01Who the controller is
Ofimática Digital Soluciones, S.L.U. (SyncroRent), tax ID (NIF) B75604488, Avenida de la Libertad, 19, 03610 Petrer (Alicante), Spain.
For anything about your data, write to us at hola@syncrorent.app. We reply within one month at most. We have not appointed a data protection officer; if we do, their details will appear here.
There is one case in which we are not the controller: when a letting agency forwards us the email in which you asked about one of its properties. There the agency is the controller and we process your data on its behalf (explained in section 4).
02What data we process
If you create your GoldPass:
- Identification and contact details: email, name, mobile number (verified by SMS).
- Identity: the result of the verification of your document and of the liveness check, the name on the document, its number (encrypted) and its expiry date. The image of your document and your selfie are captured by the verification provider (section 6); we do not store them.
- Financial and employment situation: payslips, Social Security employment record (vida laboral), contribution bases, income tax returns and self-employed tax forms, employment contract, bank statements and any other document you provide, plus the data we read from them (employer, amounts, periods).
- The result of the check against the ASNEF and Equifax bad-debt files.
- Questionnaire answers: what you are looking for, your employment situation, who you will live with, whether you have children (only how many, never their details), pets, whether you smoke and anything you want to tell us.
- Presentation photos and video, if you decide to record them.
- Your score, the result of the assessment and the recommended maximum rent.
- Payment: amount, date and status. Card details are handled by Stripe; we never see them.
- Records: which texts you accepted, when, from which IP address and with which browser.
If you add other people (co-tenant, housemate or guarantor): their name, email, mobile number, relationship to you and, once they join with their own link, the same as for you. Each of them authorises the check of their own bad-debt files and the processing of their own documents: you cannot do it for them. Let them know before adding them: they will receive an email from us.
If you are a letting agency or a landlord: name or company name, tax ID, contact email and phone number, who signs the data processing agreement (with IP address and browser) and the properties you manage.
If you ask us for access to an applicant’s documents: your name, email, phone number and the message you leave us.
If you only visit the website: nothing that identifies you. We do not use analytics or advertising cookies (see the cookie policy).
03What we use it for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account, and letting you log in with a code sent by email | Performance of the contract (art. 6.1.b GDPR) |
| Verifying your mobile number by SMS | Performance of the contract (art. 6.1.b) |
| Verifying your identity with a document and a liveness check | Your explicit consent, given when you start the verification (arts. 6.1.a and 9.2.a). Without it we cannot issue the GoldPass, but you can withdraw it whenever you like. |
| Reading and checking your documents, cross-checking them with each other and with their secure verification code, and issuing the GoldPass | Performance of the contract (art. 6.1.b) and your consent to the processing of your solvency documents (art. 6.1.a), which you can withdraw from your dashboard |
| Checking ASNEF and Equifax | Your express authorisation before paying, and that of each added person when they join with their link (art. 6.1.a GDPR and art. 20 of the Spanish Data Protection Act, LOPDGDD) |
| Calculating your score and the result (see section 5) | Performance of the contract (art. 6.1.b) |
| Showing your GoldPass to the landlords and agencies you choose | Your consent, given each time you share it (art. 6.1.a), which you can withdraw |
| Charging for the service and issuing the invoice | Performance of the contract and tax and accounting obligations (arts. 6.1.b and 6.1.c) |
| Notifying you by email or WhatsApp about your GoldPass: that it is ready, that it is about to expire, that a sign-up step is missing | Performance of the contract and our legitimate interest in you finishing what you started (arts. 6.1.b and 6.1.f). Every WhatsApp message explains how to opt out: reply BAJA (or STOP). |
| Measuring at which sign-up step people drop off, to improve it | Legitimate interest (art. 6.1.f). With our own data, without cookies or third-party tools |
| Keeping records of what you accepted and of payments | Legal obligation and defence against claims (arts. 6.1.c and 6.1.f) |
| Security: preventing fraud, impersonation and unauthorised access | Legitimate interest (art. 6.1.f) |
| Giving letting agencies their applicant dashboard | Performance of the contract with the agency (art. 6.1.b) |
We do not use your data for advertising, we do not sell it and we do not build profiles for anything other than your GoldPass.
04If a letting agency forwards us your enquiry
Many letting agencies work with SyncroRent: when you ask about a property on a portal, they forward us that email so we can invite you to prepare your GoldPass. In that case:
- The controller of your data is the agency; we are its processor (art. 28 GDPR), under a contract it signs when it joins (data processing agreement).
- We read the email (with the help of artificial intelligence, section 6) to extract your name, your email or your mobile number and the property you asked about.
- If the agency requests it, we send you a WhatsApp invitation on its behalf. You can reply BAJA (or STOP) and you will not receive anything else.
- If you do not sign up, we delete your data after 90 days. Only the property reference is kept, which does not identify you.
- If you sign up, from then on you are our user and the rest of this policy applies.
