Privacy Policy
This policy explains what personal data MiMove collects when you use https://mimove.com ("the Website"), why we collect it, who we pass it to, how long we keep it and what rights you have over it. It applies to visitors, registered users, people who send an enquiry about a property, and professionals who contact us about advertising or our services.
It should be read together with our Terms & Conditions.
1. Who we are and how to contact us
Mimove Franchise, S.L. ("MiMove", "we", "us", "our") is the controller of the personal data described in this policy. We are a company incorporated in Spain, with tax identification number CIF B87532180 and VAT number ESB87532180, and registered office at Calle Evaristo San Miguel 22, 28008 Madrid, Spain. We operate the Website and decide why and how the personal data described here is used.
We are wholly owned by Mimove International AB, registration number 559479-7317, VAT number SE559479731701, the ultimate parent of the MiMove group, at Randersgatan 2, SE-254 40 Helsingborg, Sweden. Personal data may be shared within the group for administration, support and reporting.
For any question about this policy, or to exercise any of the rights in section 10, write to [email protected].
MiMove is a property portal: an advertising platform on which estate agencies, developers and other property professionals ("agencies") publish listings, and on which you can search them and contact the agency directly. That model shapes this policy — the most important thing it has to tell you is in section 5.
2. The short version
- You can search and browse the whole Website without telling us who you are.
- When you send an enquiry about a property, we pass your name, email address, telephone number and message to the agency that advertises it, so that they can contact you. That agency then handles your data under its own privacy policy.
- Sending an enquiry also creates a MiMove account for you, using the details you entered, and signs you in.
- We use cookies and similar technologies for security, measurement and advertising. The ones that are not strictly necessary are set only if you accept them in our cookie banner, and you can change your mind at any time.
- We keep the record of an enquiry for as long as we run the service, unless you ask us to erase it.
- We never sell your personal data.
- You can ask us for a copy of your data, or ask us to delete it, at [email protected].
3. The personal data we collect
3.1 Data you give us
- Property enquiries. Your name, email address, telephone number and the message you write, together with the listing and agency the enquiry relates to, and the language of the page you were on. The "Send email", "WhatsApp" and "Phone" buttons on a listing each create an enquiry in the same way as the form.
- Qualifying answers. After an enquiry we may ask optional follow-up questions: your minimum and maximum budget, the minimum number of bedrooms you need, when you plan to move, when you would like to view, how and on which days and at what times you prefer to be contacted, and any additional comment. Answering is optional.
- Account details. Your name, email address, telephone number, username, a securely hashed password, your profile picture if you upload one, and your display preferences.
- Saved searches, alerts and saved listings, including the search criteria themselves (location, price range, property type and so on) and how often you want to be alerted.
- Professional and service enquiries. If you contact us as an agency or property professional — to advertise with us, to sign up as an agency, to request photography or video services, or to book an appointment — we collect your name, email address, telephone number, the name and address of your business, details of what you need and, where relevant, the address of the property concerned, plus the campaign or page the enquiry came from.
- Correspondence. The content of emails, messages and other correspondence you send us, including customer-service and complaint history.
3.2 Data we collect automatically
- Technical data. Your IP address and browser user-agent string, which we record together with every enquiry and in our server and application logs, to detect and investigate spam, fraud and abuse and to keep the Website secure.
- Usage data. The pages and listings you view, the searches you run, the filters you apply, the links and buttons you use, referring URLs, and the date and time of your visit.
- Recent searches. The last searches you ran are stored in your browser and in your session so that we can offer them back to you, and are attached to your account if you have one.
- Approximate location. Derived from the area you search in and, coarsely, from your IP address. We do not collect precise device location unless your browser asks you and you allow it.
- Cookies and similar technologies. See section 8.
We do not ask for and do not want special categories of data (health, political opinions, religious beliefs, and so on). Please do not include such information in the free-text message of an enquiry.
4. Why we use your data, and our legal basis
Under the GDPR we must have a legal basis for each use of your personal data. Ours are set out below.
