Privacy policy

How Pisio processes your personal data, under Regulation (EU) 2016/679 (GDPR) and Ley Orgánica 3/2018 (LOPDGDD, the Spanish Data Protection Act).

The essentials

Who processes your data: Pisio Technologies, S.L. Contact: privacidad@pisioapp.com.
What for: to help you find a home with agencies and landlords, verify your profile with your documents and charge for the services you take out.
With whom: with the agencies you give access to, with the owner of the home if the agency presents you, and with the providers that help us provide the service. With analytics and advertising tools, only if you accept them.
Where: the main hosting is in the European Union. Some providers process data outside it, with the safeguards we explain below.
For how long: while you have your account, and afterwards only what is needed to comply with the law or deal with liabilities.
Your rights: you can see, correct and delete your data, and ask for a copy of it, from "Privacy" or by writing to privacidad@pisioapp.com.

Who processes your data

Pisio Technologies, S.L., owner of Pisio. Tax ID (NIF) B93856136. Calle Juan Ramón Jiménez, km 0, núm. 11, esc. 3, pta. 4, 08191 Rubí (Barcelona), Spain.

For any data protection matter: privacidad@pisioapp.com.

What data we process, what for and on what basis

Identity, contact details and financial standing: name, date of birth, identity document, nationality, address and contact details; and your employment situation, employer, income, length of employment, savings, debts, guarantee and, when buying, whether you have a pre-approved mortgage. To sign you up, suggest homes to you and let you receive the invitations agencies send you. Performance of the contract (art. 6.1.b GDPR).
Your documents: identity, payslips, employment contract, Social Security work history, Social Security contribution bases report, pension, unemployment benefit or scholarship certificate, bank or investment account statements, or income tax return, to verify your identity and your financial standing and, with your tax return, to tell you which home purchase aids apply to you. Performance of the contract (art. 6.1.b). We explain this in "Your documents".
The reason for your stay, if you are looking for a seasonal rental: the reason you choose (and, if you choose "Other", what you write) and the document that proves it, so that the agency can verify the reason the law requires it to prove. Performance of the contract (art. 6.1.b). If the reason is health or family, the document may include health data: by uploading it you give us your explicit consent to process it (art. 9.2.a GDPR), and you can withdraw it at any time by deleting the document.
Your video interview, if you do it: your image, your voice and what you say, to verify your profile. If what you say does not match your profile, the verification waits for a person to review it. Performance of the contract (art. 6.1.b). If you are looking for a seasonal rental, it has a second part, "Your stay", where you tell us the reason, the dates and how many people will live there: it is context for the agency, it does not prove the reason and it does not change your verification. If in it you say something about your health or your family, by recording it you give us your explicit consent (art. 9.2.a GDPR), which you can withdraw at any time by writing to privacidad@pisioapp.com.
Your household: who you live with, if you tell us, so that the suggestions fit (performance of the contract, art. 6.1.b). Forming a household with another person and contributing your financial standing to it is voluntary and based on your consent (art. 6.1.a).
Your description and what you add to your search ("Anything else about your search?"): to present you to the agency whose property you apply for or whose invitation you accept. Performance of the contract (art. 6.1.b).
Sharing a room, only if you are looking for or advertising a room: legitimate interest (art. 6.1.f). It has its own section.
Your extended profile and your documents for a specific agency, when you apply for one of its properties or accept its invitation: consent (art. 6.1.a), which you withdraw at any time from "Who sees my data".
Use of the platform: activity logs, consents, IP address, browser and device. To make the service work, detect and fix faults, protect the platform and improve the product with internal counts. Legitimate interest (art. 6.1.f) and, where the law requires a record to be kept, legal obligation (art. 6.1.c).
Your help requests and our reply, to assist you. Performance of the contract (art. 6.1.b). They are read by the Pisio team, do not reach the agencies and do not count towards your match. To deal with them, the team may ask artificial intelligence for a summary (we explain this in "Artificial intelligence").
Signing in with Google or Apple, if you sign in that way: the identifier of your account with that provider and the email address and name it shares with us, to identify you. Performance of the contract (art. 6.1.b).
Analytics and advertising, only if you accept them: consent (art. 6.1.a). The details are in the Cookie policy.
Which ad you came from, if you created your account from one of our ads: the name of the campaign and of the ad carried by the link, to find out which campaigns bring people who are genuinely looking for a home and where to invest. We read it from the link at the moment you sign up, without storing anything in your browser, and we do not send it to anyone. Legitimate interest (art. 6.1.f). It is deleted after 12 months.
Which home you came to see through its link and which agency it belongs to, or which agency invited you to Pisio: to show you its homes, let you know about new ones that match you, let you apply, ask you for the documents that agency requires and not charge you the service fee where it does not apply. Performance of the contract (art. 6.1.b). The agency does not know until you apply to one of its homes, unless you connect with it: it then sees that you are on Pisio and how your profile is doing, with your consent (art. 6.1.a). And if that agency is a Pisio partner and you activate your subscription, you count as a sign-up in its annual incentive, without it knowing it is you: legitimate interest (art. 6.1.f).
Your references, if you ask for them: what the agency you ask answers about a viewing or a tenancy with you, its name and the date. To show them, if you decide to. Performance of the contract (art. 6.1.b). They do not count towards your match.
The homes from outside Pisio that we bring you, if you are looking for a home on Pisio, and what you tell us about them (whether you are interested or why they do not suit you): to bring you the ones that suit you best. Performance of the contract (art. 6.1.b). It does not change how agencies see you.
Your data for whoever advertises a home outside Pisio, only if you press "Apply" on it, and each time you do: your name, your phone number and what we have verified about you, without your documents, so that they can get in touch with you. Consent (art. 6.1.a). From the moment they receive it, whoever advertises processes your data as controller.
Tax data, when a transaction is invoiced. Legal obligation (art. 6.1.c). It has its own section.

