Last update: 12/10/2026
1) Data Controller
Controller: Jo Grosemans (operating personally under the brand “Coliving Vibes”).
Service address: Hoeilaart, Belgium
Contact email: info@colivingvibes.com
Website: https://www.colivingvibes.com
This policy applies to the website and our contact channels (email, phone, WhatsApp, forms and social media).
2) Data we process
- Identification & contact: name, surname, email, phone, city/country.
- Pre-selection/compatibility: planned dates, purpose of stay (work/studies), short professional/education profile (e.g., LinkedIn), prior references.
- Affordability/solvency (we may request more than one proof): last 3 payslips, employment contract or employer letter, current enrolment, or bank statement anonymised (name+IBAN; the rest hidden).
- Contract & invoicing: data required to draft the agreement and issue invoices; ID document (type and number and, where strictly necessary and justified, a copy/photo); permanent address; residence/visa status if applicable (non-EU).
- Proof of the temporary purpose of the contract (required by art. 66 bis of Catalan Law 18/2007), depending on the reason for your stay:
- Work: fixed-term employment contract or a certificate/letter from the company stating the reason for and expected duration of the assignment; where applicable, professional appointment or Social Security registration.
- Studies: enrolment or admission letter, certificate from the institution and academic calendar.
- Internship: internship agreement or certificate from the university or company stating the start and end dates.
- Signed declaration of the temporary purpose and of your habitual residence (contract annex).
- For extensions: updated documentation proving that the temporary purpose continues.
- Habitual residence outside the rented property: certificate of municipal registration (empadronamiento); if you live outside Spain, a certificate of residence from your country; or, alternatively, a rental contract, title deed, utility bill or tax return for that address. If you register at the property, at the end of your stay we may ask you for proof of deregistration from the municipal register.
- Return to your home country or address: in some cases, return tickets or an equivalent document proving your return, and a visa where applicable.
- During stay (operations): communications, tickets and photos of incidents (only when necessary), emergency contact (name, relationship, phone) (mandatory).
- Payments & deposit: IBAN/holder to refund the deposit by bank transfer (deleted within 90 days after refund and reconciliation).
- Guarantor (only when requested): name, identity document, contact details and proof of financial solvency (payslips, employment contract or anonymised bank statement). If you give us your guarantor's details, you must inform them beforehand; we will also inform them of this processing.
- Contract formalisation: inventory, handover record and photos of the condition of the room at check-in and check-out, and the electronic signature data of the contract (signer identity, date, IP address and signing platform record).
- Browsing/cookies: essential cookies for operation; analytics/marketing only with consent (see Cookies Policy).
We do not collect special categories (health, beliefs, etc.). Please do not send such information.
3) Purposes & legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Handle enquiries and requests (email, WhatsApp, forms) | Pre-contractual steps / Consent |
| Tenant selection (compatibility) and affordability checks | Contract performance + Legitimate interest (co-living balance & fraud prevention) |
| Contracting, stay management, incidents & maintenance | Contract performance |
| Billing & tax duties | Legal obligation |
| Proving the tenant's temporary purpose and habitual residence, and lodging that documentation together with the security deposit | Legal obligation (art. 66 bis Law 18/2007) and performance of the contract |
| Assessing and formalising the guarantor's guarantee | Performance of the contract and legitimate interest (securing compliance with the contract) |
| Electronic signature of the contract and retention of proof of signature | Performance of the contract and legitimate interest (proof of signature) |
| Review and correction of contracts by lawyers, and legal advice or defence | Legitimate interest (regulatory compliance and defence of rights) |
| Responding to inspections and requests from the competent authorities | Legal obligation |
| Handling data-subject rights | Legal obligation |
| Marketing/newsletters | Consent (opt-in; revocable) |
| Website security (essential cookies) | Legitimate interest |
| Analytics/marketing cookies (if enabled) | Consent |
| Deposit refund by bank transfer (IBAN) | Contract performance (deleted in 90 days) |
Light profiling may be used for room assignment and co-living compatibility, always with human review. No automated decisions with legal effects. You may object where based on legitimate interest.
