1. Data controller
Controller: Jaime Sureda Alvarez · Spanish NIF 33398737T
Professional address: Urb. Los Naranjos de Marbella 77, 29660 Marbella, Málaga, Spain.
Privacy contact: info@jaimesureda.com
This policy applies to data received through the contact channels on jaimesureda.com and during the professional real estate relationship.
2. Data processed and its source
The following data may be provided directly by the person concerned or their representative:
- name and contact details;
- enquiry content and purchase, sale or investment preferences;
- address, characteristics, photographs and property documents voluntarily supplied;
- identification, financial and contractual details required when a professional relationship begins;
- identity verification and compliance information required under anti-money-laundering rules where applicable.
The website infrastructure may generate technical connection data such as IP address, date, browser and security logs. The website currently has no forms, user profiles or advertising tracking systems.
3. Purposes and legal bases
| Enquiries | Answer requests received by WhatsApp or email, provide information, arrange viewings and prepare valuations. Legal basis: pre-contractual steps requested by the person and, where appropriate, legitimate interest in responding to professional communications. |
|---|---|
| Real estate service | Manage acquisition, advice, brokerage, marketing and transaction documents. Legal basis: performance of the contractual or pre-contractual relationship. |
| Legal obligations | Comply with tax, accounting and consumer rules and, where the activity is covered, anti-money-laundering and counter-terrorist-financing obligations. Legal basis: compliance with legal obligations. |
| Website security | Prevent abuse, maintain availability and diagnose incidents through infrastructure logs. Legal basis: legitimate interest in protecting the website and services. |
| Marketing | News or promotional proposals will only be sent with prior consent or where another legal permission applies, always with a simple, free way to object. |
No automated decisions or profiles producing legal or similarly significant effects are made.
4. Retention periods
- Enquiries with no engagement: for the time required to reply and no longer than 12 months after the last interaction, unless retention is needed to handle a claim.
- Clients and transactions: during the relationship and then securely restricted for applicable liability, accounting and tax limitation periods.
- Anti-money laundering: where applicable, required documents are kept for ten years; five years after the end of the relationship or transaction, access is restricted as required by law.
- Marketing: until consent is withdrawn or the right to object is exercised.
After the relevant period, data is securely deleted or kept blocked where required by law.
5. Recipients, providers and transfers
Personal data is not sold. Where necessary and legally justified, it may be disclosed to notaries, registries, financial institutions, legal or tax advisers, technical professionals, other transaction parties and public authorities, courts, law enforcement bodies or SEPBLAC.
The following technology providers support the service:
- GitHub Pages, for static website hosting;
- Cloudflare, for domain services and email routing;
- Proton Mail (Proton AG), as the final mailbox to which Cloudflare forwards professional email;
- WhatsApp Business, when a person chooses to start a conversation through that platform.
GitHub and Cloudflare may process data outside the European Economic Area. Where they do, processing is subject to their terms and based on an adequacy decision, standard contractual clauses or another valid GDPR safeguard. Proton Mail is operated by Proton AG in Switzerland, which the European Commission recognises as providing an adequate level of data protection.
Received correspondence is stored in the Proton Mail account under the applicable settings and retention policy. The professional contact register is also stored on a local hard drive controlled by the controller; no cloud CRM is currently used.
6. Your rights
You may request access, rectification, erasure, restriction, objection and portability, and may withdraw consent without affecting the lawfulness of previous processing.
Send requests to info@jaimesureda.com or to the professional address, stating the right you wish to exercise. Additional information to verify identity will only be requested where there are reasonable doubts.
If you believe your rights have not been respected, you may complain to the Spanish Data Protection Agency (AEPD).
7. Security, third parties and changes
Reasonable measures are applied to prevent unauthorised access, loss, alteration or disclosure. Users should avoid sending unnecessary documents through messaging services and report any relevant incident.
Clicking a WhatsApp or other external-service link leaves this website, and the provider then processes data under its own policy. This policy may be updated following regulatory or service changes; the current date will always appear at the top.