You can pause opportunities at any time from "How agencies see you". While they are paused you do not appear in any agency's suggestions; the applications you already had continue and you can still apply yourself.

Your documents

When you upload documents we use them to verify your identity and your financial standing, checking what they say against what you have declared, and to suggest that you complete empty fields in your profile, which we do not fill in without your confirmation. If you came through the link of an agency that asks for its own documents, we ask you for those and verify them in the same way.

If you upload your income tax return, or your form 130 or 303 as a self-employed person, we use its Secure Verification Code (Código Seguro de Verificación) on the Spanish Tax Agency's online office to check that your document matches the one the Agency holds. We do not need your certificate or your login credentials. We store that code encrypted, delete it 24 hours after the check and keep the result. If the document is in someone else's name, or we cannot tell whose it is, we do not check it.

If you upload your Social Security work history or your contribution bases report, we send it with its electronic authenticity code to the Social Security service that checks that the document is the one it issued, identifying ourselves with our company's electronic certificate. We do not need your certificate or your login credentials, we do not store that code and we keep the result. If the document is in someone else's name, we do not send it. From the contribution bases report we keep the base for each month and the company that paid contributions, and we compare it with your payslips: if the base on a payslip does not match the one for that month, we do not accept the payslip, except in a month with leave, arrears or a change of employer, when a person reviews it.

A pension certificate may say that the pension is for incapacity, which is health data. We use it to check your income and, if you give an agency permission to see your documents, it will see it too. By uploading it you give us your explicit consent to process it (art. 9.2.a GDPR), also to check it with Social Security: we send it with its electronic authenticity code, like the work history, unless we cannot tell that it is yours. You withdraw it by deleting the document.

From your documents we extract the data needed to verify and complete your profile and to provide the features described in this policy.

