Privacy, clearly explained.

Last updated: 10 October 2026

Here you can find out how Buena Vista Crew processes personal data: when you visit our website, enquire about properties, communicate with us, receive our newsletter or apply to work with us. We also explain which analytics and advertising services we use and how you can exercise your rights.

Controller and privacy contact

The controller responsible for the processing described below is Buena Vista Crew S.L., Carrer des Llombards 18, 07650 Santanyí, Balearic Islands, Spain. You can contact us by telephone on +34 601 880 152 or by email at crew@buena-vista-crew.com.

You can use this email address for privacy enquiries, to withdraw consent or to exercise your rights. Please describe your request in enough detail for us to identify the processing concerned.

Scope and legal bases

This information covers our website and related business contacts. Our company is based in Spain; our services and advertising are aimed particularly at people in Europe, with a focus on Germany, as well as prospective customers in the United States.

Our processing is governed by the General Data Protection Regulation, or GDPR. Relevant Spanish legislation and, where applicable, German requirements for accessing terminal equipment and sending electronic advertising must also be taken into account; additional US rights are explained separately. (GDPR, Spanish LSSI, Section 25 TDDDG, Section 7 UWG)

Depending on the purpose, the following legal bases may apply:

• Consent: Article 6(1)(a) GDPR, particularly for analytics, advertising measurement and additional voluntary processing that require consent.
• Contract and pre-contractual steps: Article 6(1)(b) GDPR, where processing is necessary for a contract with you or for pre-contractual steps taken at your request.
• Legal obligations: Article 6(1)(c) GDPR, particularly for applicable statutory record-keeping and retention obligations.
• Legitimate interests: Article 6(1)(f) GDPR, for example to operate a secure website, handle general business enquiries and protect legitimate claims, provided that your interests and rights do not override those interests.

The conditions for these legal bases are set out in Article 6 GDPR. A legal basis for processing personal data does not automatically replace any additional permission required to send email advertising or access your device. (Section 7 UWG, Section 25 TDDDG, LSSI)

You can use our website for information without consenting to optional analytics and advertising services. To handle an enquiry, viewing, application or requested service, however, we need the information required for that purpose; without it, we may be unable to deal with your request.

Recipients and international data transfers

We use the service providers described in this policy for website operation, content management, communications, CRM, newsletters and advertising measurement. A distinction must be made between technical processing on our behalf, joint controllership and independent processing by platform providers.

Where a provider acts solely on our behalf, processing must be governed in accordance with Article 28 GDPR; jointly determined processing is subject to Article 26 GDPR. These roles relate to specific processing operations and do not necessarily apply to every service a provider offers. (GDPR)

Some service providers or affiliated companies process data outside the European Economic Area, particularly in the United States. Hosting a server in the EU or using our own internet address does not rule out subsequent transfers to third countries.

Transfers to third countries are subject to Articles 44 et seq. GDPR: an applicable adequacy decision or another lawful transfer mechanism is required, such as standard contractual clauses with supplementary safeguards where necessary. An adequacy decision covering certified US companies may only be relied upon if the particular recipient and processing are actually covered. (GDPR)

Third countries may have different rules on access by public authorities and the enforcement of data subject rights. You can ask us for information about the safeguards used for a particular transfer and, where applicable, a copy of the relevant contractual clauses.

Hosting, website content and email infrastructure

Website operation and technical access data

When you access our website, technical data is processed to deliver the requested content and identify attacks or errors. This includes, in particular, your IP address, access time, requested address or file, HTTP status, volume of data transferred, browser, operating system and, where applicable, the previously visited page as the referrer.

We use this data to provide the website and maintain its stability and security. The legal basis is Article 6(1)(f) GDPR, reflecting our interest in providing a functional and secure online service.

Our website uses TLS encryption for transmission between your browser and our website. This encryption protects that transmission path; it does not mean that recipients involved in subsequent processing receive no data.

Vercel

We use Vercel to host and technically deliver our website. The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA; Vercel describes its role as a processor for customer data processed on a customer's instructions. (Vercel Privacy Notice)

Vercel receives the connection and request data needed to deliver and secure the website. According to the provider's information, processing may take place in the United States and other countries; the requirements for third-country transfers explained above also apply here. (Vercel Privacy Notice)

Sanity

We use Sanity as a content management system to manage and deliver our website content and media. Sanity identifies Sanity AS and Sanity US Inc. as the companies involved and describes itself as a processor for content uploaded by customers. (Sanity Privacy Policy)

Depending on the delivery method, technical access data may be generated within Sanity's infrastructure when content is retrieved. This does not guarantee processing exclusively within the EU; Sanity describes international processing and the associated safeguards in its Privacy Policy.

Hetzner and email communications

Our email mailboxes are hosted by Hetzner in Germany. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. (Hetzner Data Privacy Policy) Email hosting involves the processing of email addresses, message content, attachments and technical sending and receiving data.

Ordinary business email communications and property brochure delivery are handled through Propstack; we use Mailchimp exclusively for newsletters. We explain the purposes and retention rules for these separate processing activities in their respective sections.

Technical logs and backups

There is no single deletion period applying to our own technical logs across all the systems we use. The relevant criteria are their necessity for operation, troubleshooting and security and, where applicable, a specific incident whose investigation or legal resolution has not yet been completed.

Backups, version histories and cached content may follow different technical deletion cycles from actively used data. They do not create a separate entitlement to continue using data independently of its original purpose.

Cookies, local storage and Usercentrics

Your choices

We use cookies and similar technologies, such as Local Storage, for website functions, privacy settings and the analytics and marketing services described below. The lifetime of a locally stored identifier is distinct from the retention of data already transmitted to a provider.

Storage and access that are not strictly necessary require consent; statutory exceptions apply to strictly necessary functions that you have expressly requested. Relevant provisions include Article 22(2) LSSI and, where applicable, Section 25 TDDDG; subsequent processing of personal data also requires a legal basis under the GDPR. (LSSI, Section 25 TDDDG)

You can change your choices or withdraw consent for the future at any time through our website's privacy settings. These settings also provide service-specific information about the storage technologies used.

You can also delete or restrict cookies and website data through your browser. This does not automatically delete data already held by us or a provider; the options described in the section on your rights apply to that data.

Consent management with Usercentrics

We use Usercentrics to obtain, manage and document your privacy choices. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. (Usercentrics Privacy Policy) The data processed includes your choices, changes and withdrawals, timestamps, the version of the consent notice displayed, an identifier for allocation, and necessary browser, device and connection information.

Your consent status is stored locally so that the website can take account of your choice. Consent records are processed separately; deleting a local cookie therefore does not automatically remove the corresponding record.

The documentation of required consent records is based on Article 6(1)(c), in conjunction with Articles 5(2) and 7(1), GDPR. The relevant statutory exceptions apply to strictly necessary local storage used to implement your choice. (GDPR, Section 25 TDDDG, LSSI)

Property favourites

When you mark properties as favourites, the identifiers of the selected properties are saved in your browser's Local Storage under bvc-property-favorites. This allows you to retrieve your shortlist on a later visit using the same browser.

This storage serves the function you have requested and is not used for a separate advertising analysis. You can remove individual favourites or delete the stored website data in your browser.

Protecting our forms with Cloudflare Turnstile

We use Cloudflare Turnstile, provided by Cloudflare, Inc., USA, to limit automated access, spam and abusive form submissions. In particular, this may involve processing IP addresses, browser identifiers, technical connection characteristics including TLS fingerprints, and information about the protected website.

The check may begin as soon as you open a protected form, before you submit it. Your browser connects to Cloudflare for this purpose; the result helps determine whether a submission is permitted or a further check is required.

We rely on Article 6(1)(f) GDPR for the processing necessary to protect our forms. Our interest is in preventing abuse and reliably handling genuine enquiries; access to your device is additionally subject to the statutory conditions, including the narrow exceptions for strictly necessary operations.

This security check is distinct from handling the content of your message and from advertising tracking. The respective provider roles govern Cloudflare's technical processing and possible further processing to improve bot detection; processing exclusively within the EEA is not guaranteed.

Tag management, server-side tagging and Consent Mode

Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to centrally manage integrated scripts and services. Tag Manager is not itself a web analytics reporting system; the actual analysis depends on the services integrated through it.

The Tag Manager file is delivered through sst.buena-vista-crew.com. A first-party address does not mean that all connections are made exclusively to our own infrastructure or that no data reaches Google.

Where technical management is limited to necessary operations, it serves our legitimate interest in a controlled website operation under Article 6(1)(f) GDPR. This basis does not permit analytics or advertising functions requiring consent to be activated prematurely.

Server-side processing

Our server-side tagging container runs on Google Cloud Run in Frankfurt, in the europe-west3 region. It receives measurement and event data and processes it before forwarding it as configured to the analytics and advertising services described.

The server-side route allows, for example, unnecessary parameters to be removed and certain identifiers to be pseudonymised. It does not automatically anonymise data: the receiving server initially receives the IP address with a request, and identifiers or hashes may still be associated with a person.

Technical logging to secure this infrastructure is distinct from analysing user behaviour. Article 6(1)(f) GDPR may apply to necessary security operations; analytics and advertising purposes requiring consent rely on your consent under Article 6(1)(a) GDPR.

Google Consent Mode

Google Consent Mode communicates consent signals, in particular analytics_storage, ad_storage, ad_user_data and ad_personalization. These control the behaviour of Google tags but do not replace any required consent.

Requests may reach our own SST endpoint even if you have not consented to analytics or marketing. Technical connection data, page and event information and your consent status may be received; this receipt is distinct from subsequent analysis or transmission to Google and other providers.

Using our own server address or not using cookies does not automatically make analytics exempt from consent requirements. Consent to one service also does not automatically cover other services or additional purposes such as personalised advertising.

Google Analytics 4 and Google Signals

We use Google Analytics 4, provided by Google Ireland Limited, to analyse website use and improve our content. The data processed includes, in particular, page views, events, timestamps, approximate geographic information, browser and device information, source and campaign information, and pseudonymous user and session identifiers.

Data is transmitted through the SST infrastructure described above. This means neither complete anonymity nor a general exclusion of direct Google connections or subsequent processing outside the EEA.

We also use Google Signals for aggregated information about user groups and interests. Under the conditions specified by Google, this may take account of information about signed-in Google users who have enabled personalised advertising.

Analytics and the additional Signals functions are based on the consent you have given for these purposes under Article 6(1)(a) GDPR. You can withdraw it through the privacy settings; the retention period for user- and event-level Analytics data in our setup is 14 months.

Google processes Analytics data within the framework of its applicable data processing arrangements. Processing by Google companies outside the EEA, particularly in the United States, is possible.

Google Ads, enhanced conversions and customer matching

Conversion tracking

We use Google Ads conversion tracking to measure whether certain actions occur after an ad interaction, such as a property enquiry, contact request or signup. The results help us assess and optimise campaigns.

The data processed includes, in particular, ad click identifiers such as GCLID, cookie and other online identifiers, event type and time, page and device information, and associated conversion attributes. Collection may take place in the browser and through our SST container.

The legal basis for this advertising measurement is your consent under Article 6(1)(a) GDPR. Aggregated campaign reports do not mean that the underlying data is anonymous to Google.

Enhanced conversions for web and leads

We use enhanced conversions to associate ad interactions more reliably with website enquiries and subsequent outcomes. For this purpose, relevant contact details, particularly email addresses and telephone numbers, may be normalised, hashed using SHA-256 and transmitted to Google.

• Enhanced conversions for web: Contact attributes are associated with a website event, such as a submitted enquiry.
• Enhanced conversions for leads: An original enquiry may be linked to a later outcome, such as a qualified enquiry or a completed contract.

The designated matching attributes and event information are transmitted, not the entire content of your correspondence as a matter of course. Hashing is pseudonymisation, not complete anonymisation; matching against existing account information is part of the purpose of this process.

This processing requires corresponding consent under Article 6(1)(a) GDPR. Simply contacting us does not constitute such consent.

Customer Match and conversion-based customer lists

With Customer Match, we match designated customer and prospect attributes, in the form of SHA-256 hashes, against Google accounts. Matching is used to create and update audiences, display or exclude certain advertising, and optimise our campaigns.

We also use conversion-based customer lists. These use contact hashes transmitted in connection with enhanced conversions to automatically create and update audiences.

This audience use goes beyond pure performance measurement and requires consent covering customer matching and personalised advertising. You can withdraw this consent through the privacy settings and, for customer lists already transmitted, by contacting us.

The duration of list membership depends on the active membership settings and your consent status. Processing in the United States is possible; cookie lifetimes are distinct from attribution windows and the retention of data already transmitted.

ChatGPT Ads: OpenAI Measurement Pixel and Conversions API

Purpose and provider

We use the OpenAI Measurement Pixel and the OpenAI Conversions API to measure the effectiveness of our advertisements in ChatGPT. Configured website actions are recorded for this purpose, such as page views and contact enquiries following an ad interaction; we receive aggregated reports.

For the EEA, OpenAI identifies OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, as the responsible company in its general EEA Privacy Policy. Its specific role in advertising measurement is additionally governed by the applicable Ads contractual terms.

