Privacy Policy
Last updated: June 26, 2026
Estity ("Estity", "we", "us") provides a platform that helps owners manage property in Spain — organising property information and documents, tracking finances, preparing and filing tax declarations, and related features. This policy explains, in plain terms, what personal data we process, why, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
In short:
- We collect only the data we need to run your account, your properties, and the features you use.
- We use trusted providers (such as Stripe for payments) and enrich your property with data from public registries to help you meet your obligations.
- We do not sell your personal data.
- You can access, correct, export, or delete your data, and object to certain processing, by emailing support@estity.com.
This policy does not cover third-party websites linked from our platform, which have their own policies.
Who we are
Estity AB (Swedish org.nr 559519-5164) is the data controller for the personal data described in this policy — including for the Platform, your account, and the tax-filing services. In this policy, "Estity", "we", and "us" refer to Estity AB.
We deliver the Spanish property and tax-related services — including submitting declarations to the Spanish Tax Agency (Agencia Tributaria, "AEAT") — together with our group company Estity Innovation SL (CIF B70939533, 29780 Nerja, Málaga, Spain), an authorised AEAT collaborator. Estity Innovation SL processes personal data on our behalf and on our instructions, as our data processor under a data-processing agreement.
We process your data in accordance with the GDPR, the Swedish Data Protection Act, applicable Spanish data protection law, and other applicable law. Our lead supervisory authority is the Swedish Authority for Privacy Protection (IMY).
Contact: support@estity.com (use the subject line "Data protection" for privacy matters).
Personal data we collect
Depending on how you use Estity, we process the following categories of data. The examples are illustrative, not exhaustive.
Data you provide
- Account and contact data — such as name, email, optional phone number, language preference, and password (stored hashed). If you sign in with Google or Facebook, we receive basic profile information from them.
- Property data — information about the properties you manage, such as address and characteristics, values, and other economic data, together with documents, photos, receipts, and notes you add.
- Tax and financial data — information needed to prepare tax declarations (such as Modelo 210) and to track property finances, such as ownership shares, purchase and sale dates, property and transaction values, acquisition and financing costs (including loan interest), rental income and expenses, tax identification numbers (such as NIE/NIF), and bank details (e.g. IBAN) where you choose to pay tax by direct debit. We also store tax-filing and payment receipts.
- Identity verification data — for certain add-on services (such as applying for a NIE number or a digital ID/certificate), identification documents you provide.
- Onboarding and questionnaire responses — answers you give about your property and goals so we can guide you through your obligations and tailor the platform to you.
- Communications and feedback — support messages, survey and feedback responses, and other content you send us.
Data about other people that you provide
To use certain features, you may give us personal data about other people, such as:
- Property owners and co-owners named on a tax declaration (which can include identity details, date and place of birth, tax identifiers such as NIE/NIF, address, and tax-residency information) — these people may not have an Estity account
- Tenants or guests where you use rental features (such as name and contact details)
- Contacts and collaborators you add or invite to a property (such as name, email, and phone)
You are responsible for ensuring you are allowed to share this data with us — for example, that you have informed the person concerned or otherwise have a lawful basis. We use it only to provide the feature you are using.
Because these people usually do not have an Estity account, we normally cannot contact them directly. In line with Article 14 GDPR, we ask you to make this policy available to them, and we publish it openly on our website; where contacting them individually would be impossible or involve disproportionate effort, we rely on the exemption in Article 14(5)(b). If one of these people contacts us, we will tell them what we hold and honour their rights.
Data we collect automatically
Usage and technical data — IP address, device and browser information, activity logs, and cookie and similar technology data (see Analytics, cookies, and tracking).
Data from other sources
- Payment providers (Stripe) — payment and subscription status
- Analytics and advertising partners (e.g. Google, Microsoft, Meta)
- Public registries and data providers — to enrich your property and help you understand and meet your obligations, we retrieve and store information from public and third-party sources such as the Spanish cadastre (Catastro), mapping and address providers, and tourism/rental registries
- Referral and affiliate partners — where you registered through a partner
You do not have to provide the data we request, but without it we may be unable to provide our services.
