. We explain below which providers these are and how we safeguard the transfer.

When our website is accessed, technically necessary data is processed: IP address, date and time, page accessed, browser and operating system. This is necessary to deliver the website and operate it in a stable and secure manner.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Our website is operated through Lovable and delivered via the network of Cloudflare, Inc. (USA). Cloudflare uses servers worldwide, including in the EU. Your IP address may be processed by Cloudflare.

An order processing agreement is in place with Lovable (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; the European Commission’s Standard Contractual Clauses also apply.

Legal basis: legitimate interest in a fast and secure website (Art. 6(1)(f) GDPR).

Contact form: If you write to us using the form, we store your name, email address, phone number, property location, your message and the selected language in our database in the EU. We are notified of receipt by email (sent via Lovable’s email service).

Phone and email: If you call or write to us, we process your details in order to deal with your enquiry.

WhatsApp: On our website we only link to WhatsApp. No WhatsApp widget is loaded. Only if you click the link and write to us do the privacy terms of WhatsApp Ireland Ltd. / Meta apply. Data may then be transferred to the USA. If you do not want this, you can contact us by phone, email or form.

Legal basis: steps prior to entering into or performance of a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR).

Retention period: We delete enquiries once they have been dealt with and no contract is concluded, no later than after 12 months. Statutory retention obligations remain unaffected.

We do not use tracking or marketing cookies and do not use analytics tools. We store only what is necessary for operation:

• verwalt.lang (local storage): your selected language. Duration: until you delete it.
• vivo360.cookie-consent (local storage): your cookie choice. Duration: until you delete it.
• sb-…-auth-token (local storage): sign-in to the vivo360 App, only for app users. Duration: until sign-out.
• sidebar_state (cookie): sidebar view in the app, only for app users.

Legal basis: technically necessary storage (Art. 22(2) LSSI-CE, Art. 6(1)(f) GDPR or Art. 6(1)(b) for app users). You can change your settings at any time via “Cookie settings” in the footer.

We use Google Fonts (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) for the consistent display of fonts. When our pages are accessed, the fonts are loaded from Google servers. Your IP address is transmitted to Google; processing in the USA is possible. Google is certified under the EU-US Data Privacy Framework, and the European Commission’s Standard Contractual Clauses also apply.

Legal basis: your consent via our cookie notice (Art. 6(1)(a) GDPR). Further information: https://policies.google.com/privacy

If you use the vivo360 App as a property owner, we process the data required for our services: account data (name, email, phone, encrypted password), property data, checklists and reports, maintenance requests, photos, invoices and documents, and messages with our team. All this data is located in the EU (Ireland).

Maps: In the property view of the app, we use Google Maps (Google Ireland Ltd.). Your IP address and the map section are transmitted to Google, including to the USA (EU-US Data Privacy Framework).

Payments: We process payments via Stripe (Stripe Payments Europe Ltd., Ireland). Stripe receives the data required for payment; we do not see card data. A transfer to Stripe, Inc. (USA) is possible (EU-US Data Privacy Framework and Standard Contractual Clauses).

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Retention period: for the duration of the contract, thereafter in accordance with statutory retention obligations (in Spain generally up to 6 years for accounting documents).

Landlords in Spain are legally required to collect the data of all guests and report it to the Ministry of the Interior (Real Decreto 933/2021). If we carry out this task for a property owner, we process on behalf of the landlord:

• name, ID document type and number, date of birth, nationality, gender, residential address, contact details, arrival and departure date
• ID images uploaded by guests via a personal link temporarily for automatic reading

Uploaded ID images are processed solely on a temporary basis for automatic reading and are not stored permanently. Only the details required for reporting and a verification record are stored.

Automatic reading of ID documents: So that guests do not have to type in their data manually, we automatically read the ID photos. For this purpose, the image is transmitted via our platform provider’s AI service to a Google language model (Gemini). Processing outside the EU is possible. Google is certified under the EU-US Data Privacy Framework. The data is used exclusively to read the ID document. The guest checks the extracted details before submission.

Reporting to the authorities: The data is transmitted to the Spanish Ministry of the Interior via the SES.Hospedajes platform.

Legal basis: legal obligation (Art. 6(1)(c) GDPR in conjunction with RD 933/2021). An order processing agreement is in place for the work carried out on behalf of the landlord (Art. 28 GDPR).

Registration data is deleted automatically three years (1,095 days) after departure; a daily deletion run records this clean-up. Any older files that may still exist are removed 180 days after departure.

We pass on data only where this is necessary for our service, for example to tradespeople or service providers whom we commission on your behalf, or where we are legally obliged to do so. We do not sell data.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent you have given at any time. Simply write to us at privacidad@myvivo360.app.

You also have the right to lodge a complaint with a data protection authority. The authority responsible for us is the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

Transmission is encrypted (HTTPS). Access to data in the app is protected by user accounts and access rights.

We update this privacy policy if our services or the legal situation change. The version published here applies.