05Automated decisions
Part of the assessment is done by software, without a person being involved. We tell you because it has effects for you (art. 22 GDPR):
- Score from 0 to 100. It combines solvency (40%), employment stability (30%), history (20%) and identity (10%), based on your documents and answers. Without a presentation video, the maximum score is 65.
- Initial assessment. Before asking for documents we tell you whether you can get a GoldPass. If the provisional score does not reach the minimum, you do not move on to the second stage, although you can try again when your situation changes.
- Recommended maximum rent. 35% of your net monthly income, the usual affordability threshold for renting. With it, the landlord sees whether you can comfortably afford, only just afford or not afford their property.
- A record in ASNEF or Equifax. If you appear with a registered debt we cannot certify your solvency and the GoldPass is not issued.
- Publication. If everything checks out, the GoldPass is published without manual review. If something does not add up, a member of the team reviews it first.
You have the right to have a person review it, to explain your point of view and to challenge the result. Write to us at hola@syncrorent.app saying what you want us to review and we will reply with the explanation and, where appropriate, the corrected result.
06Who else sees your data
The landlords and letting agencies you choose. They see the result of your GoldPass (verified identity, solvency, score and what you have told us about yourself), not your documents. They only see your documents if you also grant them access, and you can withdraw it whenever you like.
Our providers, who process the data only to provide their service to us, under a data processing contract (art. 28 GDPR):
| Provider | Purpose | Where |
|---|---|---|
| Supabase | Database, encrypted files and login with a code | Ireland (EU) |
| Vercel | Website hosting and scheduled tasks | USA (see section 7) |
| IONOS | Sending emails | EU |
| Brevo | SMS for mobile number verification | France (EU) |
| Didit | Identity document verification and liveness check | Spain (EU) |
| Google (Gemini) | Automated reading of your documents and of the emails forwarded by agencies | USA (see section 7) |
| Stripe | Card payments | Ireland (EU) and USA |
| Meta (WhatsApp Business) | Sending WhatsApp messages | Ireland (EU) and USA |
| Railway | Reading the mailbox to which agencies forward emails | EU or USA (see section 7) |
ASNEF and Equifax receive your name and document number to answer the bad-debt check you authorise.
Rent default insurance. If, when closing a tenancy, the landlord takes out rent default insurance, we will ask for your authorisation before passing your data to the insurer.
Authorities. Courts, the Tax Agency or law enforcement, only when the law requires us to.
07Transfers outside the EU
Some providers (Vercel, Google, Stripe, Meta and Railway) are US companies or may process data in the USA. They do so with the safeguards required by the GDPR: the EU-US Data Privacy Framework, to which they are certified, or the standard contractual clauses approved by the European Commission (arts. 45 and 46 GDPR). You can ask us for a copy of those safeguards at hola@syncrorent.app.
08How long we keep it
| What | How long |
|---|---|
| Your documents (payslips, employment record…) | 12 months from when your GoldPass is issued. If it is never issued, 12 months from the last document you uploaded. After that they are deleted automatically. |
| Your account, your answers and your GoldPass | For as long as you keep the account. The GoldPass stops being visible after 30 days unless you renew it. |
| Data of people who reach us through an agency and do not sign up | 90 days |
| Records of what you accepted (consents, waiver of the right of withdrawal) | 5 years from when you delete your account, blocked |
| Payments | 6 years, blocked (accounting obligation) |
| WhatsApp opt-outs | Indefinitely, and only as an irreversible code derived from your number: it is what stops us writing to you again |
Blocked means that nobody can consult them except to defend ourselves against a claim or to comply with a court or public authority (art. 32 LOPDGDD). Once the period ends, they are deleted.
09Your rights
At any time and free of charge, you can:
- Access your data and find out what we do with it.
- Rectify anything that is wrong. You can change your mobile number yourself from Settings.
- Erase it. You can delete your account yourself from Settings: your documents, your GoldPass and your data are deleted, except the records the law requires us to keep (section 8).
- Withdraw your consent, for example to us viewing your documents or to an agency viewing your GoldPass. You do it from your dashboard. It does not affect what was done before you withdrew it.
- Object to processing based on legitimate interest, such as reminders.
- Restrict processing while we resolve a complaint of yours.
- Take your data with you (portability) in a structured format.
- Ask for a person to review an automated decision (section 5).
For anything you cannot do from your dashboard, write to us at hola@syncrorent.app from your account’s email address. If you disagree with our answer, you can complain to the Spanish Data Protection Agency: www.aepd.es.
10How we protect it
- Your documents are encrypted (AES-256) before being stored, with a key that is not kept in the database.
- Everything travels encrypted between your browser and us.
- Each user can only see their own data, and the team only accesses what it needs to review a file; every access is logged.
- We never ask for your Cl@ve or bank credentials or your digital certificate: you download the official reports yourself.
- If there were a security breach affecting you, we would tell you and notify the AEPD within 72 hours at most.
11Minors
The GoldPass is for people aged 18 and over. If you tell us you will live with your children, we only store how many there are, never any data about them.
12Changes to this policy
If we change anything important we will let you know by email before it applies. The date at the top shows when it was last updated.