Privacy Policy

What you give us. When you use the forms on this website, we collect:

• Enquiry and contact forms: your name, email, phone number (with country code), your message, the topics you tick (for example buying or selling), how you prefer to be contacted and, on a property page, the property reference.
• Valuation requests: the details above, plus the type of property, number of bedrooms, area and when you'd like to sell.
• Viewing requests: your name, email, phone, the date you'd like and whether you prefer an in-person or video viewing.
• Newsletter: your email address, the date you signed up, the page you signed up on and a record of your consent.

We also keep the emails, WhatsApp messages and notes of calls we exchange with you.

When we act for you in a transaction. As a real estate agency we are required by Spanish anti-money-laundering law (Law 10/2010) to identify our clients. If you buy, sell or rent through us, we will ask for identity documents, proof of address and, where the law requires, information about the source of funds and, for companies, their owners. We may also hold property documents such as title deeds, licences and certificates.

Collected automatically. Our hosting providers record technical data when you visit (such as your IP address, browser type and the pages requested) to keep the website running and secure. We do not use analytics, advertising or social media tracking.

Stored only on your device. The properties you save and the language you choose are kept in your own browser and are not sent to us, unless you choose to send us your saved list. See our Cookie Policy.

We do not ask for special categories of data (such as health or religious beliefs). Please don't include them in your messages.

We will only email you property suggestions beyond your enquiry if you subscribe to our newsletter or ask us to. We do not make decisions about you based solely on automated processing, and we do not build profiles of you.

The fields marked as required in our forms are needed to answer you. If you prefer not to give them, we may not be able to help with your request.

We never sell your personal data. We share it only as follows:

• Service providers who work for us, under contracts that oblige them to protect your data and use it only on our instructions (GDPR art. 28): Supabase (database and form storage, servers in Ireland, EU); Cloudflare and Lovable (website hosting and security); Resend (email delivery, EU sending region); Amazon Web Services (a server in Spain that fetches property listings, which handles no personal data); and our email and office software providers.
• Parties to your transaction, when needed and with your knowledge: for example the owner, developer or agency that lists a property (including agencies in the Resales Online network we collaborate with), so we can arrange a viewing or present an offer.
• Professionals you ask us to introduce you to, such as lawyers, notaries, banks, mortgage advisers or currency specialists, only with your agreement.
• Public authorities when the law requires it, such as the tax authorities, the courts or SEPBLAC (Spain's anti-money-laundering authority).

When you contact us on WhatsApp, WhatsApp (Meta) also processes your messages under its own privacy policy. Loading maps and property photographs connects your browser to the map provider (OpenStreetMap or CARTO) and to the image service wsrv.nl, which resizes property photographs (from Resales Online's image servers or our own photo storage) so pages load faster. These services receive your IP address to deliver them.

We store your data in the European Union. Some of our providers are based in, or may give support from, the United States or other countries outside the European Economic Area. In those cases transfers are protected by the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or by the European Commission's Standard Contractual Clauses (GDPR art. 46). You can ask us for more information about these safeguards.

• Enquiries and correspondence: while we deal with your request and any relationship that follows, and then for two years after our last contact if no transaction takes place.
• Newsletter: until you unsubscribe. We then keep only your email address on a suppression list, so we never write to you again by mistake.
• Transaction and identification records: 10 years from the end of the business relationship, as required by Law 10/2010.
• Accounting and tax records: 6 years (Commercial Code, art. 30) and for as long as tax law requires.
• Technical logs: for the short periods set by our hosting providers for security.

When a retention period ends, we delete the data or, where the law requires us to keep it available to the courts or authorities, we block it (LOPDGDD art. 32) and then delete it.

You have the right to:

• access the personal data we hold about you;
• rectify it if it's inaccurate or incomplete;
• erase it when it's no longer needed or you withdraw your consent;
• restrict how we use it in certain cases;
• object to our use of it based on legitimate interests;
• data portability: receive the data you gave us in a common format, or have it sent to another company;
• withdraw your consent at any time, without affecting what we did before.

To exercise them, email hello@pacemarbella.com saying which right you want to use. If we can't be sure it's you, we may ask you for information to confirm your identity. It's free, and we will answer within one month (extendable by two months for complex requests, in which case we'll tell you why).

If you're not satisfied with our answer, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es or through its electronic office at sedeaepd.gob.es.

The website uses encrypted connections (HTTPS). Enquiries are stored in a secure database that only authorised PACE staff can access. Our providers apply recognised security standards, and we review who has access regularly.

Our website and services are for adults. We do not knowingly collect data from children under 14, the age of digital consent in Spain. If you believe a child has sent us their details, please tell us and we'll delete them.

We will update this policy if we change how we use personal data. The date at the top of this page shows when it last changed. If the change is significant, we will tell you by email where we can.