Secure keyholding for a Barcelona property

A reliable keyholding service can answer six questions without searching through messages: what access exists, where it is, who may request it, who used it, why they used it and whether it came back. The arrangement also needs a separate emergency route and an end-of-service audit. Keeping a spare key in an office drawer is storage. It is not professional keyholding.

This guide describes operational controls. It does not authorise entry, override a lease or occupant, design a particular property’s security, or define a guaranteed service response. The signed agreement and applicable legal advice must set the actual service, authority, hours, fees and exclusions.

Inventory every way into the property

List entrance keys, apartment or house keys, mailbox, parking, storage, roof or service-room keys, remotes, fobs, cards, gate controls and safe keys. Add smart-lock accounts, alarm credentials, intercom access and temporary codes. Record what each item opens and whether duplication is restricted.

Use a neutral code on the physical item. Keep the mapping to address and owner in a separate protected system. Do not attach a phone number and full address to a key ring. A code is useful only if staff can resolve it quickly through authorised access.

Photograph or describe distinctive remotes and fobs. Record quantity, working state and battery condition where relevant. Test access at handover with the authorised person. A key copied from an old set may turn but not operate all locks, and a garage remote may have been removed from the receiver.

Establish who can give access instructions

Identify the owner and any authorised representative. Then record occupation: vacant, owner-used, family-used, tenanted, under works or shared. The person who owns the home is not always the person who can arrange entry without notice or agreement.

The Generalitat’s rental-contract guidance says the contract identifies the property and parties and records rent, duration, payment, deposit and other material information. The official contract page supports checking the operative tenancy before a keyholding instruction assumes access.

Create requester roles. An owner may approve defined visits. A property manager may request contractors within the management mandate. A tenant may report repairs but not authorise access to owner storage. A community administrator may coordinate common works without automatically gaining private-home access.

Require written changes to the authorised list. Voice calls can handle urgency, but confirm the instruction through a known channel. Do not accept a new sender’s claim that the owner “”“said it was fine”“” without verification.

Separate key identity from personal data

A key register needs the code, item, holder, release and return. It rarely needs passport copies, extensive personal notes or unrelated tenant correspondence. Keep identity verification proportionate to the access risk and agreed process.

The GDPR requires personal data to be adequate, relevant and limited to what is necessary for the purpose. Article 5 in the official text supports separating the operational key log from the full owner or tenancy file.

Restrict access by role. Staff who issue a contractor key may need to confirm an approved work order, not see the owner’s tax records. A contractor needs the appointment and access instructions, not the tenant’s full lease or travel schedule.

Set retention and incident procedures with appropriate data-protection advice. Access logs can be necessary evidence, but that does not justify indefinite storage or broad internal visibility.

Design secure storage around realistic mistakes

Use controlled storage that records or limits access. Separate duplicate sets when loss of one set would expose all access. Avoid placing alarm codes with physical keys. Consider business continuity: if the only authorised staff member is unavailable, can an approved replacement retrieve the correct set without weakening controls?

Create a daily issue process. Confirm request, authority, provider, date, purpose and expected return. Inspect the item at release and return. Flag an overdue key promptly. A spreadsheet reviewed monthly is too slow for same-day access risk.

For high-risk properties or master keys, define additional approval and transport controls. Do not promise a particular security standard unless the actual facility and procedure meet it. The property’s insurer or security adviser may impose requirements.

Give contractors task-limited access

Every visit needs a work order or equivalent record. Include property code, date, provider, named person, purpose, areas in scope, tenant or occupant arrangement, entry method, expected duration and evidence required. Do not issue a key for “”“maintenance”“” with no specific task.

Verify provider identity against the appointment. Record arrival and departure. Ask the provider not to copy keys, share codes or admit others. If additional work appears, they should secure the property and request approval rather than expanding access informally.

Where an occupant is present, agree the visit with them through the appropriate route. Respect private rooms and possessions. A key should not be used to bypass a missed appointment unless the contract and legal advice clearly support the action.

After the visit, confirm locking, alarm or access state, key return and any issue. Obtain the service evidence separately. Keyholding proves access control; it does not prove the quality of the repair.

Treat tenanted access as its own workflow

Article 21 of the Urban Leases Act addresses conservation repairs and the tenant’s obligations in relation to urgent work within its rules. The consolidated BOE text does not grant a keyholder an unrestricted general right of entry.

The management and keyholding agreements should point to the tenancy communication process. Give reasonable notice as advised, explain purpose, offer appointments and record agreement. For a reported emergency, use the emergency route and legal advice appropriate to the facts.

Never describe a tenant who requests notice as obstructive in the key log. Record dates, proposed times and outcomes. The log should preserve facts for the manager and adviser, not create character judgments.

When a tenancy changes, run a full access audit. Recover tenant sets as legally and contractually appropriate, reconcile landlord sets, update smart permissions and decide whether locks or codes change. Retain evidence without circulating former tenant data.

Define emergency before the phone rings

Write examples around immediate risk to people, active water escape, fire, gas concern, forced entry or serious loss of essential service. Keep routine lockouts, appliance inconvenience, planned access and minor defects on the normal route unless circumstances elevate the risk.

Catalonia’s 112 service is the emergency number for urgent situations requiring police, fire, medical or other emergency response. The official 112 page should be used for genuine emergencies, not as a substitute for property maintenance or the manager’s service line.

The keyholder’s first task is personal safety. They should not enter a suspected dangerous environment or attempt technical work outside competence. Contact emergency services and the appropriate provider, then follow the owner-notification and incident plan.

Separate containment from repair. Turning off water through a known safe valve may limit damage where authorised and safe. Selecting and approving permanent works belongs to the management decision matrix. Record times, observations, actions and callers without speculating about cause.

Build a factual incident report

Use a standard record: when reported, by whom, observable condition, people present, services contacted, entry authority, keys used, immediate action, property left secure, owner notification and next step. Add photos only where necessary and safe.

Avoid liability conclusions. “”“Water visible beneath kitchen sink at 09:20”“” is an observation. “”“Tenant broke the pipe”“” is an accusation requiring evidence. Preserve contractor and emergency-service reports.

If a key, fob or credential is lost, treat that as an incident even if nobody has used it. Identify what it opens, last known holder, address-link risk and whether locks, codes or permissions need change. Ask the owner, manager, insurer or security professional according to the plan.

Notify affected occupants through the appropriate route where risk or access changes concern them. Keep communication accurate and proportionate.

Include common areas and building work

Contractors may need a private key to inspect damage originating from a roof, façade, riser or neighbouring unit. Confirm whether the visit is organised by the community, owner or manager and what private access is required. Do not give building contractors open-ended private access.

Catalonia’s ITE is a visual inspection by a competent technician that records a residential building’s condition and guides conservation and maintenance. The official guidance helps distinguish a formal building inspection from a keyholder’s access visit.

For planned community work, create a temporary access schedule and named provider list. Record daily issue and return if keys leave controlled storage. End temporary permissions when the project phase ends, not months later at the annual audit.

Manage smart access as credentials, devices and recovery

List the platform owner, administrator accounts, invited users, connected locks, gateways, batteries and recovery route. Avoid using one staff member’s personal email as the permanent administrator. Use the owner-approved organisational account where appropriate.

Time-limit contractor codes. Remove former staff and providers immediately. Review access history when an incident occurs, while respecting lawful data use. A digital log is helpful only if clocks, users and devices are correctly configured.

Plan for internet, battery and platform failure. Keep an authorised physical fallback where appropriate. Document how to enter without causing damage and who can approve locksmith work.

At handover, transfer administrative ownership, recovery methods and devices. Deleting an app from one phone does not remove an account or credential.

Audit the system after every material change

Run a scheduled audit and an event audit after lost access, tenancy change, major works, staff departure, owner representative change or service termination. Count each item physically. Test high-value access where authorised. Reconcile issue logs and investigate unresolved entries.

Review the authorised-requester list and emergency contacts. Remove obsolete names. Check that storage mapping and property occupation remain current. A perfectly counted key set can still be unsafe if the wrong people retain authority.

Produce an exception report: missing item, overdue return, failed remote, unknown copy, stale code or unverified holder. Assign action and date. Do not close the audit with unexplained differences.

Hand over without leaving hidden access

On termination, agree the cut-off date and receiving person. Inventory physical items, digital accounts, alarm or smart access under the appropriate security route, logs, open incidents and temporary contractor permissions. Use signed transfer evidence.

Remove access for former keyholding staff after confirmation that continuity is safe. Do not delete evidence needed for legitimate records without following retention rules. Inform occupants and active contractors through the authorised manager where relevant.