How we use your data and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account and provide the platform — including property management, document storage, tax-declaration preparation, property finance tracking, rentals, contacts, and collaboration | Contract (Art. 6(1)(b)) |
| Enrich your property with data from public registries to help you understand and meet your obligations | Contract and legitimate interest (Art. 6(1)(b), (f)) |
| Process payments and subscriptions | Contract (Art. 6(1)(b)) |
| Operate referral and affiliate programs (attribution, discounts, commission, limited partner reporting) | Legitimate interest (Art. 6(1)(f)) |
| Operate, secure, and improve the service, including usage analytics | Legitimate interest (Art. 6(1)(f)); consent where required for non-essential cookies (Art. 6(1)(a)) |
| Marketing and analytics cookies on our public website | Consent (Art. 6(1)(a)) |
| Newsletters and marketing emails | Consent (Art. 6(1)(a)), or legitimate interest for similar products to existing customers |
| Meet legal, accounting, and tax obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interest, we have weighed our interests against your rights and freedoms; you can request more information about that assessment, and you can object to such processing (see Your rights).
Analytics, cookies, and tracking
We use cookies and similar technologies to keep you logged in, remember your settings, secure the service, analyse how our website and platform are used, and — on our public website — measure marketing. The main tools we use are Google Analytics, Microsoft Clarity (including heatmaps and session replay), and Meta Pixel.
- Public website (estity.com): non-essential analytics and advertising cookies are set only with your consent, managed through Cookiebot. You can view or change your choices at any time via the Cookiebot icon on the site.
- Logged-in platform: cookies and similar technologies that are necessary to provide the service (such as login and security) are used without consent. Non-essential analytics, marketing, and session-replay tools run only if you opt in through our in-app consent prompt, which is separate from accepting these terms and off by default. You can change or withdraw your choices at any time under Settings → Privacy, in three categories: Statistics (Google Analytics), Marketing (Meta Pixel and the Meta Conversions API), and Help us improve Estity (Microsoft Clarity session replay, with sensitive fields masked). Withdrawing a category stops the tool and clears its cookies.
For a full list of the cookies we use and how to manage them, see our Cookie Policy. Learn more about these tools at Google, Microsoft and Meta.
Payments
We provide secure payment through Stripe. Payment is handled on Stripe's secure, encrypted pages; we never store your full card details. See Stripe's privacy policy.
Who we share data with
We share data only where needed to run our services, where you have consented, where required by law, or based on a legitimate interest not overridden by your rights. Categories of recipients:
- Estity Innovation SL (our Spanish group company) — as our processor, to deliver Spanish property and tax services and submit declarations to the AEAT
- IT and cloud providers — hosting, infrastructure, backups
- Stripe — payment processing
- Email and communication providers — transactional email and support
- Mapping, address, and registry data providers — to look up and enrich property information you ask us to process
- Analytics and advertising partners (Google, Microsoft, Meta) — as described above
- Referral and affiliate partners — limited per-signup and aggregate data as described below
- Property broker partners — where you connect with one, your contact and property information for their brokerage/advisory services, with your consent (see below)
- Spanish Tax Agency (Agencia Tributaria, AEAT) — when you instruct us to file a declaration, we submit the relevant declaration data to the AEAT on your behalf
- Professional advisers and authorities — where necessary or legally required
When you choose to file a tax declaration through us, you instruct us to submit your declaration data to the AEAT. Depending on the payment method you choose, we may also receive your tax payment and forward it to the AEAT on your behalf. Once a declaration has been submitted to the AEAT, it generally cannot be recalled.
We use data processors who act only on our instructions, under written data-processing agreements, mainly within the EU/EEA. We do not sell your personal data.
Referral, affiliate, and broker partners
Affiliate and referral partners promote Estity using a unique link or landing page that contains their affiliate code. They simply drive traffic to us — they do not enter, submit, or provide your name, email, or any other personal data about you. You always create your own account yourself, and you are asked to accept this policy and our Terms of Service before completing registration. When you register after arriving through such a link, your account is linked to that partner so we can apply any discount you are eligible for, attribute your registration correctly, and calculate commission.
