Privacy policy
Versión 2.0 · Last updated: 31 August 2026
This policy explains what personal data we process, what for, for how long and who we share it with. It is written from an inventory of our own database and our own code: it describes what we actually do, not what these documents usually say.
The short version
We do not advertise and we do not sell your data to anyone.
The investor who buys your home never sees your name. They learn who you are on the day of signing before a notary, and not before.
We do not ask you for any health data. No medical questionnaire, no report. That is an important difference from a life insurance policy.
If you are only looking at the website, we store nothing in your browser.
You can ask us at any time what data of yours we hold, or ask us to erase it, and it is free.
1. Who is responsible for your data
You are welcome to visit us at our office: it is a real office, with opening hours, where we receive the clients who want to see our faces before deciding anything.
| Controller | RENTA100 SERVICIOS, S.L. |
| Tax ID (CIF) | B93763175 |
| Registered office | Paseo de Gracia 21, planta 5.ª, puerta 2.ª — 08007 Barcelona, Spain |
| Registry details | Registered at the Commercial Registry of Barcelona, Sheet B 661287, Folio 1, Entry 1 |
| Contact | info@renta100.com |
2. Where we start from
Before the small print, four decisions that explain everything that follows.
— We only ask you for what we need. To calculate your operation and to accompany you as far as the notary. No field in our forms exists "just in case".
— Your data comes from you. We do not buy lists, we do not take it from social media or public registers, and we do not enrich your record with third-party information. There is a single exception, explained in section 3.
— One email address, one role, for life. Someone who registers as a homeowner cannot also be an investor with the same email address. This is not a promise of goodwill: it is prevented in the database itself.
— We do not use passwords. To enter your private area we send a single-use link to your email. That way we do not have to store any password of yours, and you do not have to remember one.
3. What data we process
It depends on who you are to us. These are the possible situations.
3.1. If you are a homeowner, or thinking about selling
— Name and surname, telephone number and email address. — Address of the property, town and province. — Your age and your sex. We need both in order to calculate the operation. Section 4 explains why, because it deserves an explanation and not a parenthesis. — Your spouse's age, if the operation is also going to reserve their right of use. — The simulation you requested: value of the property, product chosen and the result of the calculation. — If you request an appointment: your name, telephone number, email address and the appointment itself. — If you ask us to call you: your name, telephone number, the time slot in which you prefer to be called and the reason for your enquiry. — A temporary code that we send to your email to check that the address is yours. — The year of birth of the person retaining the right of use, when the operation reaches formalisation.
3.2. If you are an investor
— Full name, telephone number and email address. — Full postal address, required for the deed before a notary. — An alternative email address for notices, if you give us one. — The operations in which you have invested or on which you have made an offer.
3.3. If you are a partner: agency, estate agent or property manager
— Trading name, contact email address and telephone number. — Your verified display name and your certification level. — If you ask to appear on the public map of partners: display name, logo, town, province and the coordinates of your office. This is publication on the internet, and that is why it is requested separately, with its own tick box, and we record the date and the exact wording you accepted. You can withdraw it whenever you wish. — If you introduce a property to us: the address of that property, town and province.
The exception announced above. When a partner introduces an interested homeowner to us, that person's data reaches us through them. In that case it is the partner who must have informed that person and obtained their permission before giving it to us, and that is stated in the undertaking they sign when they join.
3.4. If you have only subscribed to the newsletter or the opening notice
— Your email address. Nothing else. — The date you subscribed and the full literal wording you accepted, so that two years from now it can be checked exactly what you said yes to. — If you unsubscribe, the date you did so.
3.5. If you are only looking at the website
We store nothing in your browser. We have checked this by measuring it: on arriving at our website no cookie is installed, and nothing is stored in local storage, in session storage or in the browser database. The detail is in our Cookie Policy.
3.6. Technical records
Like any internet service, our servers receive the IP address you connect from. We use it for one thing only: to prevent anyone from sending hundreds of requests in a row and making the service unusable for everyone else. That address is held in the rate-limiting system operated by Upstash and is deleted automatically at most one hour after your last request. We do not link it to your name, we do not use it to find out who you are, and we do not keep it in our database.
3.7. What we do not process
This list is not a statement of intent. It is the result of searching for each of these items, one by one, in the tables of our database.
