Last updated: September 2026
Liisto is committed to protecting personal data and respecting the privacy rights of our users. We process personal data in accordance with applicable data protection laws, including Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and, where applicable, Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
This page provides an overview of how Liisto approaches data protection and GDPR compliance. For detailed information about the personal data we collect and how we use it, please also review our Privacy Policy and Cookie Policy.
The entity responsible for determining the purposes and means of processing personal data through Liisto is the entity identified as the Data Controller in our Privacy Policy.
Contact:
For privacy or data protection enquiries, you may contact us using the details above.
When processing personal data, we apply the principles established by the GDPR.
Personal data should be:
Depending on the circumstances, Liisto may process personal data on one or more of the following legal bases:
The specific purposes and legal bases applicable to our processing activities are described in our Privacy Policy.
We aim to collect and process only personal data that is reasonably necessary for clearly defined purposes.
We do not use personal data for purposes that are incompatible with the purposes for which it was collected unless permitted by applicable law or an appropriate legal basis exists.
We take data protection considerations into account when designing, developing and operating Liisto.
Where appropriate, we implement technical and organisational measures intended to ensure that, by default, only personal data necessary for each specific purpose is processed.
We periodically review our systems, processes and data practices as the platform evolves.
Liisto uses appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful processing.
Our security measures are reviewed in light of the nature, scope, context and purposes of processing and the risks associated with the processing.
No online service can guarantee absolute security. We therefore continually evaluate appropriate measures for protecting the personal data processed through our services.
Liisto may use carefully selected third-party service providers to support the operation of the platform, including providers of infrastructure, hosting, communications, analytics, authentication, payment processing, artificial intelligence or other technical services.
Where a third party processes personal data on our behalf as a processor, we require appropriate contractual and data protection safeguards in accordance with applicable law.
Service providers are authorised to process personal data only for the relevant services and purposes and subject to applicable contractual and legal requirements.
More information about categories of recipients and service providers may be provided in our Privacy Policy.
Some service providers used to operate Liisto may process personal data outside Spain or the European Economic Area (EEA).
Where personal data is transferred outside the EEA, Liisto takes steps to ensure that the transfer is made in accordance with applicable GDPR requirements.
Depending on the recipient and destination, these safeguards may include:
Where required, additional safeguards may be assessed or implemented having regard to the circumstances of the transfer.
Subject to the conditions and limitations established by applicable law, individuals may have the following rights regarding their personal data:
These rights are not absolute and may be subject to conditions or exceptions under applicable law.
You may submit a privacy or data protection request by contacting:
hello@liistoapp.com
Please clearly describe the right you wish to exercise and provide sufficient information for us to identify the relevant account or personal data.
Where necessary, we may request additional information to verify your identity before fulfilling a request. Any information requested for identity verification will be used for that purpose.
We will respond to valid requests within the time limits required by applicable data protection law.
Liisto uses artificial intelligence and automated technologies in certain platform functionality, including functionality designed to help real estate professionals identify relevant relationships between property listings and client search requests.
Where personal data is involved, such processing is subject to applicable data protection requirements.
Liisto's matching functionality is designed to assist professional users by identifying potentially relevant matches. A match or recommendation does not itself constitute a legally binding property, financial or contractual decision.
Where GDPR rules concerning automated decision-making apply, we will provide the protections required by applicable law.
Personal data is retained only for as long as reasonably necessary for the purposes for which it was collected, including providing the Liisto service, maintaining appropriate business and security records, resolving disputes, enforcing agreements and complying with legal obligations.
Retention periods may vary depending on the category of data, the purpose of processing and applicable legal requirements.
Further information is available in our Privacy Policy.
Liisto maintains procedures for assessing and responding to suspected personal data breaches.
Where a personal data breach is subject to notification requirements under applicable data protection law, we will notify the competent supervisory authority and, where required, affected individuals within the applicable legal timeframes.
We take appropriate steps to document and review our data protection practices.
Depending on the nature of the processing and applicable legal requirements, these measures may include maintaining records of processing activities, reviewing data protection risks, implementing appropriate contractual safeguards, assessing data protection implications of new functionality and reviewing technical and organisational security measures.
If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.
For Liisto's activities in Spain, the relevant supervisory authority may be:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
Spain
You may also have the right to contact another competent supervisory authority, particularly in the EU/EEA country of your habitual residence, place of work or the place of the alleged infringement.
This GDPR & Data Protection page provides an overview of Liisto's approach to GDPR and data protection.
Our Privacy Policy provides more detailed information about our processing of personal data, including the categories of data collected, purposes of processing, legal bases, recipients, retention and other information required by applicable law.
If there is any inconsistency between this overview and the Privacy Policy regarding a particular processing activity, the more specific information provided in the Privacy Policy should be consulted.
We may update this page from time to time to reflect changes to Liisto, our data processing practices or applicable legal requirements.
The current version and its last-updated date will always be published on this page.
For questions regarding privacy, data protection or the exercise of your rights, contact: