Privacy Policy

Privacy Policy

**Last updated:** [Date]

—

1. Identity of the Data Controller

The data controller responsible for processing your personal data via this website is:

**[Company Name]**

Registered in the Spanish Commercial Register under number: [Registration Number]

NIF/CIF: [Tax Identification Number]

—

2. Contact Information

For any questions regarding this privacy policy or the processing of your personal data, please contact us at:

  • **Postal Address:** [Street Name and Number], [Postal Code], [City], Spain
  • **Email Address:** [Email Address]
  • **Telephone Number:** [Telephone Number]
  • **Website:** [Website URL]

If you have appointed a Data Protection Officer (DPO):

  • **DPO Name:** [Name]
  • **DPO Email Address:** [DPO Email Address]

—

3. Categories of Personal Data Collected

We collect and process the following categories of personal data, depending on the service you use:

3.1 When Creating an Account

  • First name
  • Email address
  • Password (stored in encrypted form, never in readable format)
  • Date and time of registration
  • IP address in hashed (pseudonymised) form

3.2 When Logging In

  • Login date and time
  • Device type (mobile or desktop)
  • Browser type
  • IP address in hashed (pseudonymised) form

3.3 When Using Google Sign-In

  • First name and email address, as provided by Google
  • Google user ID (stored in pseudonymised form)

3.4 When Submitting a Contact Form or Viewing Request

  • First and last name
  • Email address
  • Telephone number (optional)
  • The content of your message or viewing request
  • The property in which you are interested

3.5 When Using the Website as an Account Holder

  • Saved favourite properties *(visible to [Company Name] staff for personalised service)*
  • Search settings and filters
  • Notes you add to properties *(visible to [Company Name] staff for personalised service)*
  • Lists you create *(visible to [Company Name] staff for personalised service)*
  • Email notification preferences

3.6 Via Cookies and Similar Technologies

Please refer to Article 12 of this privacy policy.

We do not process any special categories of personal data (such as health data, political opinions, or biometric data) and do not request information that would lead to such sensitive data.

—

4. Purposes of Processing

We process your personal data for the following purposes:

| Purpose | Description |

|—|—|

| **Account Management** | Creating, managing, and securing your personal account |

| **Authentication** | Verifying your identity upon login |

| **Property Services** | Displaying property listings, saving favourites, notes, and lists. Favourites, notes, and lists are visible to [Company Name] staff to provide personalised advice |

| **Email Notifications** | Sending notifications about new properties matching your search criteria, provided you have given consent |

| **Contact Handling** | Processing your inquiries, viewing requests, and leads via the contact form |

| **Fraud Prevention and Security** | Detecting and preventing unauthorised access or misuse of the platform |

| **Statistical Analysis** | Analysing anonymous usage statistics to improve our services |

| **Legal Obligations** | Compliance with applicable laws and regulations |

—

5. Legal Basis for Processing

For each processing purpose, we rely on one of the following legal bases under Article 6 of the GDPR:

| Processing | Legal Basis |

|—|—|

| Creating and managing an account | **Performance of a contract** (Art. 6(1)(b) GDPR) |

| Google Sign-In | **Consent** (Art. 6(1)(a) GDPR) – granted by using this login method |

| Email notifications about new properties | **Consent** (Art. 6(1)(a) GDPR) – you may withdraw consent at any time |

| Contact form and viewing requests | **Performance of a contract or pre-contractual measures** (Art. 6(1)(b) GDPR) |

| Fraud prevention and security | **Legitimate interest** (Art. 6(1)(f) GDPR) |

| Statistical analysis (anonymised) | **Legitimate interest** (Art. 6(1)(f) GDPR) |

| Legal obligations | **Legal obligation** (Art. 6(1)(c) GDPR) |

Where we rely on legitimate interests, you have the right to object. Please refer to Article 9 of this privacy policy.

—

6. Retention Periods

We retain your personal data no longer than necessary for the purposes for which it was collected:

| Category | Retention Period |

|—|—|

| Account data (active account) | As long as your account is active |

| Account data (after deletion) | 30 days after deletion request, then permanently erased |

| Login history (pseudonymised) | 12 months |

| Contact form data and leads | [Retention period], in accordance with legal requirements |

| Email notification settings | Until consent is withdrawn or account is deleted |

| Financial and administrative data | 7 years in accordance with Spanish tax legislation |

| Backup copies | Up to [Backup retention period] after the standard retention period |

After the retention period expires, your data will be securely and permanently destroyed or fully anonymised.

—

7. Recipients and Data Processors

We share your personal data with third parties only when necessary for the provision of our services or when required by law. We enter into data processing agreements with all data processors in accordance with Article 28 of the GDPR.

7.1 Data Processors

The following categories of service providers process personal data on our behalf:

| Processor | Service | Categories of Data |

|—|—|—|

| **Resales Online** | Real estate CRM and API (lead management, property data) | Name, email address, telephone number, message |

| **[Hosting Provider]** | Web hosting and server infrastructure | All stored data |

| **[Email Provider]** | Transactional emails (verification, notifications) | Name, email address |

| **Google LLC** | Google Sign-In (OAuth 2