Basis. Verifying your profile is part of the service you ask for (performance of the contract, art. 6.1.b GDPR): only a verified profile is included in the suggestions agencies receive. That is why we do not ask for your permission and why the right to object under art. 21 GDPR, which applies to processing based on legitimate interest, does not apply here. What you can do: not upload a document, delete any of them (it stops being used at that moment and, if it supported the verification, your profile becomes unverified again), ask us to correct a piece of data that was misread and ask for your data to be erased. And if we reject one of your documents, you can ask from your folder for a person to review it.

If you are a guarantor, your documents are processed in the same way, but on the basis of your consent (art. 6.1.a GDPR), which you give when you accept the guarantor commitment. You withdraw it from your link.

Artificial intelligence

Pisio uses artificial intelligence to read your documents and check that they are legible and consistent, transcribe your voice notes and the audio of your video interview, and summarise it, improve the texts of your profile when you ask it to and assess your qualitative fit with a home. It also processes the texts, photos and videos of agencies' listings. Our provider does this on our behalf, and this data is not used to train models.

When you write to us, or we review your documents or your account, the team may ask artificial intelligence for a summary of your case and a draft reply. To do so we send it what has happened in your account: the status of your profile, of your documents (of what is read in them, only figures and dates) and of what you still need in order to be verified, the checks and alerts on your profile, the financial situation you declared, your searches, applications, viewings, payments and subscription, the consents you have given, what you have done in your account and when, the notices we have sent you, whether you have a guarantor (nothing else about them), the relationship and status of the people you live with and whether they contribute income, and what you have written to us. It is sent without your name, your email address, your phone number or your document number, we mask the names of other people we know about (your guarantor, the people you live with, your employer) and the image of a document is never sent. If you advertise homes, the same is sent about your account and, when we review your agency's account or your private landlord account, its verification (its level, its checks and its notices) and the conversations between its team and ours, with its name, its tax ID (CIF) and its contact details masked. It does not decide anything: the reply and any decision about your profile or your account are made by a person on the team. We do this on the basis of our legitimate interest (art. 6.1.f GDPR) in assisting you well and quickly. These summaries are internal to the team and are not included in the copy of your data.

The sign-up questions are asked by an automated system, not a person. They follow a fixed script and what you answer goes into your profile, where you can correct it at any time.

Sharing a room

If you are looking for a room in a shared flat, you can tell us your gender and who you want to live with. Whoever advertises the room can state, on behalf of the people who already live there, how many people they are, their gender and whom they accept.

What for. Only to avoid suggesting rooms to you in households that would not accept you, or suggesting your search to households you have said you do not want to live with. It works both ways and never changes your position relative to other candidates. It is not used for whole homes, agencies cannot search for you by it, and what counts is the gender you declare.

Basis. Legitimate interest (art. 6.1.f GDPR): making compatible living arrangements easier between the person looking for a room and the people who already live there.

It is voluntary, and you can object. If you do not say, you simply stop seeing the rooms that have stated a preference, and your position does not change. You change or delete it in "Your searches", which is also how you exercise your right to object (art. 21 GDPR).

If you advertise homes

This policy also applies if you are a private landlord or work at an agency. This is what changes for you.

What we process. What you declare when you open the account: tax identifier, company name and trade name, contact email address and phone number, website and AICAT number if you have one. We use the email address and the website to run checks confirming that the account is real, and we keep their result. If you activate your public page, your trade name, your logo, your website and whatever you put on it (its design, a tagline and a cover photo) can be seen without an account, together with your homes published in public mode, until you deactivate it. The tagline and the photo are reviewed beforehand by our AI provider. None of this uses tenants' data. If you work at an agency, we process your email address, your Pisio identifier and your role, which determines what you can do; your colleagues see those three items on the team screen.

Your identity document, if you are a private landlord. It is used only to prove that you are who you say you are: it does not fill in any profile, it is not checked with the Spanish Tax Agency and it is not shown to any tenant. Without proven identity you cannot publish, so the basis is performance of the contract (art. 6.1.b GDPR).