Browser pixel and cookies

When you click an advertisement, the oppref parameter may be appended to the destination URL; the pixel stores this click reference in the first-party cookie __oppref on our domain and also uses __obref as a randomly generated browser reference. (OpenAI Measurement Pixel)

• __oppref: Its specified lifetime is 30 days after being written; each new capture of a non-empty oppref parameter restarts this period, even if the value is identical. Merely reading the cookie without a new URL parameter does not extend it. (OpenAI Measurement Pixel)
• __obref: Its specified lifetime is 365 days after creation; reusing a valid browser reference does not extend this lifetime. Browser restrictions or manual deletion may shorten these periods. (OpenAI Measurement Pixel)

The information transmitted may include click and browser references, event type and time, configured event details, and an event identifier to prevent duplicate counting; it also includes technical connection data such as IP address and browser identification. (OpenAI Measurement Pixel) For the pixel, source_url denotes the page's origin, not automatically its full address including all path and query parameters. (OpenAI Measurement Pixel)

Advanced matching

For advanced matching, email address, telephone number, first and last name and an internal customer identifier may be transmitted as normalised SHA-256 hashes where available and covered by consent; country, region, city and postal code are separate location fields. (OpenAI Measurement Pixel)

According to OpenAI, automatic advanced matching hashes supported contact attributes in the browser; when attributes are supplied manually, the designated fields must already be prepared accordingly. These contact attributes are not transmitted in plain text for matching, but the hashes must not be treated as anonymous data. (OpenAI Measurement Pixel)

Server-side transmission

We also transmit selected conversion events from our server-side measurement infrastructure to the OpenAI Conversions API. This transmission route is distinct from calling the pixel directly in the browser.

The interface supports, in particular, event type, time, event identifier, the click reference oppref, the browser reference obref, configured event values, IP address, browser identification and the hashed contact and unhashed location attributes described above. Which of these optional attributes an event contains depends on the available data and the measurement purpose authorised by consent. (OpenAI Conversions API)

Legal basis, withdrawal and retention

The legal basis for this advertising performance measurement is your consent under Article 6(1)(a) GDPR. The consent requirements described above also apply to storing or accessing information on your device; exclusively server-side transmission does not remove the need for a legal basis for the personal data it contains.

You can withdraw your consent through our privacy settings with effect for the future. Withdrawal applies to future browser- and server-side measurement; it does not automatically delete data already transmitted.

Processing by OpenAI OpCo, LLC or other affiliated companies in the United States and other countries is possible; OpenAI refers to its EEA Privacy Policy for international processing and safeguards. The technical documentation does not specify a fixed general deletion period for transmitted conversion event data; the cookie lifetimes stated above therefore do not constitute a guarantee of corresponding server-side deletion. (OpenAI Measurement Pixel, OpenAI Conversions API)

Microsoft Advertising and Microsoft Clarity

Universal Event Tracking and remarketing

We use Microsoft Advertising with Universal Event Tracking, or UET, provided by Microsoft Ireland Operations Limited, Ireland. We use it to measure advertising effectiveness, optimise campaigns and create remarketing audiences to reach previous visitors again or exclude certain visitors.

The data processed includes, in particular, page views, conversion events, timestamps, browser and device information, IP addresses, and cookie and ad click identifiers. The underlying data may be personal data even though we mainly receive statistics.

The legal basis is your consent under Article 6(1)(a) GDPR, including any required consent to device access. Processing by Microsoft companies in the United States is possible; you can withdraw your consent through the privacy settings.

Clarity: heatmaps and session views

We use Microsoft Clarity, provided by Microsoft Corporation, USA, to analyse how our website is used. Heatmaps and reconstructed session views help us identify unclear elements and technical problems.

The data processed includes, in particular, clicks, scrolling and mouse movements, page information, timestamps, device and browser details, and technical identifiers. A session view is not a camera recording, but it can make behaviour within the website traceable; confidential content must be protected through masking or exclusion from recording.

Processing is based on your consent under Article 6(1)(a) GDPR. Linking Clarity with Google Analytics 4 requires the relevant consent for both services.

Microsoft specifies a general retention period of 30 days for playback data and up to nine months for labelled or favourited sessions and heatmap and click data; the relevant data, including backups, is deleted after these periods. (Microsoft Clarity: Data retention) Processing in the United States is possible, and you can withdraw your consent at any time through our privacy settings.

Meta Pixel and Conversions API

We use the Meta Pixel and Meta Conversions API for advertising on Facebook and Instagram. The European provider is Meta Platforms Ireland Limited, Ireland; the purposes are advertising performance measurement, audience creation and the optimisation and personalisation of our advertisements.

When the pixel is activated, your browser may connect directly to Meta. This may transmit your IP address, browser information, page address and referrer, timestamps, pixel and cookie identifiers, and events such as page views or submitted enquiries.

We also transmit event data through our SST container to the Conversions API. This includes the events, timestamps and event identifiers designated for measurement and attribution, and, where applicable, SHA-256 hashes of contact attributes and other configured technical identifiers.

Meta can associate information with Facebook or Instagram accounts. Server-side transmission and aggregated reports provided to us do not automatically prevent this association.

The legal basis for the advertising purposes described and both transmission routes is your corresponding consent under Article 6(1)(a) GDPR. Withdrawal through the privacy settings also applies to future server-side transmissions.