— No health data. Our calculation does not ask about your state of health, does not put you through a medical questionnaire and does not ask you for a report. — Not your marital status. We do ask for your spouse's age when the operation requires it, which is a different thing. — No estimate of your life expectancy linked to your name. The calculation is made using statistical tables and your age; we neither produce nor store an individual forecast about you. — Not your device identifier or your browser fingerprint. — No tracking pixel and no advertising tool. None. We have checked this across all of our code. — We do not sell, rent or transfer your data to anyone for commercial purposes. — We do not build an advertising profile of you and we do not follow your journey between visits.
3.8. Your identity document
Intermediation in the sale and purchase of property is subject to anti-money-laundering rules. That means that, when an operation moves forward, we are required to identify you formally with an official document — national identity card, foreigner's identity number or passport — and to retain that identification. We do not ask for it out of curiosity or at the beginning: we ask for it when the law requires us to, and we will tell you so in these same words.
3.9. If you write to us on WhatsApp
We offer WhatsApp as a contact channel because many families find it the most convenient. There are two things worth knowing. The first is that this service is provided by Meta, not by us, and it is also governed by Meta's own terms and privacy policy, over which we have no control. The second is that, precisely for that reason, we will never ask you through that channel for sensitive data, or for your identity document number, or for bank details. If the conversation moves forward, we continue it by telephone, by email or at our office.
4. Why we ask for your age and your sex
It is the most uncomfortable question on our form and it deserves a direct answer.
All the products we intermediate — bare ownership, property-backed life annuity, fixed-term annuity and sale with a lifetime tenancy — have a price that depends on how long you are going to go on living in your home. It is not an estimate about you in particular: it is the same calculation any notary makes when valuing a lifetime right of use, and it rests on statistical mortality tables, which are built by age and by sex.
That is the only use. Age and sex are used to calculate the operation and to show it to the investor anonymously. They are not used for anything else: not to classify you for campaigns, not to decide whether to deal with you, not to offer you a different product from the one that applies to you.
5. What the investor who buys your home sees, and what they never see
This is not a courtesy. It is prevented in the database and there are automated checks that fail if anyone tries to change it.
The investor learns your identity at one single moment: when the operation is signed before a notary, because in order to buy a house you have to know who you are buying it from. Not before.
| What they see | What they never see |
|---|---|
| Your age | Your name and surname |
| Your sex | The exact address of your home |
| The product | Your telephone number and email address |
| The town and province | Your marital status |
| The price | Any health data |
| An indicative rate of return | Your date or year of birth |
6. What we use your data for, and on what legal basis
Where the basis is your consent, you can withdraw it whenever you wish, and withdrawing it is as easy as giving it. Doing so does not affect what we did before you withdrew it.
| Purpose | Legal basis |
|---|---|
| Calculating your indicative valuation and preparing an offer for you | Steps prior to a contract, at your request (Art. 6(1)(b) GDPR) |
| Arranging and managing your appointment with an adviser | Steps prior to a contract (Art. 6(1)(b) GDPR) |
| Managing your investor account and the operations you take part in | Performance of the contract (Art. 6(1)(b) GDPR) |
| Managing the partner network, its certification and its commission | Performance of the contract (Art. 6(1)(b) GDPR) |
| Publishing your entry on the public map of partners | Your consent (Art. 6(1)(a) GDPR), requested separately and revocable |
| Sending you the newsletter or notifying you of our opening | Your consent (Art. 6(1)(a) GDPR), revocable in every message |
| Identifying you and retaining the documentation of operations, under anti-money-laundering rules | Legal obligation (Art. 6(1)(c) GDPR) |
| Meeting our tax, accounting and company-law obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Protecting the service against abusive use and attacks | Legitimate interest (Art. 6(1)(f) GDPR) |
| Knowing how many visits the website receives, in aggregate and anonymously | Legitimate interest (Art. 6(1)(f) GDPR) |
7. How long we keep your data
The 7-day rule does not apply if you marked the simulation as a favourite, if it generated documents, if it gave rise to an offer, if you verified your email address or if it ended in an operation: in those cases it stops being an enquiry and becomes part of your file.
