How we handle your data

We only process data that you share with us yourself or that is necessary for our services:

• Contact details: name, email, phone number, place of residence
• Wishes and budget: preferred region, type of property, indicative budget, purchase timing
• Communication: emails, WhatsApp messages, phone notes
• Purchase file: during active guidance also your NIE, financing documents and legal papers
• Website use: anonymised statistics

We use your data solely to carry out our services:

• Answering contact requests and information enquiries
• Scheduling and guiding the introductory meeting
• Carrying out property searches, viewing trips and purchase guidance
• Communication during an ongoing engagement
• Sending our newsletter (only after explicit sign-up)
• Meeting legal obligations (retention obligation, tax)

We never sell your data to third parties. We do not use your data for profiling or automated decision-making.

We process your data on the basis of: (1) your explicit consent for contact forms and the newsletter, (2) performance of the contract once you become a client, (3) legitimate interest for client administration and quality control, and (4) legal obligations such as the tax retention obligation.

We only share data when it is necessary for our services, and always under a data processing agreement:

• Spanish notary and lawyer during an active purchase
• Mortgage adviser or bank at your explicit request
• Technical surveyor and valuer during due diligence
• IT suppliers (email, CRM, hosting) under a data processing agreement

We only share data that is needed for the purchase, never without your knowledge. We do not share data with marketing platforms.

We keep data no longer than necessary:

• Contact requests without follow-up: 12 months
• Client files during and after a purchase: 7 years (statutory tax retention obligation)
• Newsletter subscribers: until you unsubscribe
• Visitor statistics via Plausible: aggregated and not traceable to individuals (cookieless, no personal data)

Under the General Data Protection Regulation (GDPR) you always have the right to:

• See what data we hold about you
• Request correction or completion of incorrect data
• Request erasure ("right to be forgotten")
• Restrict the processing or object to it
• Receive your data in a readable file (data portability)
• Withdraw consent for the newsletter at any time
• Lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority)

Email your request to privacy@costaselect.com and you will receive a reply within four weeks.

We take appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and limited access to personal data. In the event of a data breach that poses a risk to your rights and freedoms, we report it to the Autoriteit Persoonsgegevens within 72 hours and inform you where this is required.

We may update this privacy statement from time to time, for example when regulations or our services change. The most current version is always available on this page, with the date of the latest change at the top. In the event of significant changes we inform subscribers by email.