PRIVACY POLICY OF LUPO ROOMS S.L.

When you register or book a room we collect your first and last name, email address, phone number, date of birth and nationality.

This data is essential to create your account, identify you as a legitimate user and contact you about your booking.

To comply with anti-fraud rules and identification obligations, we request a copy of your national ID, passport or equivalent document when a booking is confirmed.

This information is stored in encrypted form and can only be accessed by authorised personnel.

If you are a landlord we also collect the tax data required to issue invoices and to comply with the DAC7 Directive on reporting income earned through digital platforms.

If you are an Erasmus student we ask for the name of your home and host universities and your expected stay dates. This information helps us show you rooms that match your academic calendar.

Payments are processed through Stripe, a PCI-DSS Level 1 certified provider. Lupo Rooms never stores the full details of your payment card.

We only keep a transaction identifier, the last four digits of the card and its brand (Visa, Mastercard, etc.) for accounting reconciliation and fraud prevention purposes.

If you are a landlord we collect the photographs, descriptions and prices of the properties you publish on the platform. This content is shown publicly to interested students.

We store the messages exchanged between students and landlords within our in-platform messaging service in order to ensure a safe environment, resolve incidents and meet our legal obligations.

If you leave a review about a property or a landlord we store its content together with your name and profile picture. Reviews are public.

When you contact our customer support team we keep the content of the conversation, any screenshots or documents you share and the resolution of the case, in order to handle your request and improve our service.

When you visit luporooms.com we record your IP address, browser type, operating system, the pages visited, the searches performed and the duration of your session. This information helps us keep the platform secure and understand how it is used.

We use our own and third-party cookies to remember your preferences, analyse site usage and display relevant content. You can manage your preferences at any time through our Cookie Policy.

• To create and maintain your user account and to authenticate you on the platform.
• To process bookings and payments, and to facilitate communication between students and landlords.
• To issue invoices and comply with our accounting and tax obligations.
• To prevent fraud, money laundering and any misuse of the platform.
• To send you operational notifications about your booking (confirmations, reminders, changes).
• To handle your support requests and resolve incidents.
• To send you, with your consent, commercial communications about new properties, promotions or educational content.
• To improve the platform through anonymised statistical analyses and usage studies.

We will only send you commercial communications if you have given us your express consent when registering or if you are an existing customer and the communication relates to products or services similar to those you have already contracted.

You can withdraw your consent at any time, free of charge, through the unsubscribe link included in every email or by writing to info@luporooms.com.

We share your data only with the service providers we need in order to operate the platform. All of them act as data processors and have signed the confidentiality agreements required by the GDPR.

If you are a student, we share with the landlord the data strictly necessary to manage your booking and check-in (first and last name, email, phone, stay dates and identity document when required by law).

If you are a landlord, the data you publish about your property will be visible to any user of the platform.

We may also disclose your data to the competent authorities when a legal obligation requires it (for example, under the DAC7 Directive or in the context of judicial investigations).

We do not sell your data to third parties under any circumstances.

Some of our providers are located outside the European Economic Area. In such cases we safeguard your data through the Standard Contractual Clauses approved by the European Commission or through equivalent adequacy mechanisms.

We may use automated systems to detect fraudulent behaviour, verify identity documents or moderate inappropriate content.

These decisions can be reviewed by a human upon request, and you are entitled to express your point of view or to challenge them.

Our services are directed to people over 18 years of age. We do not knowingly collect data from minors. If we find out that we have received data from a minor without their legal guardian's consent, we will delete it immediately.

We process your personal data under one or more of the following legal bases, in accordance with Article 6 of the GDPR:

Most of the processing activities are necessary to manage your booking, process your payment and provide the service you have contracted with Lupo Rooms.

We retain certain data in order to comply with tax, accounting and anti-fraud regulations and with the DAC7 Directive on reporting income earned by landlords.

• Your express consent for the sending of commercial communications and for the use of non-essential cookies.
• Our legitimate interest in keeping the platform secure, preventing fraud and improving our services, always balanced against your fundamental rights.

• User account data: while your account is active and up to 12 months after its closure in order to resolve any potential disputes.
• Accounting and tax data: 6 years, as required by the Spanish Commercial Code.
• Information reported under DAC7: 10 years, as required by European regulations.
• Fraud-prevention records: up to 10 years from the last operation.
• Commercial communications: until you withdraw your consent.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction. They include:

• Encrypted HTTPS/TLS connections and encrypted storage of sensitive information.
• Role-based access control, activity logging and regular security reviews.

If a security breach were to occur that could affect your rights, we will notify you without undue delay and, at the latest, within the 72-hour window set out by the GDPR, explaining the measures taken and the recommended actions.

Your data may be processed by the following companies of the group, which operate under the same data-protection standards:

This list may be updated if the group grows. We will inform you proactively whenever new entities are added.

As described in Section 3, we share data with providers that help us deliver the service.

In every case we sign data-processing agreements that require those providers to handle your data solely for the purposes we specify.

The categories of recipients are:

• Payment and fraud-prevention providers (Stripe).
• Invoicing and accounting providers (Holded).
• Email and productivity providers (Google Workspace).
• Web hosting and security providers (Hostinger).
• Web analytics and campaign measurement providers.
• Landlords of the rooms booked, where necessary to process the booking.
• Competent public authorities whenever a legal obligation requires it.
• Legal and tax advisors bound by professional secrecy.

If you interact with our social media profiles (Instagram, Facebook, TikTok, LinkedIn) these platforms may process your data according to their own privacy policies, over which Lupo Rooms has no control.

We use technical cookies (essential for the website to work), preference cookies, analytics cookies and, with your consent, marketing cookies.

You will find the full details, retention periods and providers in our Cookie Policy, where you can also configure your preferences at any time.

The GDPR and the LOPDGDD grant you a number of rights over your personal data which you can exercise free of charge at any time.

To exercise them simply email us at info@luporooms.com from the address linked to your account, or write to us by post to our registered office, enclosing a copy of your identity document.

We will reply within one month, extendable to two months in particularly complex cases, and always free of charge unless the requests are manifestly unfounded or excessive.

The rights you can exercise are the following:

If you believe that we have not addressed your rights properly, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the competent supervisory authority of your country of residence.

We may update this Privacy Policy to reflect legal, technical or service changes. The current version will always be published on this page with the latest update date, and we will notify you by email when the changes are substantial.