PRIVACY POLICY

In accordance with Regulation (EU) 2016/679, General Data Protection —hereinafter, “RGPD”—, Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights —hereinafter, “LOPDGDD”—, and other applicable regulations, users are informed of the following data:

Data controller: GRUPO LEMGAU, S.L. NIF: B19831072 Registered office and address for notification purposes: Paseo de la Castellana, 194, 28046 Madrid, Spain Telephone: +34 630 810 208 Email: info@grupolemgau.com Website: https://www.grupolemgau.com/

Limón Casa is the commercial name used by GRUPO LEMGAU, S.L. for the provision and marketing of services related to the search, request, reservation, intermediation and management of accommodation, mainly aimed at students.

Hereinafter, GRUPO LEMGAU, S.L. may be referred to interchangeably as “Grupo Lemgau”, “Limón Casa” or the “Responsible”.

This Privacy Policy informs about the way in which Grupo Lemgau collects, uses, conserves and communicates the personal data of people who:

Browse the website.

They request information about an accommodation or service.

Create an account or user profile.

They submit a reservation request.

They make payments or contract services.

They appear as students, tenants, occupants, guarantors, payers or legal representatives.

Contact Limón Casa by email, telephone, WhatsApp, WeChat, web forms, chatbot or other enabled channels.

They present an incident, claim, request for modification, cancellation, entry or exit from the accommodation.

They voluntarily subscribe to commercial communications.

Present your candidacy to work or collaborate with Grupo Lemgau.

Consulting this Privacy Policy does not in itself imply that the user grants consent for all the treatments described. When processing requires consent, this will be requested specifically, separately and unequivocally.

The personal data processed by Grupo Lemgau may come from:

a) The interested party themselves, when they provide information through the website, forms, email, telephone, instant messaging, documents, contracts or other channels.

b) Your parents, guardians, legal representatives, guarantors, payers, family members or authorized persons.

c) Other students or future occupants participating in a joint reservation, when they provide the details of their classmates.

d) Owners, lessors, accommodation managers or collaborators involved in the management of a reservation or contract.

e) Accommodation platforms, real estate portals, agencies, educational centers or other collaborators, when there is a valid legal basis for the communication.

f) Banking entities, payment providers or service providers related to the requested operation.

When a person provides personal data of third parties, they declare that they have sufficient authorization to do so and that they have informed said people about the content of this Privacy Policy.

Lemgau Group may process, depending on the service requested, the following categories of data:

Name and surname.

DNI, NIE, TIE, passport or other identification document.

Handwritten or electronic signature.

Date of birth.

Nationality.

Gender, when necessary to check objective conditions of certain shared accommodations.

Photograph included in identification documents or provided for the management of the accommodation.

Postal address.

Phone number.

Email address.

User or identifier of messaging applications.

Emergency contact information.

Educational center.

Study program.

Admission letter.

Registration, student certificate or proof of registration.

Academic training.

Profession, company or work activity, when necessary to evaluate the application or prove solvency.

Billing data.

Bank account or IBAN.

Transfer receipts.

Information about payments, refunds, pending amounts and deposits.

Documentation on income, solvency, guarantees or economic capacity, when the accommodation requires it.

Identity of the payer or account holder.

Lemgau Group will not store complete bank card data when the payment is managed directly by an external payment service provider.

City, area and accommodation of interest.

Expected date of entry and exit.

Duration of stay.

Number of occupants.

Room or cohabitation preferences.

Accommodation needs.

Information about visits, incidents, breakdowns, damages, keys and return of the property.

Communications maintained during the request, reservation, stay or departure.

Photographs or videos provided to prove the condition of the accommodation, an incident or damage.

When necessary to manage accommodation or verify the identity and situation of the student:

Visa.

NIE or TIE.

Documentation of entry or stay in Spain.

Information strictly necessary for registration or formalization of the contract.

IP address.

Device and browser type.

Technical identifiers.

Date and time of access.

Pages consulted.

Information obtained through cookies or similar technologies, in accordance with the Cookies Policy.

Grupo Lemgau does not generally request data related to health, disability, racial or ethnic origin, religion, sexual orientation, political opinions or other special categories.

