Last update: 23/08/2025
1) Data Controller
Controller: Jo Arthur L Grosemans (operating personally under the brand “Coliving Vibes”).
Spanish Tax/ID (NIE): Y5815097K
Service address: Hoeilaart, Belgium
Contact emails: info@colivingvibes.com · colivingvibes@gmail.com
Website: https://www.colivingvibes.com
This policy applies to the website and our contact channels (email, phone, WhatsApp, forms and social media).
2) Data we process
- Identification & contact: name, surname, email, phone, city/country.
- Pre-selection/compatibility: planned dates, purpose of stay (work/studies), short professional/education profile (e.g., LinkedIn), prior references.
- Affordability/solvency (we may request more than one proof): last 3 payslips, employment contract or employer letter, current enrolment, or bank statement anonymised (name+IBAN; the rest hidden).
- Contract & invoicing: data required to draft the agreement and issue invoices; ID document (type and number and, where strictly necessary and justified, a copy/photo); permanent address; residence/visa status if applicable (non-EU).
- Register certificate (empadronamiento): for temporary tenancy we may request a certificate proving your permanent registration elsewhere; if you register at the property, upon check-out we may request proof of de-registration.
- During stay (operations): communications, tickets and photos of incidents (only when necessary), emergency contact (name, relationship, phone) (mandatory).
- Payments & deposit: IBAN/holder to refund the deposit by bank transfer (deleted within 90 days after refund and reconciliation).
- Browsing/cookies: essential cookies for operation; analytics/marketing only with consent (see Cookies Policy).
We do not collect special categories (health, beliefs, etc.). Please do not send such information.
3) Purposes & legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Handle enquiries and requests (email, WhatsApp, forms) | Pre-contractual steps / Consent |
| Tenant selection (compatibility) and affordability checks | Contract performance + Legitimate interest (co-living balance & fraud prevention) |
| Contracting, stay management, incidents, cleaning & maintenance | Contract performance |
| Billing & tax duties | Legal obligation |
| Register certificate (proof of external domicile) / de-registration at check-out if applicable | Legitimate interest and, where applicable, local legal obligation |
| Handling data-subject rights | Legal obligation |
| Marketing/newsletters | Consent (opt-in; revocable) |
| Website security (essential cookies) | Legitimate interest |
| Analytics/marketing cookies (if enabled) | Consent |
| Deposit refund by bank transfer (IBAN) | Contract performance (deleted in 90 days) |
Light profiling may be used for room assignment and co-living compatibility, always with human review. No automated decisions with legal effects. You may object where based on legitimate interest.
4) Source
Directly from you (Google Forms, Gmail email, WhatsApp, calls) and, where relevant, from portals/social platforms you used to contact us.
5) Recipients (processors & third parties)
We share data only with necessary providers under processor agreements (Art. 28 GDPR):
- Hostinger: website hosting/domain email.
- Google (Gmail, Google Forms, Drive/Docs/Sheets): email, forms and productivity.
- WhatsApp (Meta): operational messaging (sending sensitive documents via WhatsApp is discouraged).
- Notion: internal organisation and task management.
- Social media (Facebook/Instagram, LinkedIn, TikTok, YouTube): only when you interact with our pages.
- Banking institutions: payments and deposit refunds by transfer.
Disclosure may also occur under legal obligation (authorities, courts, tax authorities, law enforcement).
6) International transfers
Some providers (Google, Meta/WhatsApp, Notion) may process data outside the EEA. We rely on Adequacy Decisions, Standard Contractual Clauses (SCC) and, where applicable, the EU-U.S. Data Privacy Framework, plus supplementary measures. Details available at info@colivingvibes.com.
7) Retention
- Unconverted enquiries: up to 12 months.
- Pre-selection not resulting in contract: up to 24 months (re-contact if authorised; you can object).
- Contracts, invoices and records: term + 6 years (commercial) and 4 years (tax).
- Communications & incidents: term + up to 5 years (liabilities).
- ID copy/photo (if retained): contract term + 5 years (restricted access, encrypted in transit).
- IBAN for deposit refund: deleted within 90 days after refund and reconciliation.
- Marketing (consent): until withdrawal or opt-out.
- Cookies/IDs: see Cookies Policy.
8) Your rights
You may exercise access, rectification, erasure, objection, restriction, portability and the right not to be subject to automated decisions by emailing info@colivingvibes.com with “GDPR – rights request” and proof of identity.
You may also lodge a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es.
9) Mandatory data
Fields marked as mandatory are required to process your request or sign the contract. If not provided, we may be unable to proceed.
10) Minors
Our services are intended for adults (18+).
11) Security
We apply reasonable technical and organisational measures (access controls, access logs, encryption in transit, backups, processor agreements, minimisation). No system is 100% secure on the Internet.
13) Changes
We will publish any relevant updates to this policy to reflect legal or operational changes.