Version 1.2 · Last updated: August 2026
1. Who is the data controller
The controller of the personal data collected through yolisto.app ("Yolisto" or "the Platform") is:
- Company name: CIIGMA TECHNOLOGIES S.L.
- Tax ID (NIF): B26584524
- Registration: Commercial Registry of Madrid, sheet M-876098
- Registered address: Paseo de Recoletos 5, 28004 Madrid, Spain
- Privacy contact: legal@yolisto.app
CIIGMA TECHNOLOGIES S.L. is a company established in Spain. The processing of your personal data is therefore governed by Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and by Spanish Organic Law 3/2018 on Personal Data Protection ("LOPDGDD").
2. Who this policy protects
This policy applies to everyone whose data we process, regardless of the country from which they use the Platform. The GDPR protects your data because the controller is established in the European Union, even if you are located in Venezuela or anywhere else.
We distinguish three groups:
- Visitors: people who browse the Platform without registering or submitting forms.
- Property enquirers (leads): people who contact an agency through a Platform form to ask about a property.
- Agencies and agents with an account: real estate professionals who register to publish listings and manage enquiries.
Yolisto is a listings portal. Properties are published by the advertising agencies and agents. Yolisto is not a real estate broker, is not a party to any transaction, and does not provide legal, financial, or real estate advice.
3. What data we collect
Visitors:
- Technical browsing data (IP address, device and browser type, pages visited) and web analytics data, as described in section 5 and in the [Cookie Policy].
- Queries typed into the AI search or the price estimator. These queries normally contain no personal data; please do not include personal information about yourself or others in them.
Property enquirers (leads):
- Name, contact details (email and/or phone), and the message you write when enquiring about a property.
Agencies and agents with an account:
- Contact person details (name, email, phone), agency details (name, professional information), and the content they publish on the Platform (listings, photos, descriptions).
We do not collect special categories of data (health, beliefs, etc.) and ask you not to include them in any form or message.
4. Why we use your data and on what legal basis
| Processing | Data | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| Agency account | Contact and agency details, published content | Sign-up, dashboard management, publishing listings, receiving leads | Art. 6(1)(b): performance of the contract (the Platform's Terms of Use) |
| User account (individual) | Email, name and the profile details you choose to provide voluntarily (buying goal, whether you live in Venezuela or abroad and in which country, indicative budget, timeframe and cities of interest) | Creating your account, saving favourites, managing your searches and personalising what you see; and, in aggregated and anonymised form, producing market statistics | Art. 6(1)(b) (performance of the contract) for the account and personalisation; art. 6(1)(f) (legitimate interest) for aggregated, anonymised statistics. All profile details are optional and you may leave them blank or change them at any time |
| Saved searches and alerts | The search criteria you save and your contact channel | Notifying you when new listings match your saved search | Art. 6(1)(b): provision of the service you activate; you can turn off any or all alerts at any time |
| Lead handling and delivery | Enquirer's name, contact details, and message | Delivering your enquiry to the advertising agency so it can respond | Art. 6(1)(b): pre-contractual steps taken at the data subject's own request |
| Assisted-purchase service request | Name, country of residence, buying timeframe, indicative budget range, preferred contact channel and its value, and the property of interest | Handling your request for the remote purchase-support service provided by Yolisto: assessing your case, contacting you through the channel you indicate and, where applicable, preparing a quote for the service | Art. 6(1)(b): pre-contractual steps taken at the data subject's own request, with a view to a possible service contract between you and Yolisto |
| Web analytics | Online identifiers, usage data | Measuring and improving the Platform | Consent (Art. 6(1)(a)) for non-exempt technologies; legitimate interest (Art. 6(1)(f)) for cookieless aggregate analytics |
| Our own marketing communications | Sending you Yolisto news, if you authorize it | Consent (Art. 6(1)(a)); for agency clients, Art. 21.2 of Spanish Law 34/2002 (LSSI) for similar services | |
| AI search and price estimator | Query text; if you are logged in, linkage to your account | Providing the requested feature | Art. 6(1)(b): provision of the requested service |
| Statistics, indexes and market studies | Aggregated and anonymised listing and usage data that cannot identify you | Producing price indexes, reports and real estate market information products | Anonymised information is not personal data (Recital 26 GDPR); the prior aggregation step relies on legitimate interest (Art. 6.1.f) |
| Handling enquiries and rights requests | Contact details and request content | Responding and keeping a record | Art. 6(1)(c): legal obligations; Art. 6(1)(f): legitimate interest in handling enquiries |
5. Who we share your data with
5.1 The advertising agency (the Platform's core flow)
When you submit a contact form about a property, your data (name, contact details, and message) is sent to the agency or agent that published that listing, so they can respond to your enquiry. This delivery is the very purpose of the form, and you are also informed of it in the form itself at the moment of submission.