| What we do | Data used | Legal basis |
|---|---|---|
| Pass your enquiry to the agency advertising the property, and to any further agencies you choose, and send you a confirmation of it | Name, email, phone, message, qualifying answers, listing and agency | Taking steps at your request before entering into a contract, and performing the service you asked for (Art. 6(1)(b)) |
| Create and run your account, keep the history of your enquiries, and let you manage saved searches, alerts and saved listings | Account details, saved searches, enquiry history | Performance of a contract (Art. 6(1)(b)); our legitimate interest in giving enquirers a way to manage and follow up their enquiries (Art. 6(1)(f)) |
| Send you the property alerts and saved-search emails you have asked for | Email address, saved search criteria | Performance of a contract (Art. 6(1)(b)); consent where required (Art. 6(1)(a)) |
| Operate, secure and troubleshoot the Website: prevent spam and fraudulent or duplicate enquiries, apply CAPTCHA checks and rate limits, block abuse, keep logs and backups | IP address, user agent, logs, enquiry metadata | Our legitimate interest in protecting the Website, our users and the agencies from abuse (Art. 6(1)(f)) |
| Measure how the Website is used and improve it, including which listings and searches are popular and how our advertising performs | Usage data, cookie and device identifiers | Consent, given through our cookie banner (Art. 6(1)(a)); our legitimate interest in improving the service where no cookie or similar technology is involved (Art. 6(1)(f)) |
| Show advertising, including personalised advertising, and measure advertising campaigns | Cookie and device identifiers, usage data | Consent, given through our cookie banner (Art. 6(1)(a)) |
| Respond to professional enquiries about advertising, agency sign-up, photography services and appointments, and manage our relationship with agencies | Professional enquiry data, correspondence | Taking steps at your request before entering into a contract and performing it (Art. 6(1)(b)); our legitimate interest in running our business (Art. 6(1)(f)) |
| Send you marketing about MiMove's own services | Name, email address | Consent, or our legitimate interest in marketing to existing business contacts where the law allows it (Art. 6(1)(a) or (f)) — you can opt out at any time |
| Comply with our legal obligations, keep accounting records, and establish, exercise or defend legal claims | Whatever is relevant to the obligation or claim | Legal obligation (Art. 6(1)(c)); our legitimate interest in defending our rights (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can object to that processing at any time — see section 10.
5. Sharing your enquiry with estate agencies
This is the most important thing to understand about MiMove. We are an advertising platform, not an estate agent. The purpose of an enquiry is to put you in touch with the agency that advertises the property, so when you send one we disclose your details to that agency.
In detail:
- What is sent. The agency receives your name, email address and telephone number, the message you wrote, the listing you enquired about, and any qualifying answers you gave (budget, bedrooms, moving and viewing timing, preferred contact method, days and times, and your comment).
- When it is sent. When you submit the enquiry form, and also when you use the "WhatsApp" or "Phone" buttons on a listing — those buttons create an enquiry as well as opening the call or chat, so that the agency knows who is contacting them.
- Enquiring about several properties at once. After an enquiry we may show you similar properties from other agencies and offer to send the same enquiry to them. Nothing is sent to any additional agency unless you choose it. If you do, each of those agencies receives the same details, and each of them may contact you.
- What the agency may do with it. Once an agency receives your enquiry it becomes an independent controller of that data. It decides how to respond, how long to keep your details and whether to contact you about other properties, and it is responsible for doing so lawfully under its own privacy policy. We are not responsible for what an agency does with your data after it receives it, and we cannot delete it from their systems for you — if you want them to stop contacting you or to erase your details, you need to ask them directly. We will help you identify the right contact if you ask us.
- What we do not do. We do not sell your personal data, and we do not pass your enquiry to agencies whose property you have not enquired about and have not selected.
6. Who else we share data with
Apart from the agencies described above, we share personal data with the following categories of recipient. Those acting as our processors act only on our instructions and under a written contract.
| Recipient | What for | Data involved |
|---|---|---|
| CloudAbove Ltd (hosting) | Running the dedicated server, database and backups on which the Website operates, from a data centre in the United Kingdom | All data stored by the Website |
| Cloudflare, Inc. | Delivering and protecting the Website: every request passes through Cloudflare's network, which terminates the encrypted connection, caches static content, filters malicious traffic and denial-of-service attacks, and obscures the email addresses shown on our pages from automated harvesting | Your IP address, the request and its headers, and the page content in transit |
| Postmark (Active Campaign, LLC) | Delivering transactional email: enquiry confirmations, notifications to agencies, alerts and account emails | Name, email address, and the content of the message |
| Google (Google Ireland Ltd / Google LLC) | Google Tag Manager, Google Ads and Google AdSense for measurement and advertising; reCAPTCHA to stop automated abuse of our forms; Maps and Places for map display and address autocomplete | Cookie and device identifiers, IP address, usage data, and — for reCAPTCHA — interaction data from the form page |
| Mapbox, Inc. | Displaying maps and converting place names into map positions when you search | IP address, the search terms and map area you request |
| GTranslate | Translating the Website into the language you select | The page content requested, IP address, language preference |
| Usercentrics A/S (Cookiebot) | Presenting the cookie consent banner and recording the consent choices you make | IP address (anonymised), consent state and the date and version of your choice |
| Our IT and development suppliers | Building and maintaining the Website, its database and its integrations, under confidentiality obligations | Access to the systems in which personal data is stored, on a need-to-know basis |
| Professional advisers, insurers, auditors and authorities | Where we are required to disclose data by law, or need to establish, exercise or defend legal claims | Whatever is relevant |
| A buyer or successor | If we sell or reorganise our business, data may transfer with it; you will be told if that happens | Whatever is relevant |
7. International transfers
We are established in the European Economic Area, but two categories of transfer outside it apply to your data:
- The United Kingdom. The Website runs on a dedicated server operated by our hosting provider, CloudAbove Ltd, in the United Kingdom. The data the Website stores — including accounts and enquiry records — is therefore held in the UK. The European Commission has decided that the United Kingdom provides an adequate level of protection for personal data, so no additional safeguard is required for this transfer.