Where the relevant collection and transmission fall under the applicable Meta Business Tools terms, joint controllership is governed by the allocation of responsibilities set out there. Meta's subsequent processing for its own purposes is distinct from this; a transfer to Meta Platforms, Inc. in the United States is possible.

LinkedIn Insight Tag, Conversions API and contact enquiries

Website and advertising measurement

We use the LinkedIn Insight Tag, provided by LinkedIn Ireland Unlimited Company, Ireland, to evaluate advertising effectiveness and create audiences. When activated, it may transmit, in particular, IP address, browser and device information, page address and referrer, timestamps, tag and cookie identifiers, and event data to LinkedIn.

LinkedIn can associate website interactions with a member account. The aggregated reports provided to us therefore do not mean that all underlying data is anonymous.

We also transmit selected events through our SST container using the LinkedIn Conversions API. This includes event type and time, attribution and event identifiers, and, where applicable, hashed email addresses; the API serves measurement purposes and does not in itself constitute a separate remarketing function.

Your consent under Article 6(1)(a) GDPR is the legal basis for this analytics and advertising processing. You can withdraw it through the privacy settings.

LinkedIn specifies that data processed through the Conversions API is deleted after 180 days; aggregated conversion reports may remain beyond that period, and processing takes place particularly on servers in the United States. (LinkedIn Conversions API) The API is subject to its applicable data processing terms; LinkedIn's own platform processing must be considered separately.

Lead forms and personal messages

We receive enquiries both through LinkedIn Lead Gen Forms associated with our advertisements and through personal messages and contacts. We manually transfer the contact and enquiry information relevant to handling them into Propstack.

This transfer serves to handle the particular enquiry under Article 6(1)(b) or (f) GDPR. It is distinct from the website advertising measurement described above and does not in itself constitute additional consent to customer matching or advertising tracking.

TikTok Pixel and Events API

We use the TikTok Pixel and TikTok Events API to measure our advertisements, create audiences and optimise our advertising. TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited, United Kingdom, are relevant to the European Business Products.

When the pixel is activated, your browser may connect directly to TikTok. This may involve processing IP address, browser and device information, page address and referrer, timestamps, pixel and cookie identifiers, and interactions on the website.

Selected events are also transmitted server-side through our SST container using the Events API. These may include event types, timestamps, event and click identifiers, and SHA-256 hashes of designated contact information.

TikTok can associate the information with an account and process it in accordance with the applicable terms. Different roles apply to joint collection and transmission covered by the Business Products terms, any processing on our behalf and subsequent processing for TikTok's own platform purposes.

The legal basis for the purposes described is your consent under Article 6(1)(a) GDPR. You can withdraw it through the privacy settings; processing outside the EEA, including in the United States or Singapore, is possible.

Property listings, enquiries and Propstack

Property presentation and CRM

We use Propstack, provided by Propstack GmbH, Germany, to manage our property listings and as a customer and prospect relationship management system. The presentation of property information is distinct from processing your personal enquiry.

Providing current property data, images and descriptions serves our legitimate interest in clearly presenting our services under Article 6(1)(f) GDPR. The sections on hosting and website content explain which technical data is generated when you access them.

In the CRM, we process, in particular, names, contact details, property references, search preferences, appointments, correspondence, submitted documents and processing statuses. The purposes are to respond to your enquiry, organise consultations and viewings, and initiate and deliver the services you request.

Where necessary, this is based on Article 6(1)(b) GDPR; other business matters are handled under Article 6(1)(f) GDPR, reflecting our interest in orderly and traceable processing. Propstack is used as a technical processor for the CRM data we manage.

Sources of data

We obtain contact information particularly from you directly through forms, email, telephone or personal conversations. Enquiries from Idealista, James Edition, Immoscout and Green Acres are also automatically transferred into Propstack; LinkedIn enquiries are transferred manually as described above.

The information transferred comprises the contact details, message content and property or campaign reference provided for your enquiry. The portal's or network's own privacy information also applies to prior processing on that platform.

Access and disclosure to property owners

Only authorised internal Crew members have direct user access to our CRM contacts and correspondence. External cooperating estate agents and other external service providers do not receive such user access; necessary technical processing by Propstack and its service providers is distinct from this.

Before a viewing, we disclose only your name to the property owner to document the introduction of the prospective buyer. This serves to record which prospect we introduced and protect legitimate brokerage claims; we rely on Article 6(1)(f) GDPR for the processing required for this purpose.

Your contact details are not routinely disclosed to the owner before a viewing. If serious purchase interest subsequently develops, buyers and sellers may exchange their contact details directly; if we facilitate an exchange at one party's request, we disclose contact details only with the consent of the other party whose details are involved.

