homeifyInstall
Create home

Data processing annex

Last updated: July 2026

This annex forms part of the terms of service and governs the processing of personal data that homeify carries out on behalf of the landlord when they use a home of the Letting kind. It meets the requirements of Article 28(3) of Regulation (EU) 2016/679 (GDPR) and of Spanish Organic Law 3/2018 (LOPDGDD).

It applies only to homes of the Letting kind. In family homes and flatshares, each person enters their own data and that of the people they live with, and there is no processing arrangement to govern there: the privacy policy simply applies.

1. The parties

Controller: the individual or legal entity holding the account that creates the letting home and enters the tenancy agreement (hereinafter, “the landlord”). They decide what data is entered, for what purpose and for how long.

Processor: Daniel Cimorra Tapia, an individual with Spanish tax number 77132714Y and address at Calle José Luis Albareda 6, 3.º D, 50004 Zaragoza (Spain), operator of homeify.cc and hogarify.cc —the same service under two trading names— (hereinafter, “homeify”). It processes that data solely in order to provide the service, following the landlord's instructions.

No data protection officer has been appointed, as none of the cases in Article 37(1) GDPR applies. For any matter relating to this annex, the channel is [email protected].

2. Subject matter, duration and nature of the processing

Subject matter: the hosting and processing of the personal data the landlord enters into their letting home in order to manage the tenancy of a property.

Nature and purpose: storage, organisation, consultation, modification and erasure of that data for the sole purpose of allowing the landlord to run the contract, issue and record the receipts, handle repairs at the property, take the check-in and check-out inventories, settle the deposit and keep the associated paperwork. homeify does not process that data for any purpose of its own: it does not analyse it, does not use it for profiling, does not disclose it for commercial purposes and does not train any automated system on it.

Duration:for as long as the landlord's account and the corresponding home exist, and for the deletion period set out in clause 9.

3. Categories of data subjects and of data

Data subjects: tenants and other parties named on the tenancy agreement, as well as third parties whose data the landlord chooses to enter (for example, tradespeople or block managers recorded as property contacts).

Categories of data the product allows to be entered:

  • Identifying: name and surname, identity document, email address and phone number.
  • Financial: rent, deposit and security, receipts, payments, outstanding amounts and settlements.
  • Relating to the property: repairs with their description, their conversation and their photographs; check-in and check-out inventories with the condition of each room, photographs and meter readings.
  • Documentation the landlord uploads to the Documents module and associates with the tenancy.

No special categories of data under Article 9 GDPR are processed, nor data relating to criminal convictions or offences. The product does not ask for them in any form and the landlord undertakes not to enter them: if they do, they do so outside the intended purpose and under their sole responsibility.

4. homeify's obligations as processor

homeify undertakes to:

  • Process the data only on documented instructions from the landlord. Normal use of the product —what the landlord does through their own screens— constitutes that documented instruction.
  • Not disclose the data to third parties other than the sub-processors in clause 6, or where required by Union or Member State law; in that case, to inform the landlord beforehand unless that same law prohibits it on grounds of public interest.
  • Ensure that anyone with access to the data is bound by a duty of confidentiality, which continues indefinitely after the end of the relationship.
  • Not access any home's content unless it is strictly necessary to resolve a specific technical incident reported by the landlord. That access is logged with its reason. The platform administration panel shows metadata and usage counters, never content.
  • Apply the security measures in clause 5.
  • Assist the landlord, as far as possible and by appropriate technical measures, in responding to data subjects' requests to exercise their rights.
  • Help them comply with the obligations in Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available.
  • Make available the information needed to demonstrate compliance with this annex and allow audits on the terms of clause 8.

5. Security measures

Taking into account the state of the art, the costs and the nature of the processing, at least the following measures are applied:

  • Encryption in transit on all communications (TLS), and encryption of configuration secrets in the database with AES-256-GCM.
  • Isolation between homes:every entity is tied to its home and every query is scoped by it. When something doesn't belong to whoever is asking, the answer is “not found” and not “forbidden”, so as not to confirm even that it exists.
  • Passwordless authentication by single-use link with a fifteen-minute expiry and an attempt limit, and sessions using server-side cookies kept completely separate between the household panel and the platform administration.
  • Access control by role and permission within each home, checked on every request and not only when rendering the screen. Files are not served as static assets: every download revalidates the session and membership.
  • Files outside the public directory, with a random name generated by the system —never the name sent by the browser— and the file type verified from its binary content.
  • Daily backups of the database and the file store, and an audit log of sensitive operations.
  • Minimisation:the product does not ask for a profile photograph or any data it doesn't need, and expressly warns that running a tenancy does not require uploading an identity document or a payslip.