- The United States. Some of the suppliers listed in section 6, including Google, Postmark, Mapbox and Cloudflare, are established in or transfer data to the United States. Cloudflare sits in front of the Website, so every request you make reaches its network before it reaches our server, although it is routed through the location nearest to you.
For transfers to the United States and to any other country without an adequacy decision, we rely on the supplier's certification under the EU–US Data Privacy Framework where it has one, and otherwise on the European Commission's Standard Contractual Clauses together with additional technical and organisational safeguards. You can ask us for a copy of the safeguards in place by writing to [email protected].
8. Cookies and similar technologies
Cookies are small files stored on your device. We also use your browser's local storage, which works in a similar way. We use them for four purposes: to make the Website work (strictly necessary), to remember your choices (preferences), to understand how the Website is used (statistics), and to select and measure advertising (marketing).
Your choice
We use a consent management platform, Cookiebot by Usercentrics, which shows you a banner the first time you visit and records what you agree to. Strictly necessary cookies are set automatically, because the Website cannot work without them. Everything in the statistics and marketing categories is set only if you consent to it, and you can change or withdraw that consent at any time:
Withdrawing consent does not affect anything done while it was in force. Your choice is stored for up to 12 months, after which we ask again.
Our banner operates under the IAB Europe Transparency & Consent Framework (TCF v2.2), which is why it lists advertising vendors individually and lets you accept or reject them one by one, and under Google Consent Mode, which means Google's tags adjust or withhold what they collect according to your choice.
| Name | Set by | Purpose | Type / duration |
|---|---|---|---|
CookieConsent |
Cookiebot (Usercentrics) | Stores which cookie categories and vendors you accepted or rejected, so we can honour your choice and evidence it | Strictly necessary · 12 months |
PHPSESSID |
MiMove | Keeps your session — the searches you have run and the state of forms you are filling in | Strictly necessary · 7 days |
wordpress_logged_in_* |
MiMove | Keeps you signed in and identifies you to the Website. Cryptographically signed, so it cannot be forged | Strictly necessary · 14 days (2 days if you do not stay signed in) |
wordpress_sec_* |
MiMove | Authenticates administrative sessions in the site's back office | Strictly necessary · 14 days |
googtrans |
GTranslate | Remembers the language you chose for the Website | Functional · session or up to 1 year |
gt_autoswitch (local storage) |
GTranslate | Records that we have already offered to switch to your browser's language, so we do not ask again | Functional · until you clear your browser storage |
mm_recent_searches (local storage) |
MiMove | Stores your recent searches so we can offer them back to you on the home page | Functional · until you clear your browser storage |
_GRECAPTCHA |
Distinguishes people from automated software on our enquiry forms | Strictly necessary (anti-abuse) · up to 6 months | |
__cf_bm, cf_clearance |
Cloudflare | Tell automated traffic apart from real visitors and remember that a security check has been passed. Set only when Cloudflare's bot protection is engaged for your request, so you may never receive them | Strictly necessary (security) · 30 minutes to 1 year |
_ga, _gid, _gcl_au and related Google identifiers |
Google Tag Manager, Google Ads | Measure visits, understand how the Website is used, and attribute and measure our advertising campaigns | Analytics / advertising · up to 2 years |
Google AdSense identifiers (IDE, DSID and others) |
Select, deliver, cap and measure the adverts displayed on the Website, including personalised adverts | Advertising · up to 2 years |
Third-party services embedded in our pages — Google Maps and Places, Mapbox, YouTube video players and social media links — may set their own cookies when those parts of a page load. Their use of the data they collect is governed by their own privacy policies. The full, automatically maintained list of the cookies found on this Website, and of the advertising vendors covered by the framework above, is shown in the consent banner itself.
Other ways to control cookies
- Every major browser lets you block or delete cookies and clear local storage, usually under "Privacy" or "Site settings". Blocking strictly necessary cookies will stop you from signing in and may break parts of the Website.
- You can turn off personalised Google advertising at myadcenter.google.com and manage ad personalisation across participating companies at youronlinechoices.eu.
- You can prevent Google Analytics measurement with Google's browser add-on at tools.google.com/dlpage/gaoptout.