Financing documents and communications with lawyers

Financing matters and related documents are generally exchanged directly between the buyer and their lawyer, rather than handled through us. We may receive copies as a CC recipient, including accidentally; these messages and attachments are also stored in Propstack as part of the correspondence.

We do not disclose financing or creditworthiness documents to property owners. We do not communicate directly with notaries; that dialogue remains between the lawyer and the buyer or seller.

Merely receiving a CC copy does not create a separate entitlement to retain all the data it contains permanently. The specific processing purpose, necessity and a valid legal basis are decisive; please therefore send us only documents actually needed for our work.

Email and property brochure delivery with performance analysis

Our ordinary email communications and property brochure delivery are handled through Propstack. Opens and clicks are recorded at recipient level to analyse the effectiveness of the information sent.

This analysis is used exclusively to measure performance. We do not use recorded opens and clicks to follow up with individual recipients specifically on the basis of those activities.

A legal basis for handling your enquiry does not automatically cover additional personal performance measurement. Where consent is required, Article 6(1)(a) GDPR is the relevant basis; simply requesting a property brochure must not be treated as separate consent to every additional measurement activity.

CRM retention

Our operational retention policy for enquiries that do not result in a purchase is five years from the last personal exchange. Newsletter delivery, opens and clicks do not count as personal contact and do not restart this period.

Where a purchase is concluded, our operational policy provides for ten years from the conclusion of the contract for the entire associated CRM record, including emails and activities. Review and deletion are carried out manually; automatic deletion is not guaranteed.

These operational policies are not equivalent to a statutory obligation to retain every individual item of data in full. Statutory rights to erasure, purpose limitation and necessity remain decisive, particularly for documents that are unnecessary or were received accidentally.

These CRM periods do not automatically apply to WhatsApp chats or job applications. The separate provisions in the following sections apply to them.

Contact, callbacks and property valuations

If you contact us or request a callback or property valuation, we process your contact details, the content of your request and, where relevant, information about the property. Technical receipt and transmission data may also be processed.

We use this information to handle your enquiry and organise the next steps you request. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual matters and, otherwise, Article 6(1)(f) GDPR for appropriate business communications.

Consent to optional web analytics, customer matching or advertising tracking is not a condition for handling your enquiry. Enquiries are managed in Propstack; additional newsletter use and its legal requirements are explained separately.

WhatsApp Business

If you contact us through WhatsApp Business, we process, in particular, your telephone number, displayed profile information, messages, attachments and communication timestamps. You can use our other contact channels at any time instead.

Depending on your request, processing is based on Article 6(1)(b) or (f) GDPR. This is distinct from processing by WhatsApp Ireland Limited and the companies involved in providing the service, particularly of connection data and metadata.

Our WhatsApp communications remain within WhatsApp Business and are not synchronised with Propstack or stored there as chats. We have not enabled address book access and do not create additional chat backups in iCloud or Google Drive.

Chats are manually reviewed and deleted when they are no longer necessary to handle the matter further. There is no fixed general retention period in years; any statutory record-keeping or retention obligations must be considered separately for the specific content concerned.

End-to-end encryption of messages does not rule out the processing of technical metadata or possible international processing by WhatsApp. Not using additional cloud backups therefore does not mean that all processing takes place exclusively on our local devices.

Newsletter with Mailchimp

Delivery, sources and unsubscribing

We use Mailchimp exclusively for our newsletter. The data processed includes, in particular, your email address, your name where provided, the source of the contact, sending and delivery information, and subscriptions and unsubscriptions.

You can actively subscribe to the newsletter on our website. In our existing process, we also add general prospect enquiries, for example from the website, property portals or LinkedIn, to the newsletter mailing list; job applicants are expressly excluded.

Where you actively subscribe, your consent under Article 6(1)(a) GDPR is the basis for sending the newsletter you requested. A separate double opt-in process involving an additional confirmation email is not currently used.

The additional use of enquiries pursues our interest in informing prospective customers about properties and our services. However, a legitimate interest under the GDPR does not replace the additional permission required to send marketing emails: an enquiry alone is not express newsletter consent, and statutory existing-customer exceptions apply only when their respective conditions are met. (Section 7 UWG, Article 21 LSSI)

You can unsubscribe from the newsletter at any time using the unsubscribe link in each message or by writing to crew@buena-vista-crew.com. Unsubscribing ends further newsletter delivery; it does not affect an independently ongoing property enquiry or contractual communication that you have requested.

Individual open and click tracking

Through Mailchimp, we record whether newsletters are opened and links within them are clicked. This information can be attributed to individual recipients and is used exclusively for performance analysis.