When the user voluntarily provides health or special needs data to request a reasonable accommodation adaptation, manage an emergency or deal with a specific situation, said data will be processed only when there is a valid legal basis and to the extent strictly necessary.

Especially sensitive data that is not necessary for the management of the service should not be sent.

Purpose: respond to queries about accommodation, availability, prices, services, conditions, reservations or incidents.

Legal basis: application of pre-contractual measures requested by the interested party and, when the query is not related to a possible contract, the legitimate interest of Grupo Lemgau in responding to communications related to its activity.

Retention: for the time necessary to respond and track the request. If a reservation is not formalized, the data may be kept for a maximum of one year from the last communication, unless it is necessary to keep it for longer to respond to a claim.

Purpose: register the user, authenticate their access, manage their profile and allow them to use the available functionalities.

Legal basis: execution of the conditions of use and application of pre-contractual measures.

Conservation: as long as the account remains active. After cancellation, the data will be blocked for the applicable legal periods.

Purpose: check availability, study the request, verify identity and documentation, manage the reservation, confirm the conditions, coordinate with the owner or manager and prepare the formalization of the accommodation.

Legal basis: application of pre-contractual measures requested by the interested party and execution of the contractual relationship.

Conservation: during the processing of the request and, if the reservation is confirmed, throughout the contractual relationship. Subsequently, the data will be kept duly blocked during the statute of limitations of legal obligations and responsibilities.

Purpose: manage entry, delivery of keys, payments, incidents, maintenance, communications with owners or managers, coexistence, modifications, renewals, cancellations, departure and settlement of deposits.

Legal basis: execution of the contract or reservation conditions and compliance with legal obligations.

Conservation: throughout the contractual relationship and, once completed, during the applicable legal prescription periods.

Purpose: process payments, control pending amounts, issue invoices, make returns, manage deposits, reconcile operations and prevent errors or fraudulent use.

Legal basis: execution of the contract, compliance with legal accounting and tax obligations and legitimate interest in protecting economic operations.

Conservation: accounting, tax and billing documentation will be kept for the periods required by applicable regulations. The documentation may be kept blocked for a longer period when it is necessary for the formulation, exercise or defense of claims.

Purpose: verify the identity of the people who request or use the services, prevent impersonations, false documentation, non-payments, fraudulent operations or improper use of the platform.

Legal basis: execution of pre-contractual measures, compliance with legal obligations and legitimate interest of Grupo Lemgau, the owners and other users in guaranteeing the security of operations.

Conservation: during the time necessary to carry out the verification and, when there is an incident, during the periods necessary to investigate it or take legal action.

Purpose: address breakdowns, damages, claims, conflicts, subsequent queries, refund requests and data protection rights.

Legal basis: execution of the contract, compliance with legal obligations and legitimate interest in managing and defending claims.

Conservation: for the time necessary to manage the matter and, subsequently, until the corresponding responsibilities prescribe.

Purpose: respond to queries, send information about a request or reservation, coordinate entry or exit, report incidents and provide assistance related to the service.

Legal basis: application of pre-contractual measures, execution of the contract or consent, depending on the nature of the communication.

When the user voluntarily contacts through a third-party messaging service, their data may also be processed by the provider of said application in accordance with its own conditions and privacy policies.

The user is not obliged to use these channels and may communicate using the email or telephone number provided by Grupo Lemgau.

Conservation: during the pre-contractual or contractual relationship and, subsequently, for the time necessary to address possible claims.

Purpose: send news, promotions, offers, information about accommodation, products, services or events from Grupo Lemgau and Limón Casa.

Legal basis: express consent of the interested party.

When there is a prior contractual relationship, communications about similar products or services may be sent, in cases permitted by law, always offering a simple and free means to object.

Conservation: until the user withdraws their consent or requests to stop receiving communications.

Refusal to receive advertising will not affect the communications necessary to manage a request, reservation, payment, contract or incident.

Purpose: to know the opinions of users and improve services, processes and quality of care.

Legal basis: legitimate interest of Grupo Lemgau in evaluating and improving its services.

Conservation: for the time necessary to analyze the results. Wherever possible, results will be kept in aggregated or anonymized form.

The user may object at any time to receiving these surveys.

Purpose: evaluate applications, professional profiles, internships or collaborations.