How much we share through our partner portal depends on the type of partner and your consent:
- Lead and affiliate partners (who drive traffic via their link): the partner sees limited information about you — your name, your email in masked form (e.g. `j***n@example.com`), your registration date, and your referral status (e.g. registered, verified, paying) — plus aggregate totals such as number of referrals and overall commission. We share this based on our legitimate interest in operating a fair referral program, and because you are informed of it when you register through a partner link.
- Property broker partners (real-estate broker offices that provide property brokerage and advisory services to you): where you connect with such a partner and consent, we share — for the purpose of those brokerage/advisory services — your contact details and property information, including address and location (latitude/longitude), property type, cadastral reference and value, purchase and sale price, valuations, purchase date, and the public registry data we have retrieved from the Catastro (such as build year, registered built and total area, building parts, and the municipal tax rate and its update year). These brokers act as independent controllers for their services to you, under data-sharing terms with us. We rely on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time under Settings or by emailing support@estity.com.
For every partner type, we do not share the contents or amounts of your tax declarations, the number of declarations, your uploaded documents and receipts, your payment history, or your card data.
Where a property has co-owners, the property information shared with a broker partner may include their details; because they may not have an Estity account, we ask you to make this policy available to them (see Data about other people that you provide).
Partners must not use your data for unrelated marketing without their own lawful basis. If you do not want your account linked to a partner, register using our standard link instead.
User-to-user referrals: you can refer others either by entering their email address (we then process that email address and the referral status) or by sharing your own unique referral link yourself — in which case we collect no details about the recipient until they choose to register. If you accept a referral, we link your account to it so rewards can apply. An inviter can see only the email address they invited and its status — nothing else about your account.
International transfers
Your data is primarily processed within the EU/EEA. Where data is transferred outside the EU/EEA (for example, by some of our service providers), we apply appropriate safeguards such as the European Commission's Standard Contractual Clauses, or rely on an adequacy decision.
How long we keep your data
We keep your data only as long as necessary for the purposes above, and then delete or anonymise it. In practice:
| Data type | Retention period |
|---|---|
| Account, property, and document data | While your account is active and for a limited period afterwards. |
| Accounting records | Generally 7 years, as required by Swedish bookkeeping law (Bokföringslagen). |
| Tax-related declaration records | For the period during which the tax authorities may review a filing (in Spain, generally at least 4 years). |
| Referral and commission records | As long as needed to run the programs and meet accounting/tax obligations. |
| Marketing consents | Until you withdraw consent or unsubscribe. |
| Technical and analytics logs | For limited periods under our retention schedule. |
When you delete your account, we delete or anonymise your personal data in line with our process, keeping only what we are legally required to retain.
How we protect your data
We apply technical and organisational measures including encryption, access controls and least-privilege principles, regular review of our systems, staff training, and data-processing agreements with our suppliers. Sensitive details about property owners and rental guests — such as tax identifiers, contact details, and addresses — are encrypted. No method of transmission or storage is completely secure; if you believe your account has been compromised, contact support@estity.com.
Automated decisions and minors
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects (Art. 22 GDPR).
Estity is intended for property owners and other adults aged 18 or over. Our services are not directed at children, and we do not knowingly collect their data. If you believe a minor has provided us personal data, contact us and we will delete it.
Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction, and data portability, to object to processing based on legitimate interest (including direct marketing), and to withdraw consent where processing relies on it. Withdrawing consent does not affect processing carried out before withdrawal.
Contact support@estity.com to exercise your rights; we may verify your identity first, and we aim to respond within one month.
If you are not satisfied, you can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) — imy.se, Box 8114, 104 20 Stockholm. You may also complain to the supervisory authority in your country of residence (for example, the Spanish Data Protection Agency, AEPD, if you live in Spain).
Changes to this policy
We may update this policy from time to time. The date above shows the latest change, and material changes will be published on our website and, where required, notified by email or in the platform.
Contact
Estity AB — support@estity.com — https://estity.com