The measurements are not used for segmentation, personalisation or triggering automated follow-up emails based on your individual opening or clicking behaviour. The analysis nevertheless constitutes additional processing of personal data and is not anonymous simply because we also view aggregated results.

Any consent required for personal performance measurement is distinct from permission to send emails. Article 6(1)(a) GDPR is the relevant basis for analysis requiring consent; you can address objections to this analysis or withdraw consent by contacting our privacy contact.

Provider and retention

The Mailchimp provider is The Rocket Science Group LLC d/b/a Mailchimp; processing of our newsletter data is governed by the applicable contractual terms and the Mailchimp Data Processing Addendum. Mailchimp describes processing in the United States and at other locations of its affiliates and subprocessors; the requirements for international transfers apply accordingly. (Mailchimp Data Processing Addendum)

We have not set a separate fixed retention period for the newsletter or its measurement data; we use the service's default retention arrangements. This does not establish a reliable guarantee of automatic deletion after a particular number of days or months.

Unsubscribing ends delivery but does not necessarily result in the immediate and complete deletion of all records, previous reports and suppression information. Necessity for the respective purpose, your data subject rights and any lawful record-keeping obligations remain decisive.

The Mailchimp Data Processing Addendum governs, among other matters, return or deletion at the end of the contract and possible exceptions, but does not specify a single deletion period for all individual marketing open and click data. (Mailchimp Data Processing Addendum) Suppression information kept to respect your unsubscription must not be used as a basis for further advertising.

Applications and talent pool

Handling your application

If you apply to work with us, we process your contact details, application documents, qualifications and related communications. This applies to advertised positions and unsolicited applications.

Applications are stored in our email mailbox and additionally in Propstack. Only management and the people responsible for the recruitment process have access to the documents.

Processing to decide on a possible working relationship is based particularly on Article 6(1)(b) GDPR. Where documents are necessary to establish or defend legal claims, Article 6(1)(f) GDPR may apply; necessity must be assessed separately in each case.

Voluntary talent pool

If no suitable opportunity is currently available, we may, with your consent given by email, retain your documents in our talent pool for suitable future positions. This additional processing is based on Article 6(1)(a) GDPR and is voluntary.

No fixed expiry date is agreed for this consent. You can withdraw it at any time by writing to crew@buena-vista-crew.com, with effect for the future.

The absence of an expiry date does not permit unlimited storage independently of purpose and necessity; the specific talent pool purpose, the validity of your consent and your erasure rights remain decisive. (GDPR, EDPB Guidelines on consent, paragraphs 110–111) Applicants are not added to our Mailchimp newsletter, even if they join the talent pool.

Videos and external platforms

Media we provide ourselves

When you retrieve videos and images through our website infrastructure, the technical data needed to deliver them is generated. The information on hosting applies; the legal basis is our legitimate interest in a functional presentation under Article 6(1)(f) GDPR.

Delivering a video does not constitute consent to additional analysis of your playback. Such measurement is subject to the separately described requirements.

YouTube

We embed YouTube videos, particularly to present properties and tours. The provider for users in the EEA is Google Ireland Limited, Ireland.

Loading the player establishes connections to Google or YouTube. This may involve processing IP address, browser and device information, the page accessed, time and video usage information, and using cookies or similar technologies.

If you are signed in to a Google account, interactions may be associated with that account. Signing out of your account does not automatically prevent all further processing by the provider.

Embedding that requires consent is based on Article 6(1)(a) GDPR. You can withdraw consent through the privacy settings; this does not reverse transfers that have already taken place, and processing in the United States is possible.

Linked social networks

Our website links to our social network profiles. Following such a link takes you away from our website; use of the respective platform is governed by its own privacy information.

If you contact us there, we process the message addressed to us to handle your request. The platform's independent processing and any additionally activated advertising services described above are distinct from this.

General retention and deletion

The periods or criteria stated in the respective sections apply to personal data. There is no single statutory retention period covering all website, CRM, newsletter, communication and application data in the same way.

The relevant considerations include the original purpose, continued necessity, valid consent, applicable legal obligations and specific legal claims. A documented commercial or legal transaction does not automatically permit unlimited retention of all data ever associated with it. (GDPR, Articles 5 and 17)

Cookie lifetimes, advertising attribution windows, server-side event data and technical backups must be distinguished from one another. Withdrawal ends processing based on consent for the future; legally required records or documents lawfully retained on another independent basis must be assessed separately. (GDPR, Articles 7 and 17)

Your rights under the GDPR

You can contact crew@buena-vista-crew.com to exercise your rights. Where necessary to handle your request securely, reasonable additional information may be needed to confirm your identity; the statutory conditions for the following rights apply. (GDPR, Articles 12–22)

• Access and a copy: You can find out whether and which personal data we process, including purposes, recipients, sources and retention, and generally obtain a copy of that data, Article 15 GDPR.
• Rectification: You can request the correction of inaccurate data and completion of incomplete data, Article 16 GDPR.
• Erasure: You can request deletion subject to the statutory conditions; exceptions include necessary legal obligations and legal claims, Article 17 GDPR.
• Restriction: You can request restriction of processing subject to the statutory conditions, Article 18 GDPR.
• Notification of recipients: Where required, recipients are informed of rectification, erasure or restriction; you can request information about these recipients, Article 19 GDPR.
• Data portability: Where automated processing is based on your consent or a contract, you can receive the data you provided in a structured, commonly used and machine-readable format and, where applicable, request direct transmission, Article 20 GDPR.
• Withdrawal: You can withdraw consent at any time for the future without affecting the lawfulness of earlier processing, Article 7(3) GDPR.
• Automated decisions: Subject to Article 22 GDPR, you have safeguards against solely automated decisions, including profiling, that produce legal or similarly significant effects.

The conditions and limits of these rights are set out in the GDPR. The advertising services described may create audiences or personalise advertisements; this is distinct from a solely automated decision producing legal or similarly significant effects.

Objection

You may object to processing under Article 6(1)(e) or (f) GDPR on grounds relating to your particular situation; this also applies to profiling based on those provisions. Processing may then continue only under the statutory conditions, particularly where compelling legitimate grounds are demonstrated or processing is necessary for legal claims. (Article 21 GDPR)

You may object to processing for direct marketing at any time without giving reasons; this includes related profiling. Following such an objection, the data concerned must no longer be processed for those purposes. (Article 21(2)–(3) GDPR)

Response periods and complaints

We respond to requests under the GDPR without undue delay, generally no later than one month after receipt; where an extension is necessary because of the complexity or number of requests, the period may be extended by up to two further months, with notice and reasons provided within the first month. (Article 12 GDPR) Requests are generally handled free of charge; statutory exceptions apply particularly to manifestly unfounded or excessive requests. (Article 12 GDPR)

You can lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, place of work or the alleged infringement; in Spain, this is particularly the Agencia Española de Protección de Datos, AEPD. Contacting us first is not a prerequisite for exercising this right. (Article 77 GDPR)

Additional information for individuals in the United States

Scope and categories of data

Our processing in connection with our Spanish establishment is not exempt from GDPR requirements merely because you are in the United States. Additional rights under US state laws apply where their respective substantive, personal and business-related applicability requirements are met. (GDPR, Article 3, California Privacy Protection Agency)

Depending on the contact, the categories we process include identifiers and contact details, online and device identifiers, usage and advertising interactions, property interests and business communications. They may also include documents you provide, financing-related information in CC correspondence, and application and qualification data.

Data comes particularly from you directly, your use of our website, the property portals and social networks named above, and correspondence addressed or copied to us. Purposes, categories of recipients and retention are described in the respective sections of this policy.

Targeted advertising, “sale” and “sharing”

Disclosing online identifiers and interaction data to advertising platforms may qualify as “sale”, “sharing” or processing for targeted advertising under applicable US law, even without a direct sale for money. The specific classification depends on the processing concerned and the applicable law. (California Privacy Protection Agency)

You can reject optional advertising services or withdraw consent through our privacy settings and send additional privacy requests to crew@buena-vista-crew.com. Where legally required, recognised opt-out signals such as Global Privacy Control must also be treated as corresponding requests. (California Privacy Protection Agency)

Additional rights and time limits

Where applicable US law provides for them, additional rights include access, a copy of data, correction, deletion, opting out of sale or sharing for behavioural advertising, and limiting certain uses of sensitive data. Rights may also include appointing an authorised agent, exercising rights without discrimination, and having a refusal reviewed; the conditions differ by state. (California Privacy Protection Agency, Texas Attorney General: Privacy rights)

For access, correction or deletion requests covered by California's CCPA, receipt generally must be acknowledged within ten business days and a substantive response provided within 45 calendar days; an extension by a further 45 days is possible under the statutory conditions and with appropriate notice. (California Privacy Protection Agency) Covered requests to opt out of “sale” or “sharing”, or to limit certain uses of sensitive data, must be implemented as soon as practicable and no later than 15 business days. (California Privacy Protection Agency)

These California time limits do not automatically apply uniformly to all US states. Where the GDPR or another provision also requires an earlier response, a longer US time limit does not replace that requirement.

Changes to this Privacy Policy

We update this information when our processing, service providers or legal requirements change. The applicable version is the published policy bearing the date shown above.