Legal basis: application of pre-contractual measures requested by the candidate and, when applicable, their consent to retain the candidacy in future processes.

Conservation: during the selection process. If conservation is authorized for future processes, the data may be kept for a maximum of one year, unless the consent is updated or renewed.

Purpose: comply with tax, accounting, administrative, judicial, fraud prevention and any other applicable legal obligations.

Legal basis: compliance with a legal obligation.

Conservation: during the periods established in each regulation and, subsequently, as long as responsibilities may be demanded.

The fields marked as mandatory are necessary to manage the query, request, reservation, payment or corresponding service.

Refusal to provide necessary data or providing incomplete or inaccurate information may prevent:

Responding to a request.

Check the user's identity.

Process or confirm a reservation.

Formalize the contract.

Manage payments or returns.

Provide assistance during the stay.

Comply with legal obligations.

The data requested for commercial communications or other optional purposes is not necessary to contract the services.

Personal data may be communicated, when necessary and there is a valid legal basis, to:

a) Owners, lessors, managers, administrators or representatives of the requested accommodation.

b) Other providers who are directly involved in the reservation, entry, stay, maintenance or departure.

c) Banking entities, payment platforms and collection service providers.

d) Maintenance, repair, cleaning, locksmith or assistance companies, when they must intervene in an incident.

e) Agencies, tax, accounting, legal consultancies, insurance companies, auditors and other professionals subject to confidentiality duties.

f) Technology providers, web hosting, storage, email, messaging, customer management, electronic signature or IT support that act as data processors.

g) Public administrations, judicial bodies, security forces and bodies, tax authorities or other organizations, when there is a legal obligation or a valid requirement.

h) Educational centers, family members, guarantors, payers or representatives, when it is necessary for the management of the service and there is sufficient authorization or legal basis.

Users' personal data will not be sold to third parties.

When a supplier processes data on behalf of the Lemgau Group, the corresponding processing agreement will be formalized when required.

Some technology, messaging, storage, analysis or support providers may be located outside the European Economic Area or process information from third countries.

When an international data transfer occurs, Grupo Lemgau will ensure that it is covered by:

An adequacy decision from the European Commission.

Standard contractual clauses approved by the European Commission.

Binding corporate rules.

Any other guarantee or exception allowed by the RGPD.

Voluntary use by the user of WhatsApp, WeChat or other external platforms may involve processing or transfers carried out by the owners of said applications, in accordance with their own policies.

The user may request additional information about the applicable guarantees by writing to info@grupolemgau.com.

Accommodation services can be requested for students under 18 years of age. In these cases, the reservation, contracting, payments and other acts that require it must be carried out with the intervention or authorization of the father, mother, guardian or corresponding legal representative.

When the treatment is based on consent and the interested party is under 14 years of age, the consent of the person exercising parental authority or guardianship will be necessary. When legislation requires the assistance of the legal representative for the legal act or business related to the treatment, said intervention will be requested even if the minor is over 14 years of age.

Lemgau Group may request the necessary information to verify identity, age and legal representation.

Minors must not provide personal data, make payments or formalize reservations without the knowledge and assistance of their legal representative when this is necessary.

When booking shared rooms or entire homes, a user can provide data on roommates, guarantors, payers, family members or emergency contacts.

The person who provides this data guarantees that:

The information is correct.

You have authorization to provide it.

You have informed the affected persons about the communication of their data.

Does not provide data that is not necessary for the corresponding purpose.

Lemgau Group will provide third parties with the information required by regulations when applicable.

Lemgau Group does not generally adopt decisions based exclusively on automated treatments that produce legal effects on the user or significantly affect them in a similar way.

Technical tools may be used to organize requests, detect errors, classify queries, personalize communications or identify possible anomalous operations. These tools will not replace human intervention when the decision may significantly affect the contract or the user's rights.

When profiles are created for commercial purposes, they will be based on the user's consent or another valid legal basis, and will not include special categories of data.

Lemgau Group will only send commercial communications when there is a legal basis that allows it.

When the sending is based on consent, this will be requested through a specific box that will not be previously checked.

The user may withdraw their consent or request cancellation at any time:

Using the link included in each communication.

By writing to info@grupolemgau.com.

Using any other free mechanism provided by Grupo Lemgau.

