Privacy Policy

1. Data controller

Spain Costas Exclusive Properties, S.L.U., NIF B72417397, Calle Guatemala, no. 19, ground-floor premises, door 6, 08018 Barcelona (Barcelona), Spain. Privacy contact: info@spain-costas.com.

2. Data we process

When you submit an enquiry we may process your name, phone number, email address, message, property preferences, the related page/property and IP address. If Analytics consent has been given, we may also process limited attribution parameters, technical browser/device information and approximate country/city derived from the IP address.

If you contact us through the Telegram bot, we also process the chat identifier, messages and contact details you provide during that conversation.

We do not ask users to enter special categories of personal data in free-text form fields.

3. Purposes and legal bases

• Answering enquiries, preparing offers and managing property requests: pre-contractual steps requested by the user (GDPR Art. 6(1)(b)).
• Website security and abuse prevention: legitimate interests (GDPR Art. 6(1)(f)).
• Analytics, campaign attribution and technical/geographic enrichment associated with an enquiry: consent (GDPR Art. 6(1)(a)).
• Compliance with legal obligations and authority requests: legal obligation (GDPR Art. 6(1)(c)).

We do not use solely automated decision-making that produces legal effects for users.

4. Recipients and providers

Technical providers may receive or access data where necessary to provide their services:

• Telegram Bot API, used for the bot and internal notifications about new enquiries. Telegram Privacy Policy.
• ipapi.co, used only where Analytics consent exists to derive approximate country/city from an IP address. ipapi Privacy Policy.
• Google Analytics, where Analytics consent is given, and YouTube/Google Maps, where External content consent is given. Google Privacy Policy.
• MapLibre/CARTO and the delivery infrastructure for library/map resources, only after External content consent. CARTO Privacy Policy.
• Hosting and infrastructure providers required to operate and protect the website.

We do not sell personal data.

5. International transfers

Some technology providers may process data outside the EEA. Where applicable, recognised GDPR transfer mechanisms are used according to the provider and processing, such as adequacy decisions, the EU-US Data Privacy Framework for certified entities, or Standard Contractual Clauses.

6. Retention

Enquiries are retained for as long as needed to respond and manage the commercial or pre-contractual relationship. Data may then be blocked for applicable statutory limitation periods. Processing based on consent stops for future use when consent is withdrawn. Cookie choices are retained for 6 months.

7. Your rights

You may request access, rectification, erasure, restriction, portability, object to processing and withdraw consent without affecting prior lawful processing. Contact info@spain-costas.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD): aepd.es.

8. Cookies and updates

See our Cookie Policy for storage technologies and consent controls. This policy will be updated when processing activities or providers change.