Privacy Policy

We have updated our Privacy Policy based on the requirements of the European General Data Protection Regulation (GDPR), applicable as of May 25, 2018.

Object of Data Protection

The object of data protection is the protection of personal data. This is any information relating to an identified or identifiable natural person (a so-called data subject). This includes information such as name, postal address, email address, or telephone number, but also other information that arises in the context of using our online services, in particular information about the beginning, end, and scope of use as well as the transmission of your IP address.

1. Purposes and Legal Basis of Data Processing

We process personal data in accordance with legal requirements, even if in individual cases a different legal basis may be relevant. The provision of personal data by you may be required by law or contract or may be necessary for the conclusion of a contract.

Usage of our website is generally possible without registering. Use of individual services and functions may require prior registration or provision of information. Even without registration, personal data may still be processed.

1.1 Fulfilment of Contractual and Pre-contractual Obligations

We process your personal data if this is necessary for:

responding to property inquiries,
scheduling property visits,
preparing or executing rental or purchase agreements,
communicating with you regarding property transactions, and
providing related services such as property management or valuation.

The processing takes place on the basis of Article 6(1)(b) GDPR.

1.1.1 Contact and Inquiry Forms

When you use our contact form or email us, the following categories of personal data may be processed:

Name,
Email address,
Telephone number,
Your individual message.

Without this data, we may not be able to properly handle your request.

1.1.2 Newsletter and Property Alerts

You can register to receive newsletters or property alerts (e.g., when a property that matches your criteria is available). Registration requires your name and email address. Consent is collected via the double opt-in procedure. You can unsubscribe at any time.

1.2 Compliance with Legal Obligations

We may process your personal data in order to comply with legal obligations (e.g. tax laws, anti-money laundering laws). The processing is based on Article 6(1)(c) GDPR.

1.3 Safeguarding Legitimate Interests

We may also process your personal data to protect our legitimate interests, provided that your rights do not override such interests. This includes:

Improving our services and website,
Risk management and compliance,
Ensuring technical security of our systems,
Internal administrative purposes,
Marketing our real estate services in compliance with applicable laws.

1.4 Consent

Where required (e.g. for newsletters, photos of events, testimonials), we process your data based on your consent (Article 6(1)(a) GDPR). You may revoke your consent at any time.

2. Cookies and Comparable Technologies

Our website uses cookies and similar technologies. Some are technically necessary (e.g. to remember language settings or session management). Others may be used with your consent for analysis, marketing, or personalization. You can manage your preferences in our [Cookies Policy].

3. Integrated Third-party Services

We may integrate third-party services such as:

Map services (e.g., Google Maps for property locations),
Video hosting (e.g., virtual tours),
Social media links.

When using such services, the privacy policies of those providers apply.

4. Recipients of Personal Data

Personal data may be shared with:

Service providers (e.g. IT hosting, CRM systems, notaries, property management companies),
Public authorities (e.g. tax authorities, registries, compliance obligations),
Private partners (e.g. contractors, cleaning or maintenance providers, where relevant to the service).

5. Data Processing in Third Countries

If personal data is transferred outside the EU/EEA, we ensure adequate safeguards in accordance with GDPR.

6. Storage Duration and Deletion

We keep data only as long as necessary and then securely delete/anonymize it:

Enquiries with no engagement: up to 12 months.
Contracts/transactions/relocation files: Spanish legal terms typically require 6 years (Commercial Code) and 4 years (Tax). For AML documents, up to 10 years where applicable.
Marketing consents: until you unsubscribe or withdraw consent.
Technical logs: short, security-driven periods (normally ≤12 months).

8. Rights of the data subject Right to information: You have the right to obtain information about the data we have stored about you. Right of correction and deletion: You can demand that we correct incorrect data and – insofar as legal requirements are met – delete your data. Restriction of processing: You may request that we restrict the processing of your data, provided that legal requirements are met. Data portability: If you have provided us with data on the basis of a contract or consent, you may, if legal requirements are met, demand that you receive the data you have provided in a structured, common, and machine-readable format or that we transfer it to another controller.

Objection: You have the right to object to the processing of data by us at any time for reasons arising from your particular situation, insofar as this is based on the protection of legitimate interests. If you exercise your right to object, we will cease processing unless we can demonstrate compelling legitimate grounds for further processing which override your rights and interests.

Objection to direct marketing: If we process your personal data for the purpose of direct marketing, you have the right to object to our processing of your data for this purpose at any time. If you exercise your right to object, we will stop processing your data for this purpose. Revocation of consent: If you have given us consent to process your personal data, you can revoke this consent at any time with effect for the future. The lawfulness of the processing of your data, until it is revoked, remains unaffected.

Right to lodge a complaint with a supervisory authority: You can also lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of your data violates applicable law. To do so, you can contact the supervisory authority responsible for your place of residence or country or the supervisory authority responsible for us.

Contacting us and exercising your rights: Furthermore, if you have any questions about the processing of your personal data and your rights as a data subject, you can contact us at stasiaestate@api.es