Privacy policy

No Data Protection Officer has been appointed because none of the situations in article 37 GDPR applies. Privacy queries may be sent to the email address above.

• Controller: SEBASTIAN GIL TRADING S.L.
• Tax identification number (CIF): B82667320
• Registered office and tax address: Avenida de Canillejas a Vicálvaro 14 B, 28055 Madrid, Spain
• Registry details: Registro Mercantil de Madrid (Madrid Commercial Registry), volume 15.451, book 0, folio 70, section 8, sheet M-259567, entry 1
• Legal representative: Alberto Sebastián Gil
• Email for exercising your rights: alberto@sebastiangil.com
• Telephone: +34 629 234 269

The processing activities actually carried out through this website are described below:

• Contact form (contact page): data processed: name, email, telephone, subject and message. Purpose: to handle and answer your enquiry. Legal basis: your consent (art. 6.1.a GDPR). Retention: while the enquiry is handled and, afterwards, for the statutory limitation periods.
• Enquiry about a property (property page): data processed: name, email, telephone, message and property of interest. Purpose: to answer your information or viewing request. Legal basis: your consent (art. 6.1.a) and pre-contractual steps taken at your request (art. 6.1.b). Retention: up to one year after the last contact, unless a transaction is formalised.
• Alerts about future rental properties: data processed: first name, surname, telephone, email and comments. Purpose: to inform you about future rental availability. Legal basis: your consent (art. 6.1.a GDPR and art. 21 LSSI-CE). Retention: until you withdraw your consent or request erasure.
• Alerts about changes to a property: data processed: name, email and property of interest. Purpose: to inform you about price, status or availability changes. Legal basis: your consent (art. 6.1.a). Retention: until you withdraw your consent or request erasure.
• Download of property documentation: data processed: email, name if provided, property and document downloaded, IP address and approximate country or city. Purpose: to control access to documentation reserved for clients, prevent fraudulent use and understand real interest in each property. Legal basis: your consent (art. 6.1.a) and legitimate interest in protecting the documentation (art. 6.1.f). Retention: one year from the download.
• AI virtual assistant: data processed: the text of the questions you type and, if you include it, personal data in them. Purpose: to answer your enquiries about properties and services. Legal basis: your consent (art. 6.1.a). Retention: for the duration of the session; the content is not used to build commercial profiles.
• Registered users and administration area: data processed: name, email and access credentials. Purpose: to manage access to the company's internal areas. Legal basis: performance of a contractual or employment relationship (art. 6.1.b) and legitimate interest in security (art. 6.1.f). Retention: for the duration of the relationship and the statutory retention periods.
• Web analytics and campaign measurement: data processed: online identifiers, browsing data, pages visited and approximate IP address. Purpose: to compile usage statistics and measure the effectiveness of our advertising campaigns. Legal basis: your consent (art. 6.1.a). Retention: according to each cookie, with a maximum of 24 months for your consent decision.
• Direct contact by email, telephone or messaging: data processed: whatever you provide to us. Purpose: to handle the communication. Legal basis: consent or legitimate interest in replying to those who contact us (art. 6.1.f).
• Compliance with legal obligations (invoicing, accounting, authority requests): legal basis: legal obligation (art. 6.1.c), retained for the statutory periods (generally six years).

The legal bases applied are: your consent (art. 6.1.a GDPR), pre-contractual steps or performance of a contract (art. 6.1.b), compliance with legal obligations (art. 6.1.c) and the company's legitimate interest in security, fraud prevention and defence against claims (art. 6.1.f).

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Data is kept only for as long as necessary for each purpose and, afterwards, for the statutory limitation periods. The specific periods are set out in section 2 for each processing activity.

Where personal data includes images or documents, they are kept under the same conditions and deleted once the applicable period ends.

To provide the service we rely on the following providers, which act as data processors and access the data only on our instructions:

• Base44: website hosting, database, server functions and transactional email delivery.
• Supabase: database and storage of the site's files and images.
• Microsoft Clarity: analytics and heatmap tool, only if you accept analytics cookies.
• Google Ireland Ltd. (Google Ads): conversion measurement and advertising, only if you accept advertising cookies.
• YouTube (Google Ireland Ltd.): playback of videos embedded in property pages, which may set cookies when played.
• OpenStreetMap and the Leaflet library: map display. They do not set their own tracking cookies.
• Google Fonts: loading of the typefaces used in the site design.
• The email and messaging providers used to handle your requests.
• Public authorities, courts and tribunals, and law enforcement, where a legal obligation or request applies.

We do not disclose your data to third parties for commercial purposes other than those described.

International transfers: some of these providers are located outside the European Economic Area, mainly in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission (art. 46 GDPR) and, where appropriate, supplementary security measures.

No automated decisions producing legal effects concerning you are taken, and no profiling with such effects is carried out.

The site's virtual assistant generates automated informational answers: it is not an automated decision about your situation and does not replace professional advice. Answers may contain inaccuracies and have no contractual value.

You may exercise the rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent. You also have the right not to be subject to automated individual decisions.

To do so, write to alberto@sebastiangil.com or send a request by post to Avenida de Canillejas a Vicálvaro 14 B, 28055 Madrid, Spain, proving your identity (for example with a copy of your identity document). We will reply within one month, extendable to two months in complex cases.

If you consider that we have not properly handled your rights, you may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) (Spanish Data Protection Agency), C/ Jorge Juan 6, 28001 Madrid, or through its electronic office at www.aepd.es. You may also contact the supervisory authority of your country of habitual residence in the European Union.

This website is not aimed at children under 14 and we do not knowingly collect data from children under that age. If you are a parent or guardian and find that a minor has provided us with data, please contact us and we will delete it.

We apply reasonable technical and organisational measures to protect data against loss, unauthorised access, alteration or disclosure, including encrypted communications, access controls and limiting data to what is strictly necessary.

We may update this policy to reflect regulatory changes or new site features. The version in force is always the published one, showing the date of the last update.