| Data | Period |
|---|---|
| A simulation that leads nowhere | 7 days. An automated process deletes it every night |
| Scenarios kept once the period has passed | Retained without any data that identifies you, for statistics only |
| A contact who does not become a client | 12 months from the last contact |
| Appointments held or cancelled | 12 months |
| Email verification code | 24 hours after it expires |
| IP address in the rate-limiting system | At most one hour after your last request |
| Newsletter unsubscription | 3 years, solely in order to be able to evidence that you unsubscribed |
| Operations signed before a notary | 10 years, as required by anti-money-laundering rules |
| Invoicing and accounting | The periods set by company law and tax law |
| Data of a closed account | Deleted when it is closed, except for what we must keep by legal obligation and what is strictly necessary to evidence the closure itself |
8. Who has access to your data
We do not transfer your data to anyone who wants to use it for their own purposes. We do work with technology providers who process it on our behalf and on our instructions, under a signed processing agreement. We name them all:
Meta is not a provider of ours. If you write to us on WhatsApp, that service is provided by Meta under its own terms and does not act on our behalf or on our instructions. That is why it does not appear in the table above: it is not someone we entrust with processing your data, it is a service you choose to use in order to talk to us.
The calculation engine receives figures, not people. When we calculate your operation, all that reaches the engine is the age, the sex and the value of the property. Not your name, not your address, not your telephone number, not your email address.
No data of yours reaches Microsoft. When you book an appointment, an event is created in our adviser's calendar, but that event does not carry your name, your email address or your telephone number, and you do not appear as an attendee. The adviser looks your details up in our own system. It is a design decision, not a coincidence.
Transfers outside the European Union. Some of these providers have their parent company outside the European Union. In those cases the transfer of data relies on the safeguards provided for in Chapter V of the Regulation: the standard contractual clauses approved by the European Commission or, where applicable, the adequacy framework recognised by the Commission.
Authorities. We will provide your data to a court, to the Spanish tax authority, to the anti-money-laundering authority or to law enforcement where a rule requires us to. In no other case.
| Provider | What for |
|---|---|
| Supabase | Our database. The servers are in Frankfurt, Germany |
| Vercel | Hosting of the website and cookieless visit counting |
| Brevo | Automated emails and newsletter. A French company |
| Microsoft 365 | Team email and appointment calendar |
| Railway | Actuarial calculation engine |
| Upstash | Request rate limiting |
| Sanity | Manager of editorial content. Does not process client data |
9. Automated decisions
Our simulator calculates a figure automatically, but that figure is not a decision about you. It is an indicative valuation, pending actuarial validation, and it always carries that warning.
No offer closes by itself: a person reviews it, and the operation only exists once it is signed before a notary, with your independent legal adviser beside you if you so wish. We do not refuse you anything automatically and there is no system that scores you.
10. Your rights
You can exercise these rights free of charge and at any time:
Write to us at info@renta100.com stating which right you wish to exercise. We will reply within one month. We may ask you to prove your identity: that is so that we do not give your data to someone else.
If you believe we have not dealt with you properly, you can complain free of charge to the Spanish Data Protection Agency (Agencia Española de Protección de Datos), calle Jorge Juan 6, 28001 Madrid (www.aepd.es).
| Access | To know what data of yours we hold and what we do with it |
|---|---|
| Rectification | To correct data that is wrong or incomplete |
| Erasure | To ask us to delete it |
| Objection | To object to our processing it |
| Restriction | To ask us to keep it but not use it |
| Portability | To take it away in a format you can reuse |
| Withdrawal of consent | Where that is the basis on which we process your data |
11. How we protect your data
Without going into detail that would make an attack easier: the database is encrypted and hosted in the European Union; permission to read each row is controlled by rules inside the database itself, and not only in the application; we do not store passwords, because we do not use passwords; all communications are encrypted; and the few cookies we use cannot be reached from the page's code and travel only over a secure connection.
No system is invulnerable. If a security breach occurred that posed a risk to your rights, we would inform you and would notify the supervisory authority within the statutory deadlines.
12. Minors
Our services are aimed at adults and, in the case of homeowners, normally at people over 65. We do not knowingly process the data of minors. If we detect that we have received a minor's data, we delete it.
13. Cookies
These are dealt with in a separate document: our Cookie Policy, where you will find the full inventory of what is stored in your browser, cookie by cookie. In summary: there are three, all of them ours, none of them for advertising, and none of them appears if you are only looking at the website.
14. Changes to this policy
If we change anything material, we will update the date at the top and, where the change affects you directly, we will tell you. We keep previous versions: if you gave your consent on a particular version, we keep a record of which one it was.
This policy is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation) and by Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights.