Beta version. The service is being tested: results may be incomplete or wrong. You use it at your own risk. Terms

Privacy policy

What data we process, why, on what basis and for how long, and how to exercise your rights.

Version 1.0-beta · In force since 28/09/2026

This is a translation. The Spanish version is the binding one; in case of discrepancy, the interpretation most favourable to the consumer prevails.

In short

Question	Answer
Who is responsible	privacidad@patitasencasa.es
What for	Running your account, listings and applications; PatitasID checks; identity verification, required to publish and to apply to adopt; security and preventing deception; and being able to show that you accepted the terms.
On what basis	Performance of the contract (the terms you accept), our legitimate interest, your consent (explicit, if you choose biometric verification) and compliance with legal obligations.
Who receives it	Other users, only what an application needs; the providers who serve us (hosting, email, identity verification, Google sign-in and, if you accept it, analytics); and the authorities when the law requires it.
Your rights	Access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and a complaint to the Spanish Data Protection Agency.

Who is responsible
Answer
privacidad@patitasencasa.es
What for
Answer
Running your account, listings and applications; PatitasID checks; identity verification, required to publish and to apply to adopt; security and preventing deception; and being able to show that you accepted the terms.
On what basis
Answer
Performance of the contract (the terms you accept), our legitimate interest, your consent (explicit, if you choose biometric verification) and compliance with legal obligations.
Who receives it
Answer
Other users, only what an application needs; the providers who serve us (hosting, email, identity verification, Google sign-in and, if you accept it, analytics); and the authorities when the law requires it.
Your rights
Answer
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and a complaint to the Spanish Data Protection Agency.

1. Data controller

The controller of your data is:

Email: privacidad@patitasencasa.es
Website: patitasencasa.es

We have not appointed a data protection officer because, given our activity, the law does not require one.

2. What data we process, why, on what basis and for how long

When	Data	Purpose	Legal basis (GDPR)	Period
Browsing the site	IP address, browser, operating system and technical logs	Operation and security of the site	Legitimate interest, art. 6(1)(f)	Up to 12 months
Accepting the beta terms	Version of the terms, date and time, your account identifier (if you have one), IP address, browser (user agent), language and a SHA-256 fingerprint of the exact text you were shown	Being able to show that you accepted the terms	Legitimate interest, art. 6(1)(f)	Without an account: 12 months from acceptance. With an account: 5 years from the last time the acceptance was used to register, publish or apply
Account	First name and surname, date of birth, email, phone, address and user type; if you are an organisation, its name and CIF; the type and number of your identity document, needed for verification. If you sign in with Google, Google gives us your name and email	Creating and managing your account	Contract, art. 6(1)(b)	While the account is active and 30 days after it is closed
Animal listings	Animal details, photos and contact details of the publisher	Publishing the listing	Contract, art. 6(1)(b)	While the listing is active
Adoption applications, messages and appointments	Application form data, messages and appointments between users	Passing the application to the person who published the listing and allowing them to communicate	Contract, art. 6(1)(b)	No adoption (rejected, withdrawn or closed): 1 year after closing. Adoption completed: 5 years after the adoption, the general limitation period for contractual claims in Spain (art. 1964 of the Civil Code)
Identity verification with Didit	Didit Identity Spain, S.L. processes the document image, the selfie, the liveness check and the biometric comparison. We only receive the result, the document type and number, the session identifier and the date	Verifying your identity, required to publish and to apply to adopt	Explicit consent, arts. 6(1)(a) and 9(2)(a)	The result, while the account is active. At Didit, one month; the biometric template is deleted together with the session
Manual identity verification	Images of both sides of the document, document type and number, result and date of the review	Verifying your identity without biometric data	Legitimate interest, art. 6(1)(f)	The images, until an administrator approves or declines the verification (they are then deleted); the result, the document type and number and the date, while the account is active
Moderation	If you close your account with sanctions in force, an encrypted, irreversible fingerprint of your email (not the email)	Preventing a new registration from erasing a block	Legitimate interest, art. 6(1)(f)	12 months from the last sanction
Content reports	Details of the reporter and content of the report	Handling the report	Legal obligation (Digital Services Act), art. 6(1)(c)	Up to 3 years
Contact form	Name, email and message	Replying to you	Legitimate interest, art. 6(1)(f)	Up to 1 year from the last reply
Emails we send you	Recipient, email type, subject and delivery status	Knowing whether a notice was delivered	Legitimate interest, art. 6(1)(f)	90 days
Adoption stories	First name, quote and photos you choose to share	Publishing your story with your name	Consent, art. 6(1)(a)	Until you withdraw consent
Newsletter	Email	Sending you news about the service	Consent, art. 6(1)(a)	Until you unsubscribe
Analytics, only if you accept it	Cookie identifiers, pages visited and device and browser data	Understanding how the site is used	Consent, art. 6(1)(a)	According to the Cookie policy
PatitasID	What you type in a check	Calculating the result	Legitimate interest, art. 6(1)(f)	Not kept (see the PatitasID tab)

Browsing the site
Data
IP address, browser, operating system and technical logs
Purpose
Operation and security of the site
Legal basis (GDPR)
Legitimate interest, art. 6(1)(f)
Period
Up to 12 months
Accepting the beta terms
Data
Version of the terms, date and time, your account identifier (if you have one), IP address, browser (user agent), language and a SHA-256 fingerprint of the exact text you were shown
Purpose
Being able to show that you accepted the terms
Legal basis (GDPR)
Legitimate interest, art. 6(1)(f)
Period
Without an account: 12 months from acceptance. With an account: 5 years from the last time the acceptance was used to register, publish or apply
Account
Data
First name and surname, date of birth, email, phone, address and user type; if you are an organisation, its name and CIF; the type and number of your identity document, needed for verification. If you sign in with Google, Google gives us your name and email
Purpose
Creating and managing your account
Legal basis (GDPR)
Contract, art. 6(1)(b)
Period
While the account is active and 30 days after it is closed
Animal listings
Data
Animal details, photos and contact details of the publisher
Purpose
Publishing the listing
Legal basis (GDPR)
Contract, art. 6(1)(b)
Period
While the listing is active
Adoption applications, messages and appointments
Data
Application form data, messages and appointments between users
Purpose
Passing the application to the person who published the listing and allowing them to communicate
Legal basis (GDPR)
Contract, art. 6(1)(b)
Period
No adoption (rejected, withdrawn or closed): 1 year after closing. Adoption completed: 5 years after the adoption, the general limitation period for contractual claims in Spain (art. 1964 of the Civil Code)
Identity verification with Didit
Data
Didit Identity Spain, S.L. processes the document image, the selfie, the liveness check and the biometric comparison. We only receive the result, the document type and number, the session identifier and the date
Purpose
Verifying your identity, required to publish and to apply to adopt
Legal basis (GDPR)
Explicit consent, arts. 6(1)(a) and 9(2)(a)
Period
The result, while the account is active. At Didit, one month; the biometric template is deleted together with the session
Manual identity verification
Data
Images of both sides of the document, document type and number, result and date of the review
Purpose
Verifying your identity without biometric data
Legal basis (GDPR)
Legitimate interest, art. 6(1)(f)
Period
The images, until an administrator approves or declines the verification (they are then deleted); the result, the document type and number and the date, while the account is active
Moderation
Data
If you close your account with sanctions in force, an encrypted, irreversible fingerprint of your email (not the email)
Purpose
Preventing a new registration from erasing a block
Legal basis (GDPR)
Legitimate interest, art. 6(1)(f)
Period
12 months from the last sanction
Content reports
Data
Details of the reporter and content of the report
Purpose
Handling the report
Legal basis (GDPR)
Legal obligation (Digital Services Act), art. 6(1)(c)
Period
Up to 3 years
Contact form
Data
Name, email and message
Purpose
Replying to you
Legal basis (GDPR)
Legitimate interest, art. 6(1)(f)
Period
Up to 1 year from the last reply
Emails we send you
Data
Recipient, email type, subject and delivery status
Purpose
Knowing whether a notice was delivered
Legal basis (GDPR)
Legitimate interest, art. 6(1)(f)
Period
90 days
Adoption stories
Data
First name, quote and photos you choose to share
Purpose
Publishing your story with your name
Legal basis (GDPR)
Consent, art. 6(1)(a)
Period
Until you withdraw consent
Newsletter
Data
Email
Purpose
Sending you news about the service
Legal basis (GDPR)
Consent, art. 6(1)(a)
Period
Until you unsubscribe
Analytics, only if you accept it
Data
Cookie identifiers, pages visited and device and browser data
Purpose
Understanding how the site is used
Legal basis (GDPR)
Consent, art. 6(1)(a)
Period
According to the Cookie policy
PatitasID
Data
What you type in a check
Purpose
Calculating the result
Legal basis (GDPR)
Legitimate interest, art. 6(1)(f)
Period
Not kept (see the PatitasID tab)

Data marked as required in each form is needed for that feature; without it we cannot provide it.

3. PatitasID

PatitasID works without registration and does not keep what you type. Everything about its data, including other people’s data such as an IBAN, is explained in the PatitasID tab.

4. Identity verification

To publish or edit a listing and to apply to adopt, you must verify your identity. You do not need to do so to browse listings or use PatitasID. You choose the way:

With Didit (automatic). Didit Identity Spain, S.L. (opens in a new tab) (CIF B22929327, Spain) acts as our processor: it processes the photo of your document, a selfie, a liveness check and the biometric comparison between your face and the document photo. Didit keeps the verification data for one month, and the biometric template is deleted together with the session. We only receive the result (approved, declined or under review), the document type and number, the session identifier and the date. We neither receive nor keep the images. The basis is your explicit consent (arts. 6(1)(a) and 9(2)(a) GDPR), which you give separately and may withdraw at any time; withdrawing it does not affect processing already carried out.
Manual review. You upload a photo of each side of your DNI, NIE or passport. The images are stored in private storage at our hosting provider in the European Union (Oracle Cloud Infrastructure, Madrid region) and only an administrator can view them, through temporary links that expire after 15 minutes. They are deleted as soon as the administrator approves or declines the verification; after that we only keep the result, the document type and number and the date. No biometric data is used. The basis is our legitimate interest in preventing animal sales disguised as adoptions and in protecting animals and people (art. 6(1)(f) GDPR).

The manual way exists precisely so that consent to biometric verification is freely given: if you do not want to give it, you can still get verified.

5. Who we share your data with

We do not sell data. We only share it:

With other users, when necessary: when you send an adoption application, the person who published the listing receives your contact details and the application, because the adoption is not possible without them (art. 6(1)(b) GDPR).
With the authorities, only when the law requires it, for example following a court or police order.

In addition, these providers process data on our behalf, under contract and only for the service they provide to us:

Oracle Cloud Infrastructure: hosting of the site, the database and the files, on servers and object storage in the Madrid region (eu-madrid-1), in the European Union.
Resend: sending the service’s emails.
Didit Identity Spain, S.L. (Spain): automatic identity verification, if you choose it.
Google: if you choose “Sign in with Google”, Google confirms your name and email to us; and, only if you accept analytics cookies, Google Tag Manager and Google Analytics.

Transfers outside the European Economic Area. Resend and Google are US companies and may process data outside the European Economic Area. These transfers rely on the European Commission’s standard contractual clauses and/or the EU-US Data Privacy Framework, depending on the provider.

6. Security

Passwords are stored hashed with bcrypt, connections use HTTPS, access to data is limited according to each person’s role and backups are made regularly. Documents from manual verification are stored in private storage with no public access.

No transmission over the internet is completely secure: use a strong password and do not share it with anyone.

7. Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, receive it in a portable format, object to processing based on legitimate interest and withdraw your consent at any time. Withdrawal does not affect the lawfulness of earlier processing.

To exercise them, write to privacidad@patitasencasa.es or use the contact form. We will reply within one month. You can delete your account from your profile.

You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es (opens in a new tab)) or with the data protection authority of your country.

8. Age

The service is only for people aged 18 or over. If we learn that a minor has given us data, we will delete it.

9. Cookies

We use technical cookies and, only if you accept them, analytics cookies. The details are in the Cookie policy.

10. Changes to this policy

Each new version is published with its number and date. If the change is significant, we will let you know on the site or by email.

11. Contact

For any question about your personal data:

Email: privacidad@patitasencasa.es
Website: patitasencasa.es

1. What you type in a check

PatitasID works without registration. What you type in a check (names, identifiers, microchip numbers, dates, IBAN, amounts, phone, address, website) is sent once to our server, used to calculate the result and discarded. It does not stay in databases, activity logs or analytics, and it does not appear in the web address. The result has no address of its own and only you see it.

Legal basis: our legitimate interest, which is also yours, in preventing deception in the adoption and purchase of animals (art. 6(1)(f) GDPR).

2. Other people’s data

Some data you enter may relate to another person, for example a seller’s IBAN. We process it only at the moment of the query: we do not build profiles or combine it with other data. You have usually received it from that same person, and both your interest and ours is to prevent deception involving animals.

Anyone whose data may have been entered can exercise the rights in section 7 of the General tab.

3. What leaves our server

Two checks need to query an external service while we answer you: the address you type is sent to the CartoCiudad geocoder of Spain’s National Geographic Institute, and a website’s domain to the registry service for its zone (RDAP; for example, Verisign for .com and .net). We send nothing else, we do not tell them who is asking and we do not keep what you typed. If you prefer that data not to leave, leave those fields empty: the other checks work the same.

If you press the button to look up a microchip on Europetnet, that number travels to their website with the link and stays in their logs. It only happens if you press it, we warn you first, and the result does not come back to us.

4. What is stored

Organisation data published in official registers under a re-use licence, at entity level only: name, registration number, tax identifier, legal form, municipality, registration date and status. Some official files also include personal data (board members, founders, addresses, phone numbers, emails): it is discarded when the file is read, never reaches our database, and the file is deleted when the import finishes.
Aggregated daily statistics: how many checks of each type are made and with what result, by country. No one’s data.
Proposals to the moderation queue: only the entity’s name, identifier and registration number, with no data about who proposes it.
Correction requests, with your consent (art. 6(1)(a) GDPR): the text and your email, so we can reply.
In your own browser, and only if you choose a country or dismiss the country suggestion: that preference. It does not leave your device.

5. Analytics

Only if you accept analytics cookies do we measure how often each step is used, without sending any field value. The aggregated statistics in the previous point use neither cookies nor personal data.

6. Periods

What you type in a check: not kept. Rejected proposals: 90 days. Correction requests: 3 years from closure; after that the contact details are anonymised.

7. No automated decisions

PatitasID does not make decisions about people or build profiles of anyone. We do not take decisions based solely on automated processing within the meaning of Article 22 GDPR. If an automatic filter has restricted your listing on the platform, you can ask for a person to review it.

8. Corrections and rights

If a check affects you and you believe it does not reflect reality, ask for a correction (opens in a new tab). To exercise your data protection rights, see section 7 of the General tab.