How we process your personal data, in accordance with the GDPR (EU 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD).
Last updated: August 2026
At Consultores Infocasa the protection of your personal data is a priority. This policy explains what data we process, for what purpose and on what legal basis, for how long, with whom we share it and what rights you have.
We process the categories of data that you provide to us and that are necessary for the purpose of each relationship:
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Responding to enquiries and requests submitted through the form or by email or telephone. | Consent of the data subject (art. 6(1)(a)) and/or steps taken at the data subject's request prior to entering into a contract (art. 6(1)(b)). |
| Managing the professional relationship and providing the services engaged. | Performance of a contract or engagement (art. 6(1)(b)). |
| Complying with legal obligations (tax, accounting and anti-money-laundering). | Legal obligation (art. 6(1)(c)), in connection with Spanish Law 10/2010 and tax legislation. |
| Ensuring the security of the website and handling the exercise of data subject rights. | Legitimate interest of the controller (art. 6(1)(f)). |
| Sending our own informational or marketing communications, where applicable. | Consent (art. 6(1)(a)) or legitimate interest in respect of existing clients (art. 6(1)(f) and art. 21 LSSI). |
Data will be retained for as long as the relationship subsists and, once terminated, for the periods legally required to address possible liabilities. In particular: data from enquiries that do not result in a professional relationship will be kept for as long as necessary to handle them and for no more than twelve months; anti-money-laundering documentation will be kept for ten years (art. 25 of Law 10/2010); and tax and accounting data for the periods laid down in tax and commercial legislation.
Your data is not disclosed to third parties except where required by law. The following providers have access to it solely in order to provide their service to us and under the processing agreements required by article 28 GDPR:
| Processor | Location | Service provided |
|---|---|---|
| Netlify, Inc. | United States | Website hosting, and receipt and storage of contact form submissions. |
| Supabase, Inc. | United States | Database of the controller's internal client management system (CRM), in which your enquiry and its follow-up are recorded. |
| Arsys Internet, S.L.U. | Spain (EU) | Domain registration and corporate email service. |
In the course of a transaction, and where necessary for its performance, data may be disclosed to notaries, public registries, financial institutions, valuers and public authorities. As an obliged entity, we may report information to the Spanish Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences (SEPBLAC) where legislation so requires, in which case the data subject is not to be informed (art. 24 of Law 10/2010).
Two of the processors listed above are established in the United States, so that their involvement entails an international transfer of data within the meaning of Chapter V GDPR. The recipient and the safeguard relied upon for each transfer are set out below:
| Recipient | Data transferred | Safeguard (arts. 45 and 46 GDPR) |
|---|---|---|
| Netlify, Inc. (United States) | Connection data of site visitors and the entire content of contact form submissions. | The provider's certification under the EU-U.S. Data Privacy Framework, relying on the European Commission adequacy decision of 10 July 2023 (art. 45 GDPR) and, additionally, the standard contractual clauses of Implementing Decision (EU) 2021/914 incorporated into the data processing agreement (art. 46(2)(c) GDPR). |
| Supabase, Inc. (United States) | Identification and contact data and the content of the enquiry, recorded in the controller's internal CRM. | Standard contractual clauses of Implementing Decision (EU) 2021/914 incorporated into the data processing agreement entered into with the provider (art. 46(2)(c) GDPR), together with supplementary technical measures of encryption in transit and at rest and role-based access control. |
You may request a copy of these safeguards, or information as to where they have been made available, at the email address given in section 1. The remaining processors listed above process data within the European Economic Area.
Neither the typefaces nor the images on this site are loaded from third-party servers: every resource is served from this domain, so that simply browsing the site does not communicate your IP address to external font or image providers.
You may exercise the following rights free of charge by writing to info@consultoresinfocasa.es, stating the right you wish to exercise and enclosing a copy of a document evidencing your identity:
If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es.
The user warrants that the data provided is accurate and undertakes to notify any change. Where the user provides third-party data, the user must have informed those third parties beforehand and obtained their consent to the disclosure.
The controller has adopted appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with article 32 GDPR, in order to protect data against loss, alteration or unauthorised access.
This policy may be updated to reflect legislative developments or changes to our services. Periodic review is recommended; the date of the last update appears at the beginning of this document.
