Privacy Policy

Last updated: 10 October 2026.

This policy explains how personal data is processed when you use Habiatza, submit a form, interact with the AI assistant, request a valuation or report, ask for human review or subscribe to Habiatza Pulse.

1. Data controller

Controller: Alejandro Abreus Vila / Habiatza. Privacy contact: hola@habiatza.com. Full identification details are available in the Legal Notice of the responsible professional.

2. Data we process

• Contact and communication details.
• Information about properties, location, characteristics, sale or rental objectives and commercial context.
• Content of enquiries and conversations with the AI assistant.
• Technical data required for security, session continuity, abuse prevention and request traceability.
• Visit-source and campaign data where UTM parameters or a referrer are available.
• Consent and communication preferences.

3. Purposes and legal bases

• Answer enquiries and prepare analyses, reports, indicative valuations and professional review: pre-contractual steps or performance of the service requested.
• Manage professional engagements: contractual performance and legal obligations.
• Security, fraud prevention and abuse defence: legitimate interests and security obligations.
• Habiatza Pulse and commercial communications: consent where required or another lawful basis permitted for an existing relationship, always with a simple and free right to object.
• Non-essential analytics or marketing: prior consent where required.

4. Artificial intelligence and automated decisions

Habiatza uses AI systems to classify enquiries, structure information, summarise context and generate explanations or proposed next steps. Users are informed when they are interacting with an AI system. AI responses may contain errors and should be verified where relevant decisions are involved.

The chatbot is not used to make solely automated decisions producing legal or similarly significant effects on an individual. Human review can be requested or triggered where appropriate.

5. Recipients and processors

Data may be processed by providers required for hosting, security, email, automation, consented analytics, storage, forms and AI processing. Depending on the feature used, services may include web-infrastructure providers, Cloudflare Turnstile for anti-abuse security, Google services for automation or storage and OpenAI for technical AI processing.

Personal data is not sold to advertisers. Disclosure to external professionals, authorities, notaries, registries, financial institutions or other recipients occurs only where required for a requested service, a legal obligation or another valid legal basis.

6. International transfers

Where a provider processes data outside the European Economic Area, safeguards required by the GDPR will be used as applicable, such as adequacy decisions, Standard Contractual Clauses or other legally valid transfer mechanisms.

7. Retention

Data is kept for as long as necessary for the relevant purpose and, afterwards, for applicable limitation or statutory retention periods. Data used for commercial communications is kept until consent is withdrawn or the right to object is exercised, unless another lawful basis applies.

8. Your rights

You may exercise rights of access, rectification, erasure, objection, restriction and portability where applicable, and withdraw consent, by emailing hola@habiatza.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

9. Children

Habiatza is not specifically directed at minors. Data concerning minors should not be submitted unless an appropriate legal basis exists and the information is strictly necessary for a legitimate matter.

10. Security and data minimisation

Technical and organisational measures are used to reduce the risk of unauthorised access, loss, alteration or improper disclosure, and data is limited as far as reasonably possible to what is necessary for each purpose.