Privacy notice
This notice explains how we handle personal data on this website and in the accounts of the people who use Propia for their work: staff of property management companies and communities, and anyone who signs up.
If you are a resident or owner in a community that uses Propia, your community is responsible for your data and its own notice applies. Ask your administrator, or see Privacy in the resident portal.
Who we are
[Propia legal name], tax number [tax number], [registered address]. For anything about your data, write to [privacy email].
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| What you send through the contact form: your name, email, subject and message | To answer your enquiry | Steps you ask us to take; our legitimate interest in answering |
| Your account: name, email, phone, photo, language and display choices | To give you an account and show it to your colleagues | The contract with your employer or community; our legitimate interest in running your account |
| Your password (kept only as a hash), two-step sign-in keys, passkeys, recovery codes and trusted devices | To keep your account safe | The contract; our duty to keep data secure (GDPR Art. 32) |
| What you do in the service, when, and from which IP address | To keep a record of changes, investigate misuse and detect attacks | Our legitimate interest in security; the legal duty to keep data secure |
| Your sign-up details | To set up your trial once you confirm your email | Steps before a contract |
| Billing contacts and invoices for your company | To charge for the service | The contract; accounting law |
We do not sell your data, use it for advertising, or make decisions about you by automated means.
Who receives it
Only the providers that run the service for us, each under a data processing agreement:
- Microsoft (Azure): hosting, databases and files in Spain; error monitoring in the Netherlands; reading supplier invoices you upload, in the EU.
- Mailgun: sending emails. Twilio: text messages, and the WhatsApp alert we receive when you use the contact form (your name, email, subject and the start of your message). Both are US companies that transfer data under the EU–US Data Privacy Framework and standard contractual clauses.
- Stripe: card payments. Google Maps: showing a building on a map (its address, and your IP address when the map loads).
- If you turn on notifications on a device, your browser's maker (Google, Apple, Mozilla or Microsoft) delivers them.
We disclose data to authorities only when the law requires it.
Cookies
This site uses only the cookies it needs to work. There are no analytics, tracking or advertising cookies, so we do not ask for consent.
| Cookie | What it does | How long |
|---|---|---|
__Host-CMA.Auth | Keeps you signed in | Until you sign out, 12 hours at most |
__Host-CMA.Session | Holds your session while you are signed in | Until you sign out, 12 hours at most |
__Host-CMA.AF | Protects forms against forged requests | Until you close the browser |
.AspNetCore.Culture | Remembers your language | 1 year |
__Host-CMA.TwoFactorTrust | Remembers a device you trusted for two-step sign-in | 30 days |
CMA.DeskDevice | Identifies a gatehouse device that staff have paired | 1 year, or until the device is unpaired |
Your browser also keeps a few display choices on your device (light or dark mode, whether you have seen the cookie notice). They are never sent to us.
How long we keep it
- Contact form enquiries: until we have dealt with them, and at most [12 months].
- Your account: until one year after you lose your last role or last sign in, whichever is later; it is then anonymised.
- Activity records: 2 years (money and accounting actions 6 years, or 10 for Portuguese communities); IP addresses 1 year.
- Our invoices: 6 years.
Your rights
You can ask to see, correct, delete or take a copy of your data, to restrict or object to its use, and to withdraw any consent you gave. If you have an account, you can download a copy of your data yourself in My Profile and send us a request from there; otherwise write to [privacy email]. We answer within one month.
You can also complain to the Spanish Data Protection Agency (aepd.es), or to the authority where you live or work.
Changes
If we change this notice in a way that matters, we will tell you in the app first. Version 1, [date].