4) Source
Directly from you (Google Forms, Gmail email, WhatsApp, calls) and, where relevant, from portals/social platforms you used to contact us. Where there is a guarantor, their data is provided by the guarantor or by the tenant. Certificates from companies, universities or internship providers are provided by the tenant.
5) Recipients (processors & third parties)
We share data only with necessary providers under processor agreements (Art. 28 GDPR):
- Formspree (Formspree Inc., USA): processes the contact form submission (name, email, phone and message). International transfer covered by standard contractual clauses.
- Matterport: virtual tour of the property, only if you accept cookies.
- Google: embedded virtual tour, only if you accept cookies.
- Hostinger: website hosting/domain email.
- Google (Gmail, Google Forms, Drive/Docs/Sheets): email, forms and productivity.
- WhatsApp (Meta): operational messaging (sending sensitive documents via WhatsApp is discouraged).
- Notion: internal organisation and task management.
- Social media (Facebook/Instagram, LinkedIn, TikTok, YouTube): only when you interact with our pages.
- Banking institutions: payments and deposit refunds by transfer.
- DocuSign: electronic signature of the contract.
- INCASÒL (Generalitat de Catalunya deposit register): lodging of the security deposit together with the documentation proving the temporary purpose and habitual residence, as required by law.
- Competent authorities in the event of an inspection or request (housing, consumer, tax or data protection, among others: Generalitat de Catalunya, Agència de l'Habitatge de Catalunya, City Council, Spanish Tax Agency (AEAT) or AEPD): the contract and temporary-purpose documentation they request, as required by law.
- Lawyers and legal advisers, bound by professional secrecy and confidentiality: to draft, review and correct contracts, and to advise or defend us in claims, inspections or proceedings.
Disclosure may also occur under legal obligation (authorities, courts, tax authorities, law enforcement).
6) International transfers
Some providers (Google, Meta/WhatsApp, Notion, DocuSign) may process data outside the EEA. We rely on Adequacy Decisions, Standard Contractual Clauses (SCC) and, where applicable, the EU-U.S. Data Privacy Framework, plus supplementary measures. Details available at info@colivingvibes.com.
7) Retention
- Unconverted enquiries: up to 12 months.
- Pre-selection not resulting in contract: up to 24 months (re-contact if authorised; you can object).
- Contracts, invoices and records: term + 6 years (commercial) and 4 years (tax).
- Communications & incidents: term + up to 5 years (liabilities).
- ID copy/photo (if retained): contract term + 5 years (restricted access, encrypted in transit).
- IBAN for deposit refund: deleted within 90 days after refund and reconciliation.
- Marketing (consent): until withdrawal or opt-out.
- Documentation proving the temporary purpose and habitual residence (including tickets): for the term of the contract and any extensions and, afterwards, blocked (art. 32 LOPDGDD) for the same period as the contract (term + 6 years) and, in any case, for as long as administrative, civil or tax liability arising from the contract may be claimed. While blocked, it is only used to respond to judges, courts and competent authorities or to defend our rights.
- Guarantor data: the same periods as the contract the guarantee relates to.
- Proof of electronic signature and handover inventory/photos: term + up to 5 years.
- Cookies/IDs: see Cookies Policy.
8) Your rights
You may exercise access, rectification, erasure, objection, restriction, portability and the right not to be subject to automated decisions by emailing info@colivingvibes.com with “GDPR – rights request” and proof of identity.
You may also lodge a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es.
9) Mandatory data
Fields marked as mandatory are required to process your request or sign the contract. If not provided, we may be unable to proceed.
10) Minors
Our services are intended for adults (18+).
11) Security
We apply reasonable technical and organisational measures (access controls, access logs, encryption in transit, backups, processor agreements, minimisation). No system is 100% secure on the Internet.
13) Changes
We will publish any relevant updates to this policy to reflect legal or operational changes.