Your calendar, if you connect it. It is voluntary and serves to avoid receiving viewings when you are busy. We only read when you are busy: we do not read the title, the attendees or the location of your events. Within your agency, whoever can edit a property's time slots sees those busy periods, with the same limitation, because they need to know which times they cannot offer. You disconnect it from your settings, and we then delete the connection and the permission you gave.

Your property management software, if you connect it. It is voluntary. We keep the address, or the username and password, you give us to read your listings from it from time to time, and who connected it. We delete it when you disconnect it or close the account, and what each reading did, after 12 months.

Retention and rights. We process the account while it exists. When it is closed we empty its record and delete your identity document and what was read from it. What the law requires, or what proves an agreement or a breach, is kept, blocked: among other things, the payment data, the record of the publication of each property and, if your agency joined the Partner Programme, its signature. Your rights are the same: you exercise them from "Privacy", in your Settings, or at privacidad@pisioapp.com, which is also where you ask for the copy of your data.

Who we share your data with

Agencies. When the matching engine suggests you to an agency (if you have the search service or, without it, for a home that has few candidates), it sees a summary profile without contact details: your first name and your username, your city, what you are looking for, your employment situation and length of employment, your income and, when buying, your capital in bands, whether you have a verified guarantee or a pre-approved mortgage, when you were last active and which documents you have verified, never their content. It does not see your identity document, your address, your photo or your documents. If you apply for one of its properties or accept its invitation, it also sees your description and whatever you have written in "Anything else about your search?". If you book a viewing or confirm your interest in one of its properties, it also receives your full name, so that it knows who it is dealing with, and, if you book a viewing, also your email address, to arrange it. If you give your phone number when you apply, when you accept its invitation or in your profile, Pisio keeps it until you withdraw it and only the agency you choose receives it, in order to contact you. If you contribute your financial standing to another person's household, it sees the household's financial standing in bands, as household financial standing and not as your own figure. If you have paused opportunities, no agency sees you, except the agency whose property you apply for yourself or with which you are already in a process. Your visible references are seen by the agencies that see your profile and, if they present you, by the owner; hidden ones, only by you. Whoever opens a reference link you share sees your full name and whether your profile is verified.

Your extended profile, your documents and your video interview are seen only by the agency you authorise, type by type, and, if it presents you, by the owner of the home, without your documents or your video interview. You can withdraw this at any time.

If an agency presents you to the owner of the home, the owner sees, through a link that expires, part of what the agency sees about you, and never your contact details, your identity document, your debts or your documents.

The contract for the home. If whoever chooses you generates it from Pisio, we fill it in on their behalf with your full name, your identity document and your email address, if you have given them access; otherwise those fields are left blank. We keep the document just long enough for them to download it and then delete it; any copy they keep is their responsibility.

Providers working on our behalf. They are processors (art. 28 GDPR) and may use the data only to provide their service to us. By category: hosting and storage, email, calendar and video calls, artificial intelligence, payments, notifications, error monitoring and, if you accept it, analytics. We do not store your card number. You can ask us for the up-to-date list of providers at privacidad@pisioapp.com.

Public bodies that check your documents. The Spanish Tax Agency, if you upload your income tax return or your form 130 or 303, and Social Security, if you upload your Social Security work history, your contribution bases report or your pension certificate: we ask them whether the document is the one they issued, as we explain in "Your documents".

Third parties acting on their own account. Google and Apple, if you sign in with them, pay with their wallet or take out the subscription in their store, in which case they sell it to you. Google and Microsoft, if whoever advertises connects their calendar and receives there the details of the viewings booked. YouTube and Vimeo, if you play the video of a home. And, only if you accept advertising on the website, the advertising platforms: with Meta we are joint controllers for collecting that data on our website and sending it to Meta (art. 26 GDPR), you can exercise your rights against Meta or against us, and what Meta does afterwards is for Meta to decide; Google, in Google Ads, processes it as a controller in its own right. Which tools these are and how they are accepted or withdrawn, in the Cookie policy.

