Legal
Privacy policy
Last updated: October 2026
Fields shown as [PLACEHOLDER] must be completed with the company’s verified details, and the text reviewed by a qualified Spanish lawyer, before publication.
1. Data controller
- Controller: [COMPANY LEGAL NAME, S.L.] (“CostaVeyra Renovations”)
- NIF/CIF: [NIF/CIF]
- Address: [REGISTERED ADDRESS, SPAIN]
- Privacy contact: [PRIVACY EMAIL]
2. Data we collect
- Project enquiry form: name, email, phone/WhatsApp (optional), preferred language, property location and type, ownership status, project type, budget range, desired timing and the description you provide.
- Attribution data: the page where you arrived, the referring website and campaign parameters (such as utm_source or gclid), so we can understand how enquiries reach us.
- Usage data: only if you accept analytics cookies — see the cookie policy.
- Direct communications: emails, calls or WhatsApp messages you send us.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Reviewing your enquiry and replying to you | Steps at your request prior to a contract (Art. 6.1.b) and your consent (Art. 6.1.a) |
| Sharing your project details with the architects, contractors and specialists involved in preparing and delivering your project | Your consent, given in the form (Art. 6.1.a) |
| Internal qualification and prioritisation of enquiries | Legitimate interest in organising our service (Art. 6.1.f). It does not produce legal effects on you. |
| Occasional guidance emails, only if you opt in | Consent (Art. 6.1.a) |
| Website analytics and campaign measurement | Consent via the cookie banner (Art. 6.1.a; Art. 22.2 LSSI-CE) |
You may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
4. Recipients
- Project professionals (architects, contractors, designers, installers) involved in preparing and delivering your project — only with your consent and only the information needed for their part of the work. Where they process your data for their own purposes, they act as independent controllers.
- Service providers acting as processors: website hosting and form handling (Netlify, Inc.), analytics (Google Ireland Ltd., if you consent), email and CRM tools [CRM / EMAIL PROVIDER].
- Public authorities where required by law.
5. International transfers
Some providers (such as Netlify, Inc. and Google) may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
6. Retention
Enquiry data is kept for as long as needed to handle your project and, if no relationship follows, for a maximum of [24] months, after which it is deleted or anonymised — unless longer retention is required to meet legal obligations. Newsletter data is kept until you unsubscribe.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by writing to [PRIVACY EMAIL]. If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the supervisory authority of your country of residence.
8. Security
We apply appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and restricted access to enquiry data.