If a key cannot be reconciled, disclose it. The owner can decide with insurer or security adviser whether locks or credentials must change. An undocumented missing key is not solved by ending the contract.

Design access for planned owner arrivals

For a second home, keyholding may support arrivals as well as contractors. The service should distinguish preparation from hospitality promises. Agree the inspection time, utilities or climate checks, cleaning hand-off, deliveries and the point at which the owner becomes responsible for access again.

Use a short pre-arrival checklist based on the actual home. Confirm that the main access works, visible water or power issues are absent, agreed systems are in the expected state and contractor work has left the property secure. Do not certify safety or technical condition through a general visual visit.

After departure, record the owner-approved lock-up tasks and any reported defect. Avoid assuming that staff may inspect personal rooms, cupboards or documents. The mandate should define scope and privacy even in a vacant owner-used home.

Control duplicate creation

Do not permit informal copying by contractors or staff. Record every authorised duplicate, purpose, maker, date and holder. Restricted or patented key systems may have their own card or provider process. Keep the control evidence separate from the physical keys.

When a duplicate is no longer needed, recover it. Destruction should follow a documented process appropriate to the key or credential. A verbal assurance that a contractor “”“threw it away”“” is weak evidence for the owner.

If the number of authorised copies cannot be established, report the uncertainty and assess rekeying with the owner, insurer or security professional. Do not reset locks automatically without checking occupation, emergency continuity and connected access.

Review provider and staff permissions

Keyholding security depends on people and systems. Train staff on identification, issue, return, incidents, privacy and coercion or suspicious requests. Use named accounts in the key register rather than shared logins where possible.

Review who can open storage, resolve codes, approve issue and export logs. One person should not be able to create, issue and erase a record without oversight for higher-risk access. The exact control should match the service and property risk.

When staff leave or roles change, remove physical and digital access promptly and document it. Include temporary workers and external cleaners in the audit where they held credentials.

Price the service by scope, not by the word keyholding

Compare storage, issue hours, emergency response, visit attendance, contractor coordination, smart access, reporting, audits and travel. Two providers can use the same label while offering very different authority and response.

Ask which tasks incur call-out or coordination fees and which require a separate management agreement. Confirm replacement-key, locksmith, alarm and out-of-hours exclusions. A low storage fee does not prove the complete access service is cheaper.

Do not buy an emergency promise without response definitions. The provider may receive calls, attend when staff are available or guarantee a stated service level. Those are different contracts. Record dependencies on emergency services and third-party providers.

Keep an owner-readable access report

Report the current inventory, last audit, issues and open exceptions. The owner does not need every routine key movement, but they should be able to request the underlying log. Show lost, overdue, newly copied and digitally revoked access clearly.

For each incident, include property security outcome and next decision. Avoid placing codes or full addresses in the report. Sensitive details belong in the controlled system.

During long quiet periods, confirm that audits still occur. Lack of key use is not evidence that every item and permission remains correct.

Limits and next step

No written guide can determine lawful entry for a particular property or tenancy. A keyholding service cannot guarantee that an emergency will be detected, that a contractor will perform correctly or that digital platforms will remain available. Security and insurance requirements vary.

Prepare the full access inventory, owner authority, occupation, authorised requester list, emergency definition, provider process and desired hours. Ask the proposed service to demonstrate issue, incident, audit and handover records.

Speak with the Lasose team about the actual keyholding scope available. Confirm response hours, storage, authority, fees, exclusions and links to property management in the signed agreement.

Frequently asked questions

Should a key tag show the property address?

No. Use a coded reference stored separately from the address and owner details. A lost key should not tell the finder where it works.

Can a keyholder enter whenever the owner asks?

Not automatically. Entry must fit the written mandate, actual occupation, lease, applicable law and agreed notice. Tenant or other occupant rights can limit the owner’s practical access route.

What counts as an emergency for keyholding?

Define it in the agreement around immediate risk to people, property or essential systems. Routine inconvenience, planned maintenance and owner errands should use the normal approval and appointment route.

How should contractor access be recorded?

Record requester, authority, provider identity, date, purpose, key issued, areas in scope, arrival, departure, return and any incident. Give no more access information than the task requires.

Are smart-lock codes safer than physical keys?

They can improve time-limited access and logs, but only if accounts, permissions, recovery, devices and deletion are managed. Digital access can fail or remain active unnoticed, so it needs the same audit discipline.