Beyond the advertising you accept, we do not disclose your data to anyone for commercial purposes.

International transfers

Some providers process data outside the European Economic Area, mainly in the United States. In those cases the transfer is covered by an adequacy decision of the European Commission (art. 45 GDPR) or by standard contractual clauses (art. 46.2.c GDPR), depending on the provider.

What affects you most: your documents, the texts of your profile, what you answer during sign-up, the audio you dictate or that of your video interview, what you write to us about the homes we bring you and what we send to summarise your case when the team asks for it are processed in the United States by our artificial intelligence provider, under standard contractual clauses. Part of that content may be subject to human review in third countries, with the same safeguards.

The main hosting of the platform and of your documents is in the European Union.

You can ask for information about these safeguards, and for a copy of them, at privacidad@pisioapp.com.

How long we keep your data

We keep your data while you have your account and, afterwards, only for the periods needed to comply with legal obligations or deal with possible liabilities. The criteria:

Files of your documents and your video interview: we keep them while they are needed to verify your profile and delete them when they no longer are, in line with our internal retention periods. The extracted data and the result of the verification remain in your profile while you have your account.
Inactive account: if you go 24 months without signing in we notify you by email and in the app and, if you do not sign in within the following 30 days, we close the account as if you had asked to close it. Signing in once is enough to keep it. If your account has activity in progress or a team that is still using it, our team reviews it first.
Messages with agencies, what you answer during sign-up and help requests: a limited time from when the application is closed or from the last activity, after which they are deleted.
Summary of your case made with artificial intelligence: 12 months from when it is made, and sooner if you close your account.
Analytics and advertising, which are not linked to your account: analytics events, 12 months; session recordings, 30 days; Google Analytics data, 14 months. If you withdraw your consent, they stop receiving new data.
Which ad you came from: 12 months from sign-up, and sooner if you close your account.
The home you came to see through its link: until you apply to it, and for 90 days at most. Which agency you came from, and which homes you reached through their link: for as long as you have your account.
Your references: for as long as you have your account. You can hide or show them at any time.
Listings from outside Pisio: while they remain published and for 7 more days. If a listing can no longer be seen, its text and its photo are deleted within 37 days at most. After that, only the price figures for the area.
The homes we bring you, what you told us about them and the phone number you give us to apply: while you keep looking and for 30 days after you switch off or delete your search. You can delete the phone number earlier.
Backups: they are deleted automatically after 30 days. What you delete may remain in them until then, without being used.

When you close your account, or we close it for inactivity, we remove from your profile the data that identifies you, delete your searches, your financial data, your household and the files of your documents, and remove any cards you had saved with our payment provider. What the law requires us to keep is no longer in your name: applications are kept without your identity, and the data on who paid each charge is blocked and destroyed 6 years after the last entry (art. 30 of the Código de Comercio (Commercial Code) and art. 32 of the LOPDGDD).

Automated systems

Pisio uses automated systems that build a match profile from the relevant information in your profile and about the home, and use it to rank applications and opportunities.

That ranking influences when and in what order you receive opportunities, but it does not decide who gets the home. Even if you do not match a home, whoever offers it can still invite you. The final decision always rests with the agency or the landlord.

If any data used is incorrect, you can ask us to correct it by writing to privacidad@pisioapp.com. If it is corrected, your assessment is updated.

