Privacy policy

Who processes your data

Data controller: Ester Bautista Calvo (Fincas Bautista), Tax ID 45787034Z, C/ Dr. Fleming 61, entresuelo, 08860 Castelldefels (Barcelona). Privacy contact: hola@fincasbautista.es.

We are not required to appoint a data protection officer (DPO). [REVISAR ABOGADO]

What we use your data for

Each form and private area has its own processing activity. Here they are one by one:

Website contacts and requests

Purpose: Replying to your messages and requests (property information, valuation, sale, study for your community, mortgage help, insurance quote, claim report) and the follow-up you ask for.
Legal basis: Your consent (Art. 6(1)(a) GDPR) and pre-contractual steps at your request (Art. 6(1)(b)). To share your data with banks or credit intermediaries, your explicit consent.
How long: While we handle your request and up to 2 years after the last contact if no transaction takes place; if it does, for the relationship and the legal periods (10 years for anti-money-laundering due diligence, Law 10/2010). [REVISAR ABOGADO]
Who else sees it: Service providers under a processing agreement. If you ask: notaries, banks or credit intermediaries, insurers. Public authorities when required by law.

Property alerts and client account

Purpose: Emailing you new properties that match your search and saving your favourites.
Legal basis: Your consent (Art. 6(1)(a) GDPR), confirmed by double opt-in from your email.
How long: Until you unsubscribe (one click in any email). Unconfirmed alerts are deleted after 30 days.
Who else sees it: Service providers (web hosting in Spain, email) under a data processing agreement. We do not share your data with third parties unless required by law.

Owners’ portal (My community)

Purpose: Approving your registration as an owner or tenant, handling your incidents and requests, updating you on their status and giving you access to your community’s documents, receipts, notices and votes.
Legal basis: Performance of your community’s management contract (Art. 6(1)(b) GDPR) and the legal obligations of horizontal property law (Art. 6(1)(c); Book Five of the Catalan Civil Code). [REVISAR ABOGADO]
How long: While you are an owner or resident and we manage your community; afterwards, blocked for the legal retention periods for community records. [REVISAR ABOGADO]
Who else sees it: Contractors and suppliers who fix an incident (only the data needed for the repair), the community and its board where appropriate, our property-management software and the hosting and notification providers (email, and WhatsApp or SMS if you enable them).

Agents and sales staff

Purpose: Managing the employment or commercial relationship with our team, their panel access, client assignment and commission calculation.
Legal basis: Performance of the contract (Art. 6(1)(b) GDPR) and employment, tax and social security obligations (Art. 6(1)(c)). Panel activity logs are based on our legitimate interest in security (Art. 6(1)(f)).
How long: During the relationship and then the legal periods (4 years for employment and tax matters; 6 years for commercial records). [REVISAR ABOGADO]
Who else sees it: Payroll and tax advisers, banks for payments, tax authorities and Social Security. [REVISAR ABOGADO]

Partners and suppliers

Purpose: Managing the partnership agreement, the client referrals you send us, work orders, their documents and fee settlements.
Legal basis: Performance of the partnership agreement (Art. 6(1)(b) GDPR) and tax and commercial obligations (Art. 6(1)(c)).
How long: For the duration of the partnership and then 6 years (Commercial Code) and 4 years for tax purposes. [REVISAR ABOGADO]
Who else sees it: Tax advisers, banks for payments and tax authorities. The data of the clients you refer is only seen by our office.

Job applications

Purpose: Assessing your application (and CV, if attached) for current or future recruitment processes.
Legal basis: Your consent (Art. 6(1)(a) GDPR).
How long: 12 months from when you send it, unless you ask us to delete it sooner. [REVISAR ABOGADO]
Who else sees it: Service providers (web hosting in Spain, email) under a data processing agreement. We do not share your data with third parties unless required by law.

Cookie preferences

Purpose: Remembering and proving which cookies you accepted or rejected.
Legal basis: Legal obligation to be able to prove consent (Art. 6(1)(c) GDPR and Art. 22(2) LSSI).
How long: 12 months; then we ask you again.
Who else sees it: Service providers (web hosting in Spain, email) under a data processing agreement. We do not share your data with third parties unless required by law.

Your rights

You can ask at any time for access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent without affecting prior processing. Write to hola@fincasbautista.es stating which right you are exercising; if we cannot identify you, we will ask you to prove your identity. We reply within one month.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Consent records

When you accept the privacy policy, cookies or an agreement, we store the date, the IP address you used, the exact text you accepted and its version, so we can prove it (Art. 7(1) GDPR). We keep this proof while we process your data and for the subsequent limitation periods. [REVISAR ABOGADO]

Security and transfers

We apply appropriate technical and organisational measures: encrypted connection (HTTPS), password access with two-factor authentication for administrators, role-based permissions, activity logs and daily backups.

Your data is hosted in the European Union. Only if you choose to message us on WhatsApp, or if we enable analytics with your consent, may US providers (Meta, Google) certified under the EU-US Data Privacy Framework be involved. [REVISAR ABOGADO]

Minors and third-party data

Our services are aimed at people over 18. If you give us someone else’s data (for example, a co-owner), you must have informed them first.