9. How long we keep your data
We keep personal data for as long as we need it for the purposes set out in section 4. How long that is depends on the data: the criteria we apply are how long the relationship or enquiry remains live, how long we could face a dispute, claim or complaint about it, and any period the law requires us to keep records for.
We do not operate a fixed deletion schedule for enquiry records, and you should assume that an enquiry you send is kept for as long as we run the service. You can ask us to erase your data at any time, and we will do so unless we are required or entitled to keep it — see section 10.
| Data | How long |
|---|---|
| Property enquiries and the qualifying answers attached to them | Retained for the life of the service. The record of an enquiry is our evidence of what was sent, to which agency and when; we rely on it to answer disputes and complaints, to recognise duplicate and fraudulent enquiries, and to measure and improve how the platform works. It is deleted if you ask us to erase it |
| Your account, saved searches, alerts and saved listings | For as long as your account exists. You can ask us to close and delete it at any time, and we will |
| Professional enquiries (advertising, agency sign-up, photography, appointments) | For the duration of our commercial relationship with you or your business, and afterwards while a claim arising from it remains possible |
| Marketing contact data and consent records | Until you unsubscribe or object; we then keep the minimum record needed to show that you opted out and to make sure we do not contact you again |
| Server, security and application logs (including IP addresses) | Until they are rotated out of our logging and monitoring systems |
| Backups | Data you have asked us to delete persists in backups until those backups are overwritten in the ordinary course |
| Accounting and tax records, and records needed for legal claims | For the period required by law — six years for accounting records under the Spanish Commercial Code — or until the relevant claim is time-barred |
Remember that an agency which has received your enquiry keeps its own copy under its own retention policy, which we do not control.
10. Your rights
Under the GDPR you have the right to:
- Access — obtain confirmation of whether we process your data and receive a copy of it;
- Rectification — have inaccurate or incomplete data corrected;
- Erasure — have your data deleted where we no longer have a good reason to keep it;
- Restriction — have us pause our use of your data while a dispute about it is resolved;
- Portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller;
- Object — object at any time to processing based on our legitimate interests, and, absolutely, to processing for direct marketing;
- Withdraw consent — where we rely on consent, withdraw it at any time, without affecting processing carried out before you withdrew it.
To exercise any of these rights, email [email protected]. We will respond within one month; if your request is complex we may extend that by two further months and will tell you if so. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity before we act, to make sure we do not disclose your data to someone else.
If you are signed in, you can also correct much of your data yourself in your account.
11. Marketing and how to opt out
We send three kinds of email: transactional email you cannot opt out of while you are using the service (confirmation of an enquiry, account and security messages); alerts for the saved searches you set up, which you can turn off in your account or with the link in each alert; and marketing email about MiMove's services, which we send only where we are allowed to and which you can stop with the unsubscribe link in every message or by writing to [email protected].
Opting out of our marketing does not stop an agency you enquired with from contacting you — you need to tell that agency directly.
12. How we protect your data
We take appropriate technical and organisational measures to protect personal data, including encrypted (HTTPS) connections for the Website, an encrypted connection to our database, passwords stored only as salted hashes and never in readable form, cryptographically signed session cookies, restricted and logged administrative access, CAPTCHA and rate limiting on our forms, a security layer in front of the Website that filters malicious traffic and denial-of-service attacks, and limits on which staff can access personal data. No system can be guaranteed completely secure; if a breach occurs that is likely to result in a high risk to your rights, we will notify you and the competent supervisory authority as the law requires.
13. Children
The Website is intended for people aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has given us their data, contact [email protected] and we will delete it.
14. Automated decisions and profiling
We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.
We do use automated processing to make the service useful: to rank and order search results, to suggest similar properties, to decide which properties go into your alerts, and — where you have consented to advertising cookies — to select the adverts you see. You can object to this profiling, and stop the advertising element, as described in sections 8 and 10.
15. Changes to this policy
We may update this policy to reflect changes in what we do or in the law. The date at the top of the page shows when it was last revised. Where a change materially affects you, we will take reasonable steps to bring it to your attention.
16. Questions and complaints
If you have a question or a complaint about how we handle your personal data, please contact us first at [email protected] — we would like the chance to put things right.
You also have the right to lodge a complaint with a data protection supervisory authority. As we are established in Spain, that is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid — aepd.es. You may also complain to the supervisory authority of the EU country where you live or work, or where you believe the problem occurred.
Mimove Franchise, S.L. — CIF B87532180 · VAT ESB87532180
Calle Evaristo San Miguel 22
28008 Madrid
Spain
Data protection: [email protected]
General enquiries: [email protected]
Parent company — Mimove International AB, reg. 559479-7317 · VAT SE559479731701
Randersgatan 2
SE-254 40 Helsingborg
Sweden