Data of other people

Sometimes we process data of people who do not have a Pisio account:

Your guarantor, if you propose one: their data and documents are processed with their consent, which they give when accepting the commitment and withdraw from their link or by writing to us.
The people living in a room that is advertised: whoever advertises it states how many people they are and their gender, without names. If you live there and want it changed, ask whoever advertises it or write to us.
People you tell us about in a help request: we use what you tell us about them only to reply to you (legitimate interest, art. 6.1.f GDPR).
Anyone who asks us for a call from the agencies page: their name, their agency, their work email address, their phone number if they give it, how many homes they transact per year and the day and time they choose, to arrange the call they ask for (steps taken at their request prior to entering into a contract, art. 6.1.b GDPR). We create the call in our Google calendar, which sends them the invitation with the video call link. We delete it 6 months after the call, including from our calendar.
People an agency asks us to invite: their name and email address, which the agency gives us because they asked it for a home, so that we can send them an invitation on its behalf. Pisio acts on behalf of the agency, which is the controller (art. 28 GDPR). If they do not create a profile, we delete it 90 days after sending; if they ask not to receive more emails, we keep only a fingerprint of the email address so as not to write to them again.
Whoever advertises a home outside Pisio: from the listings published in the areas of people looking for a home on Pisio, the price, the area, the features of the home, the text without contact details, one photo and the link, taken from the portals and websites where it is published, to show the listings that suit them and to calculate the prices in the area. The text and the photo go through artificial intelligence to see why the home suits them. If the person looking asks us to write on their behalf, we use the contact details in the listing for that. We delete it 7 days after the listing is withdrawn. If whoever advertises is an individual, we do this on the basis of legitimate interest (art. 6.1.f GDPR) and you can object by writing to privacidad@pisioapp.com.

In any of these cases you can write to us at privacidad@pisioapp.com to find out what we process and to exercise your rights.

Invoices and tax data

When a transaction must be invoiced we process only what its document requires: whether you are resident in the Canary Islands, Ceuta or Melilla, because the tax depends on it (and for that same purpose we check whether the area where you are looking for a home, or the address you have given us, is there); your name and your address if you choose a paper invoice; and your name or company name, your tax identifier and your tax address when the document requires it or you ask for it. The basis is legal obligation (art. 6.1.c GDPR).

This data is kept separate from your search profile, plays no part in the selection of homes and is not given to agencies. Our payment provider receives what is needed to issue the invoice and its corrections. You can view and download your documents from your account, and choose whether you receive the invoice on paper or in electronic format.

Accounting documents are kept for 6 years from the last entry affecting them. When the account is closed they are removed from ordinary access and their identifying data is blocked, together with the copies already delivered, until that period expires; whatever remains to be issued, corrected or sent is completed with restricted access.

Your rights

You can request access, rectification, erasure, restriction, objection and portability. Write to us at privacidad@pisioapp.com or do it from "Privacy" (in your Account settings, on the website and in the app). From there you can delete your account and, if you are looking for a home, ask for a copy of your data, which we send you by email, ask us to stop using a piece of data while we check whether it is correct, and withdraw from a contract while you are within the period to do so. Your consents are also there.

If something is based on your consent, you can withdraw it at any time, without affecting what was processed before: an agency's access to your extended profile or your documents, from "Who sees my data"; the connection with an agency, from "Who sees my data"; the guarantee, from the guarantor's link, or from your Profile if you want to remove your guarantor; the household, from your Profile; the notice to outside agencies, by writing to us; your data for whoever advertises a home from outside, by writing to us (what has already been sent is processed by whoever received it); and analytics and advertising, from "Cookie preferences" or from "Privacy".

If you believe we have not respected your rights, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (aepd.es).

What happens if you do not give us a piece of data

No law obliges you to give us data, but some is necessary to provide the service to you:

Account and search: without them there is no service.
Identity and income documents: they are voluntary, but without them your profile is not verified, you are not included in the suggestions agencies receive and you will not receive opportunities. If you declare figures that your documents do not back up, the profile is not validated either.
Biography and detailed preferences: if you do not give them, nothing is blocked; the match is just less precise.

Changes to this policy

We always publish the current version on Pisio. If we make significant changes to how we process your data, we will inform you before they apply. If a change requires new consent, we will ask you for it before carrying out that processing.