6. Sub-processors

The landlord gives general authorisation for engaging the sub-processors needed to provide the service. As at this version, the following are involved:

  • Hosting and infrastructure provider, where the application and the database run, with servers in the European Union.
  • Cloudflare, Inc. — delivery network and access tunnel to the service. It processes connection data (IP address and request metadata), not the content of the homes.
  • Lemon Squeezy — payment gateway, and onlyif the landlord takes out a paid plan. It processes their billing data, not their tenants'.

Outbound email and file storage are provided using homeify's own means on the hosting infrastructure indicated, without any additional third party involved.

homeify will give notice of any addition or replacement of a sub-processor at least thirty days in advance, publishing it on this page and notifying by email those landlords with active letting homes. During that period the landlord may object; if they do and there is no reasonable alternative, they may terminate the service without penalty and with the right to a refund of the unused proportional part. Every sub-processor is contractually bound by obligations equivalent to those in this annex, and homeify remains liable for their acts.

7. International transfers

Data is hosted and processed within the European Economic Area. The providers in clause 6 whose parent company is outside the EEA provide the service from European infrastructure and, to the extent that any transfer may occur, it relies on the standard contractual clauses approved by the European Commission or on an adequacy decision in force. No transfers of the homes' content are made outside the EEA.

8. Audit

The landlord may request, once a year and with fifteen days' notice, the information reasonably necessary to verify compliance with this annex, as well as copies of any security certifications or reports available. If they need an in-depth audit, its scope will be agreed in writing; it will take place during working hours, without interrupting the service, and its cost will be borne by the landlord unless a breach attributable to homeify is found.

9. Return and deletion on termination

Once the service ends, and at the landlord's choice, homeify will return or delete the personal data processed on their behalf. Specifically:

  • The landlord can download a full copy of their data at any time and without asking, from their account.
  • When a home is closed down, it becomes inaccessible immediately and its data and files are permanently deleted after thirty days. That margin exists so a closure made by mistake can be reversed; after it, deletion is irreversible and reaches the backups on their next rotation.
  • Only what a legal obligation requires will be kept —for example, billing documentation— duly blocked and with restricted access for the corresponding limitation period.

10. Personal data breaches

homeify will notify the landlord of any personal data breach affecting their home without undue delay and, in any event, within forty-eight hours of becoming aware of it, with the information in Article 33(3) GDPR to the extent available: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

Notification to the supervisory authority and, where applicable, to the data subjects is the landlord's responsibility as controller. homeify will provide reasonable assistance to do so within the deadline.

11. The landlord's obligations as controller

By using a letting home, the landlord declares and undertakes to:

  • Have a lawful basis for processing the data they enter —normally performance of the tenancy agreement— and not to enter data unrelated to that purpose.
  • Inform their tenantsthat they use this tool and of the processor's identity, in accordance with Articles 13 and 14 GDPR.
  • Apply the principle of minimisation: not to upload documentation they don't need in order to manage the tenancy, and in particular not to include special categories of data.
  • Handle the rights requests their tenants direct to them, and pass on to homeify any instructions requiring technical action on our part.
  • Keep their access credentials confidential and withdraw access from anyone who no longer needs it.

If an instruction from the landlord infringes the GDPR or any other data protection rule, homeify will tell them immediately and may suspend carrying it out.

12. Acceptance and term

This annex is accepted when creating a home of the Letting kind, and that acceptance is recorded with its date. It replaces any previous agreement on the same subject and remains in force for as long as the landlord keeps a home of that kind.

Any material change will be communicated by email at least thirty days in advance. If the landlord does not agree, they may stop using the service and request deletion of their data under clause 9; continuing to use it after it takes effect constitutes acceptance.

Anything not covered here is governed by the terms of service and the privacy policy. This annex is governed by Spanish law and by the GDPR.

13. Contact

For any question about this annex, exercise of rights or notification of security incidents: [email protected]. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).