How we handle your data

We only process the following data:

• Contact details: name, email, phone number, place of residence
• Wishes and budget: preferred region, type of property, indicative budget, purchase timing
• Communication: emails, WhatsApp messages, phone notes
• Purchase file: during active guidance also your NIE, financing documents and legal papers
• Website use: our own visitor statistics without cookies, plus what Google, Meta and Ahrefs receive (see Who we share data with)
• Form abuse protection: an encrypted representation (hash) of your IP address, from which the address itself cannot be derived

We only use your data for:

• Answering contact requests and information enquiries
• Scheduling and guiding the introductory meeting
• Carrying out property searches, viewing trips and purchase guidance
• Communication during an ongoing engagement
• Sending our newsletter (only after explicit sign-up)
• Meeting legal obligations (retention obligation, tax)
• Protecting our forms against abuse
• Seeing how the site is used, so we can improve it
• With your consent: measuring Costa Select ads and showing them to previous visitors

We never sell your data to third parties and make no automated decisions about you. Profiling only happens with your consent for advertising: Google Ads and Meta remember that you visited the site, so they can show you Costa Select ads.

We process your data on the basis of: (1) your explicit consent for contact forms and the newsletter, (2) performance of the contract once you become a client, (3) legitimate interest for client administration and quality control, and (4) legal obligations such as the tax retention obligation.

For our services we only share data when it is necessary, and then under a data processing agreement:

• Spanish notary and lawyer during an active purchase
• Mortgage adviser or bank at your explicit request
• Technical surveyor and valuer during due diligence
• IT suppliers (email, CRM, hosting) under a data processing agreement

For a purchase we only share the data it requires, never without your knowledge.

With your consent in the cookie banner, Google and Meta also receive data about your visit, such as which pages you view, whether you submit a form and which buttons you click: Google Analytics for statistics, Google Ads and Meta for advertising. For statistics, Ahrefs only counts page views, without cookies. Google and Meta recognise your browser by a cookie and process the data as independent parties, so without a data processing agreement, also outside the EU. Without consent, Google still receives reports of what you do on the site, but without cookies and without a code that recognises you. More in our cookie statement.

If you have consented to advertising and you arrive through a Google ad, we store that ad's click ID with your enquiry. We pass this click ID, together with the time, the type of form, the page and an internal enquiry number, to Google via Zapier, to measure which ads lead to an enquiry. Your name, email address and phone number are not included. Zapier acts as our processor, under a data processing agreement, and processes the data in the United States under the EU-U.S. Data Privacy Framework.

Photos of the homes in our listings are loaded directly from the servers of our property database. Like any website that serves an image, those servers see your IP address. They set no cookies.

We keep data no longer than necessary:

• Contact requests without follow-up: 12 months
• Client files during and after a purchase: 7 years (statutory tax retention obligation)
• Newsletter subscribers: until you unsubscribe
• Our own visitor statistics, cookieless; raw records 90 days, then only daily totals
• Form abuse protection: a few hours

Under the General Data Protection Regulation (GDPR) you always have the right to:

• See what data we hold about you
• Request correction or completion of incorrect data
• Request erasure ("right to be forgotten")
• Restrict the processing or object to it
• Receive your data in a readable file (data portability)
• Withdraw consent at any time, for the newsletter and for cookies (via Cookie settings at the bottom of every page)
• Lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority)

Email your request to privacy@costaselect.com and you will receive a reply within four weeks.

We take appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and limited access to personal data. In the event of a data breach that poses a risk to your rights and freedoms, we report it to the Autoriteit Persoonsgegevens within 72 hours and inform you where this is required.

We may update this privacy statement from time to time, for example when regulations or our services change. The most current version is always available on this page, with the date of the latest change at the top. In the event of significant changes we inform subscribers by email.