yolisto
List

International Data Transfer Annex

Version 1.0 · Last updated: October 2026

1. Purpose and scope

This Annex forms part of the Yolisto Terms and Conditions of Use (the "Terms") and governs the delivery, by CIIGMA TECHNOLOGIES S.L. ("Ciigma"), of the personal data of people who enquire about a listing through the Platform (the "leads") to the agency, developer or agent with an account that publishes that listing (the "Agency").

It applies where the Agency is established outside the European Economic Area in a country that does not have an adequacy decision from the European Commission, such as Venezuela. If the Agency is established in the European Economic Area or in a country with an adequacy decision, this Annex has no effect for as long as that remains the case.

If the Agency's processing of that data were directly subject to Regulation (EU) 2016/679 ("GDPR") under its Article 3(2), the Agency will comply with the GDPR directly and the parties will adapt this Annex to the standard clauses the European Commission adopts for that situation.

2. Standard contractual clauses

Ciigma, as data exporter, and the Agency, as data importer, agree to the standard contractual clauses for the transfer of personal data to third countries approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "Clauses"), in their Module One: transfer controller to controller. The official text of the Clauses is published on EUR-Lex.

The Clauses are incorporated into this Annex by reference, in their literal text and without modification, with the options in section 3. Appendices I and II to this Annex are, respectively, Annexes I and II to the Clauses.

The Agency accepts and enters into the Clauses and this Annex by accepting the Terms on the Platform. As evidence of that acceptance, Ciigma keeps the date, the version and the digital fingerprint of the accepted text. Each acceptance forms a contract between Ciigma and that Agency.

3. Options chosen

  • Clause 7 (docking clause): not included.
  • Clause 11(a) (independent dispute resolution body): that option is not included.
  • Clause 13 (supervision): the competent supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
  • Clause 17 (governing law): Spanish law.
  • Clause 18 (choice of forum and jurisdiction): the courts of Madrid (Spain).

4. Relationship with the Terms

In the event of a conflict between the Clauses and the Terms or this Annex, the Clauses prevail. No provision of the Terms, including its limitations of liability, limits the liability provided for in Clause 12 of the Clauses or the rights the Clauses grant to data subjects.

5. How they apply in practice

Without prejudice to what the Clauses require:

  • Contact point (Clause 11): the Agency's contact point for data subjects is the email address of its account on the Platform. The Agency keeps it up to date.
  • Data subject rights (Clause 10): the Agency handles the requests it receives about lead data. If it needs help, it may write to legal@yolisto.app.
  • Personal data breaches (Clause 8.5): in addition to what that clause requires, the Agency notifies Ciigma at legal@yolisto.app, without undue delay, of any personal data breach affecting lead data.
  • Requests from public authorities (Clause 15): any notifications the Agency must give Ciigma are sent to legal@yolisto.app.
  • Copy of the Clauses: data subjects may ask either party for a copy of the Clauses and of this Annex; Ciigma provides it at legal@yolisto.app.

Appendix I (Annex I to the Clauses)

A. List of parties

Data exporter

  • Name: CIIGMA TECHNOLOGIES S.L., Spanish tax ID (NIF) B26584524, registered with the Commercial Registry of Madrid, sheet M-876098.
  • Address: Calle Ruiz 14, 2º Izq., 28004 Madrid, Spain.
  • Contact: legal@yolisto.app.
  • Activities relevant to the data transferred: operation of the Yolisto Platform and delivery to the Agency of enquiries about its listings.
  • Role: controller.
  • Signature and date: the Agency's electronic acceptance of the Terms, on the date recorded by the Platform.

Data importer

  • Name, address and contact: the name, city and country, email address and phone number shown in the Agency's account on the Platform, and the contact person for that account.
  • Activities relevant to the data transferred: responding to people who enquire about the properties it advertises.
  • Role: controller.
  • Signature and date: the Agency's electronic acceptance of the Terms, on the date recorded by the Platform.

B. Description of the transfer

  • Categories of data subjects: people who, through the Platform, ask for information about a property advertised by the Agency, contact it, or request Yolisto's assisted-purchase service for one of its properties.
  • Categories of personal data: name; contact details (email address or phone number); the message written by the data subject, if any; the property they are interested in.
  • Sensitive data: none. The Platform asks data subjects not to include any.
  • Frequency: continuous, each time a data subject sends an enquiry about one of the Agency's listings.
  • Nature of the processing: delivery of the enquiry to the Agency by email and in its dashboard on the Platform.
  • Purpose of the transfer and further processing: enabling the Agency to respond to the request for information or contact about the property.
  • Retention period: the Agency keeps the data for as long as needed to respond to the enquiry and handle any relationship arising from it, and afterwards only for the period required by the law applicable to it.
  • Onward transfers: the Agency may only disclose the data to third parties in the cases permitted by Clause 8.7. If it uses providers that process the data on its behalf (for example, email or customer-management providers), it does so with the safeguards of that clause.

C. Competent supervisory authority

Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Appendix II (Annex II to the Clauses): technical and organisational measures of the data importer

The Agency applies, as a minimum, the following measures to lead data:

  • Only the Agency's staff who handle the enquiry have access to it, under a duty of confidentiality.
  • Access to the Yolisto dashboard and to the mailbox where enquiries arrive uses personal credentials that are not shared, with two-step verification on the mailbox where its provider offers it.
  • The devices used for access have a screen lock and up-to-date operating systems and applications.
  • The data is not published, added to broadcast lists or groups, or used for unsolicited marketing messages.
  • The data is deleted when it is no longer needed for the purpose in section B.
  • The Agency has a designated person who responds to security incidents and knows how to notify Ciigma.