From the moment it receives your data, the agency becomes a data controller in its own right for its own processing of that data. Our terms of service contractually require agencies to use your data solely to handle your enquiry. For any question about how the agency uses your data after delivery, you may contact the agency directly; you may also write to us at legal@yolisto.app and we will point you in the right direction.
If you request Yolisto's assisted-purchase service for a specific property, your name and contact details are also sent to the agency advertising that property as a notification of interest (so the agency can handle the sale for you), in addition to being processed by Yolisto to provide the support service. Delivery to the agency relies on the same safeguards described in section 6 for lead delivery.
5.2 Service providers (data processors)
We use providers that process data on our behalf under contracts compliant with Article 28 GDPR:
- Vercel Inc. (United States): Platform hosting.
- [Analytics provider to be confirmed]: Platform usage measurement.
- [AI provider to be confirmed]: processing of AI search and estimator queries.
- [Email provider to be confirmed]: transactional email delivery.
We do not sell your personal data or share it with third parties for those third parties' own advertising purposes.
5.3 Authorities
We may disclose data to competent authorities where a legal obligation so requires.
5.4 What we do not do with your data
Yolisto does not sell or rent your personal data to third parties, nor does it share it so that third parties can send you advertising. Any market information products that Yolisto creates or offers to third parties are built exclusively from aggregated and anonymised data that cannot identify any individual.
6. International transfers
- Hosting in the United States (Vercel): the transfer is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which Vercel is certified, and as a fallback by the standard contractual clauses (SCCs) included in its data processing agreement.
- Delivery of leads to agencies in Venezuela: Venezuela does not have an adequacy decision from the European Commission. The transfer of your contact details to the advertising agency is based on the standard contractual clauses (Decision (EU) 2021/914, controller-to-controller module) that each agency accepts when registering on the Platform and, where applicable, on Article 49(1)(b) GDPR, as a transfer necessary for pre-contractual measures taken at your own request when you ask that agency to contact you.
You may request more information about these safeguards by writing to legal@yolisto.app.
7. How long we keep your data
- Agency accounts: while the account is active. After closure, data is kept blocked for the limitation periods of potential legal liabilities (Art. 32 LOPDGDD).
- Leads: for the time needed to deliver the enquiry to the agency and thereafter for a maximum of [12/24 months, to be defined], unless a subsequent relationship or a legal retention obligation exists.
- Analytics: for the retention periods configured with the analytics provider, [period to be confirmed].
- User account, favourites and saved searches: while your account is active or until you delete them; alerts stop as soon as you turn them off.
- Assisted-purchase requests: while your request is being handled and, if you do not go on to contract the service, for a maximum of 12 months from the last contact; if you contract the service, for the duration of the relationship and the subsequent limitation periods.
- Marketing communications: until you withdraw consent or object.
- Enquiries and rights requests: for the applicable liability limitation periods.
8. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing, and portability, and withdraw your consent without affecting the lawfulness of prior processing.
To exercise them, write to legal@yolisto.app, stating the right you wish to exercise and information that allows us to identify you. We will respond within the timeframes set by the GDPR (as a general rule, one month from receipt of the request, under Art. 12.3 GDPR).
If you believe we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory authority given the controller's establishment in Spain: www.aepd.es.
Users in Venezuela: the rights above apply to you in full regardless of your country of residence. This policy is also compatible with the right of access, updating, rectification, and destruction of data recognized in Article 28 of the Constitution of the Bolivarian Republic of Venezuela (habeas data), which you retain under your national legal system.
9. Minors
The Platform is not directed at persons under 18. We do not knowingly collect data from minors. If we become aware that a minor has provided us with personal data, we will delete it.
10. Security
We apply technical and organizational measures appropriate to the risk of the processing (Art. 32 GDPR), including encrypted communications (HTTPS), access controls, and minimization of the data collected. No system is completely infallible; if a security breach occurs that poses a high risk to your rights, we will notify you in accordance with applicable law.
11. Cookies
The use of cookies and similar technologies is described in the [Cookie Policy], where you can manage your preferences.
12. Changes to this policy
We may update this policy to reflect changes in the Platform or in the law. The current version will always be published on this page, showing the date of the last update. If a change is substantial, we will flag it visibly on the Platform.
For any questions about this policy, write to legal@yolisto.app.