The withdrawal of consent will not affect the legality of the processing carried out before its withdrawal.

The interested party can exercise the following rights:

Access: know if Grupo Lemgau processes your data and obtain a copy.

Rectification: correct inaccurate data or complete incomplete data.

Deletion: request the deletion of the data when it is no longer necessary or there is another legal cause.

Opposition: oppose certain treatments based on legitimate interest or intended for advertising.

Limitation: request that the treatment be restricted in the cases legally provided for.

Portability: receive certain data in a structured, commonly used and machine-readable format, and request its transmission to another person in charge when technically possible.

Withdrawal of consent: withdraw the consents granted at any time.

Not be subject to exclusively automated decisions: when they produce legal effects or significantly affect you.

The exercise of rights is free of charge, except in cases where the requests are manifestly unfounded, excessive or repetitive in the terms legally provided. The AEPD indicates that requests must be responded to, in general, within one month, extendable for another two months when the complexity or number of requests justifies it.

The interested party may send their request to:

Email: info@grupolemgau.com Postal address: GRUPO LEMGAU, S.L., Paseo de la Castellana, 194, 28046 Madrid, Spain Reference: “Data protection”

The request must indicate:

Name and surname.

Right you wish to exercise.

Clear description of the request.

Address or means to receive the response.

Additional information necessary to locate the data.

It will not be necessary to automatically attach a full copy of the identity document. Grupo Lemgau will only request the additional information necessary to verify identity when there are reasonable doubts about the person making the request.

The rights can be exercised directly or through a legal or voluntary representative. The enabled means must be accessible and the exercise cannot be rejected solely because the interested party has used another valid channel.

When the interested party considers that their data has not been processed correctly or that their rights have not been attended to, they may file a claim with:

Spanish Data Protection Agency — AEPD Calle Jorge Juan, 6 28001 Madrid, Spain

You may also file the claim through the electronic headquarters of the AEPD.

However, before submitting a claim, the interested party can contact Grupo Lemgau through info@grupolemgau.com, so that the entity can review and address the situation.

Lemgau Group will adopt appropriate technical and organizational measures to protect personal data against:

Accidental loss or destruction.

Unauthorized access.

Alteration.

Improper communication.

Illegal use.

Any other form of unauthorized processing.

Staff, collaborators and suppliers who have access to personal data will be subject to confidentiality obligations.

However, no system connected to the Internet can guarantee absolute security. The user must protect their devices, passwords and documentation, and report any suspicion of unauthorized access.

Once the data is no longer necessary for the purpose for which it was collected, it will be deleted or anonymized.

When there is a conservation obligation or legal responsibilities may arise, the data will be duly blocked and will only be available to judges, courts, the Public Prosecutor's Office, public administrations or other competent authorities.

Once the applicable statute of limitations expires, the data will be securely deleted.

The user guarantees that the data provided is true, exact, complete and up-to-date.

The user must communicate any relevant modification, especially in relation to:

Contact information.

Identification documentation.

Academic status.

Payment information.

Legal representatives.

Authorized persons.

Information necessary for the reservation or stay.

Grupo Lemgau will not be responsible for the consequences derived from false, inaccurate, incomplete or outdated data provided by the user, without prejudice to the legal obligations that correspond to the Controller.

The website may include links or integrations with payment platforms, social networks, maps, messaging services, real estate portals or other external services.

These third parties may process data as independent controllers in accordance with their own privacy policies.

Lemgau Group recommends reviewing the conditions and privacy policies of each provider before using their services.

Lemgau Group may modify this Privacy Policy to adapt it to:

Legislative or regulatory changes.

New criteria from data protection authorities.

Modifications in the services offered.

Incorporation of new suppliers or technologies.

Changes in processing operations.

The updated version will be published on the website indicating the date of the last modification.

When the change substantially affects a treatment based on consent, said consent will be requested again when necessary.

For any questions related to this Privacy Policy or the processing of personal data, the user can contact:

GRUPO LEMGAU, S.L. NIF: B19831072 Address: Paseo de la Castellana, 194, 28046 Madrid, Spain Telephone: +34 630 810 208 Email: info@grupolemgau.com Website: https://www.grupolemgau.com/

Last update: July 2026.