Privacy Policy

1.Data controller

ColiveWork is operated by Woodia Spain. For data protection matters, contact: privacy@colivework.co. As a data controller, we determine the purposes and means of processing your personal data.

2.Information we collect

• Account information: full name, email address, profile photo, bio, professional sector, work style preferences — collected when you register.
• Booking data: move-in/move-out dates, application messages, booking history.
• Payment data: billing address, transaction IDs. Card details are processed directly by Stripe and never stored on our servers. See stripe.com/privacy.
• Usage data: pages visited, search queries, filters applied, time spent on listings — collected via cookies and server logs.
• Communications: messages sent through the platform between residents and hosts.
• Device data: IP address, browser type, operating system, referring URL.

3.Legal basis for processing (GDPR)

• Contract performance: processing necessary to provide the ColiveWork service (account management, bookings, payments).
• Legitimate interests: fraud prevention, platform security, improving our service, sending relevant product updates.
• Consent: marketing emails and non-essential analytics cookies — you can withdraw consent at any time.
• Legal obligation: retaining transaction records as required by Spanish tax law.

4.How we use your information

• Create and manage your account.
• Match residents with suitable coliving spaces based on preferences.
• Process and manage booking requests.
• Send transactional emails (booking confirmations, approvals, payment receipts) via Resend.
• Improve search relevance and platform features.
• Detect and prevent fraud and abuse.
• Comply with legal obligations.

5.Data sharing and disclosure

• With hosts: when you submit a booking request, your name, bio, professional sector and message are shared with the host. No payment data is shared.
• With Stripe: payment processing. Stripe is a certified PCI DSS Level 1 provider.
• With service providers: hosting (Vercel/AWS), database (Supabase), email (Resend). All bound by data processing agreements.
• Legal requirements: we may disclose data if required by law, court order, or to protect the rights and safety of our users.

We never sell personal data to third parties. We never share data for advertising purposes.

6.International data transfers

Our infrastructure uses services based in the EU and USA. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

7.Data retention

• Account data: retained while your account is active. Deleted within 30 days of an account deletion request.
• Booking records: retained for 7 years to comply with Spanish tax and accounting obligations.
• Usage logs: retained for 90 days then anonymized.
• Marketing consent records: retained until consent is withdrawn plus 3 years.

8.Your rights under GDPR

You have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): request deletion of your data, subject to legal retention requirements.
• Portability: receive your data in a structured, machine-readable format.
• Restriction: request we limit how we process your data in certain circumstances.
• Object: object to processing based on legitimate interests.
• Withdraw consent: for any processing based on consent, at any time.

To exercise any of these rights, email privacy@colivework.co. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es.

9.Security

We implement industry-standard security measures including: TLS encryption in transit, encrypted storage, access controls, regular security reviews. No system is 100% secure — please use a strong password and notify us immediately of any suspected unauthorized access.

10.Children

ColiveWork is not intended for users under 18 years of age. We do not knowingly collect data from minors.

11.Changes to this policy

We will notify you of material changes via email or a prominent notice on the platform at least 14 days before the change takes effect.

12.Contact

Woodia Spain · privacy@colivework.co · colivework.co