Privacy Policy for Abitamo

Last Updated: January 22, 2026

1. Introduction

Abitamo ("we," "our," or "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy describes how we collect, use, and disclose your personal data when you use our services, in compliance with the European Union's General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

Data Controller:
Abitamo<br>Madrid, Spain

2. Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email	Website
Email	support@abitamo.com
Website	By visiting a page on our website

3. Personal Data We Collect

We collect personal data that you voluntarily provide to us when you register for an account, use our services, or make a purchase.

Category of Data	Specific Data Collected	Purpose of Collection	Legal Basis (GDPR)
Identity Data	First name and last name	Account registration, service personalization, and communication.	Performance of a contract with you.
Contact Data	Email address, Phone number, Address, State, Province, ZIP/Postal code, City	Service delivery, billing, and essential communication.	Performance of a contract with you.
Transaction Data	Payment details (processed by third-party payment processors)	Processing payments for products and services.	Performance of a contract with you.
Usage Data	Information about how you use our website and services.	Service improvement, security, and analytics.	Legitimate interests (improving our services).
Technical Data	IP address, browser type, operating system, and device information.	Security, troubleshooting, and analytics.	Legitimate interests (security and service maintenance).

Note on Payment Data: We do not directly store your full payment card details. All payment transactions are processed by secure, third-party payment processors who specialize in the secure handling of payment data.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we must have a legal basis to process your personal data. We rely on the following legal bases:

Performance of a Contract: We process your Identity, Contact, and Transaction Data when it is necessary to fulfill our contractual obligations to you, such as providing the services you have requested and processing your payments.
Legitimate Interests: We process your Usage and Technical Data where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Our legitimate interests include improving our website and services, ensuring network security, and preventing fraud.
Consent: We rely on your consent to send you marketing emails. You have the right to withdraw your consent at any time by clicking the "unsubscribe" link in the email or by contacting us.

5. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

To Provide and Manage Services: To register you as a user, manage your account, and provide you with the products and services you have purchased.
To Process Payments: To process your transactions and manage billing and financial operations.
To Communicate with You: To send you service-related announcements, technical notices, updates, security alerts, and administrative messages.
Marketing Communications: If you have opted-in, to send you emails about new products, services, and offers.
Analytics and Improvement: To monitor and analyze usage and trends to improve our website and services.

6. Tracking and Analytics Tools

We use third-party analytics tools, such as Google Analytics, to help us measure traffic and usage trends for our services. These tools collect information sent by your device or our service, including the web pages you visit, add-ons, and other information that assists us in improving the service. This information is collected and used in an aggregated form so that it cannot reasonably be manipulated to identify any particular individual user.

7. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

Service Providers: Third-party vendors, consultants, and other service providers who perform services for us or on our behalf, such as payment processing, data analysis, email delivery, hosting services, and customer service.
Legal Compliance: We may disclose your data where we are legally required to do so to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process.
Business Transfers: In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.

8. International Data Transfers

As we are based in Spain (EU), the personal data we collect is primarily processed within the European Economic Area (EEA). However, some of our third-party service providers, such as Google Analytics, may be located outside the EEA (e.g., in the United States).

When we transfer your personal data outside the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe (Standard Contractual Clauses).

9. Your Data Protection Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

The Right to Access: You have the right to request copies of your personal data.
The Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
The Right to Erasure ("Right to be Forgotten"): You have the right to request that we erase your personal data, under certain conditions.
The Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
The Right to Object to Processing: You have the right to object to our processing of your personal data, under certain conditions (e.g., for direct marketing).
The Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
The Right to Withdraw Consent: Where we rely on consent to process your personal data, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us using the details provided in Section 2. We will respond to your request within one month.

10. Children's Privacy

Our services are not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13 without verification of parental consent, we will take steps to remove that information from our servers.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or where an alleged infringement of the GDPR has taken place. As Abitamo is located in Spain, the relevant supervisory authority is the Agencia Española de Protección de Datos (AEPD).

AEPD Contact Information:
Website: https://www.aepd.es/
Address: C/ Jorge Juan, 6. 28001 – Madrid.