Privacy Policy
Last updated: [to be confirmed]
This Privacy Policy explains how Clear Ally Marbella (“we”, “us”, “our”) collects, uses, and protects personal data when you visit this Website or interact with us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Spanish Organic Law on Data Protection (LOPDGDD), and the Spanish Law on Information Society Services (LSSI-CE).
1. Who we are
Clear Ally Marbella
[Registered company name, address, CIF, VAT and Mercantile Registry details to be confirmed with Olga before publishing]
Email: [email to be confirmed with Olga]
We are the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer, as our processing activities do not meet the criteria set out in Art. 37 GDPR. For all data-protection enquiries, contact us at [email to be confirmed with Olga].
2. What data we collect
We collect personal data in three ways:
a) Information you give us directly
When you fill out a contact or enquiry form, book a discovery call, or message us via WhatsApp, email, or phone, we collect:
- Name
- Email address
- Phone number
- Country of residence (where provided)
- Property preferences, budget, and timeline (where provided)
- Any other information you choose to share in your message
b) Information collected automatically when you visit our website
- IP address and approximate location
- Browser type, device type, and operating system
- Pages viewed, time on site, referring website
- Interactions with our website (e.g. forms started, links clicked)
- Cookies and similar technologies (see section 8 below)
c) Information from third parties
Where you reach us via referral or paid advertising (Google Ads, Meta Ads), we may receive data such as the click identifier and the campaign that led you to us, used to measure advertising performance.
3. Why we use your data and the legal basis
| Purpose | Legal basis |
|---|---|
| Respond to your enquiry, schedule discovery calls, send curated property shortlists | Performance of a contract / pre-contractual measures (Art. 6(1)(b) GDPR) |
| Send service-related communications (appointment confirmations, viewing details) | Performance of a contract (Art. 6(1)(b) GDPR) |
| Improve our website and services through analytics | Consent (Art. 6(1)(a) GDPR), only with your acceptance via the cookie banner |
| Show you relevant advertising on Google, Meta, and other platforms | Consent (Art. 6(1)(a) GDPR), only with your acceptance via the cookie banner |
| Send marketing emails or newsletters (where you opt in) | Consent (Art. 6(1)(a) GDPR) |
| Comply with legal, accounting, or tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Defend our legitimate business interests (e.g. security, fraud prevention) | Legitimate interests (Art. 6(1)(f) GDPR) |
You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
4. How long we keep your data
| Data type | Retention period |
|---|---|
| Enquiry / contact form submissions | Up to 24 months after last contact, then deleted or anonymised |
| Active client relationship data | For the duration of the engagement and 5 years after, to meet legal record-keeping obligations |
| Cookie and analytics data | Up to 14 months (Google Analytics default) |
| Marketing consent records | Until consent is withdrawn |
| Data required for tax or legal compliance | 6 years (Spanish Commercial Code) |
5. Who we share your data with
We do not sell or rent your personal data. We share it only with:
Service providers (data processors) acting on our instructions:
- Pipedrive, CRM (lead and client management). Pipedrive may process data in the EU or US under Standard Contractual Clauses.
- Google (Analytics, Ads, Tag Manager), analytics and advertising. Data may be transferred to the United States under EU-US Data Privacy Framework safeguards.
- Meta Platforms (Facebook, Instagram), advertising platform. Transfers covered by Standard Contractual Clauses.
- Cloudflare, website security and content delivery (EU/global infrastructure).
- n8n / hosting providers, webhook automation and form processing.
- Email and communication providers, to send and receive correspondence.
Where required: government authorities, courts, or regulators if legally compelled.
Professional advisors (legal, accounting) under confidentiality.
We never share your data with third parties for their own marketing purposes.
6. International transfers
Some of our service providers are located outside the European Economic Area, primarily in the United States. Where this applies, transfers are protected by:
- The EU-US Data Privacy Framework (where the recipient is certified), or
- Standard Contractual Clauses approved by the European Commission, supplemented by additional measures where appropriate.
You may request a copy of the safeguards in place by contacting us.
7. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data (“right to be forgotten”)
- Restrict processing under certain circumstances
- Object to processing based on legitimate interests
- Data portability, receive your data in a structured, machine-readable format
- Withdraw consent at any time
- Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or your local supervisory authority
To exercise any of these rights, email [email to be confirmed with Olga] with your request and proof of identity. We will respond within 30 days.
Automated decision-making. We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you.
8. Cookies
We use cookies and similar technologies (pixels, local storage) to make the Website work, measure performance, and deliver relevant advertising.
Categories
- Strictly necessary, required for the Website to function. Cannot be switched off. Includes consent preferences, security, and basic navigation.
- Analytics, help us understand how visitors use the Website. Run only with your consent.
- Marketing, used to deliver relevant advertising on Google and Meta, and to measure campaign performance. Run only with your consent.
Specific tools
| Provider | Purpose | Category | Retention |
|---|---|---|---|
| Silktide Consent Manager | Stores your cookie consent preferences | Strictly necessary | 12 months |
| Google Analytics 4 | Measures website traffic and behaviour | Analytics | Up to 14 months |
| Google Ads (conversion linker) | Measures advertising performance and conversions | Marketing | Up to 90 days |
| Google Tag Manager | Loads and manages other tags listed here | Strictly necessary | Session |
| Meta Pixel (Facebook/Instagram) | Measures advertising performance and serves remarketing | Marketing | Up to 90 days |
| Cloudflare | Bot protection and security | Strictly necessary | Up to 30 days |
We may add or change tools over time. The categories above remain stable.
Managing your preferences
The cookie banner appears on your first visit and lets you accept or decline each category. You can change your preferences at any time via your browser’s cookie settings or by contacting us. To opt out of Google Analytics specifically: tools.google.com/dlpage/gaoptout.
International transfers of cookie data (e.g. to Google or Meta in the United States) are covered by the safeguards described in section 6.
9. Children
Our services are intended for adults aged 18+. We do not knowingly collect data from minors. If you believe we hold data on a minor, please contact us and we will delete it promptly.
10. Security
We use technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), access controls, and limiting data access to those who need it. No system is fully secure, but we work to protect your data against loss, misuse, and unauthorised access.
11. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. The “Last updated” date at the top will reflect the most recent revision. Material changes will be notified via the website or by email where appropriate.
12. Contact
For any questions about this Privacy Policy or how we handle your data:
Email: [email to be confirmed with Olga]
Post: [registered office address to be confirmed with Olga]