Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Costa Modular Home (“we”, “us”, “our”) collects, uses, stores, and protects personal information when you visit or interact with our website at www.costamodular.es (the “Website”), make enquiries regarding luxury real estate brokerage, modular and passive home construction, turnkey interior renovations, or apply for our Investor Club.

We are committed to maintaining the trust of our clients and visitors. We process personal data strictly in compliance with applicable European and national data protection laws, including the EU GDPR, the Polish Personal Data Protection Act, and Spanish data protection legislation (Ley Orgánica 3/2018 – LOPDGDD).

2. Personal Data We Collect

Depending on how you interact with us and the services you request, we may process the following categories of personal data:

• Identification and contact details: full name, email address, telephone number, preferred language, country of residence or nationality.
• Enquiry and communication details: contents of messages transmitted via email, website contact forms, WhatsApp messaging, or phone calls; property preferences (location, budget, specifications), modular construction requirements, investment criteria, or Investor Club applications.
• Technical and device data: IP address, device type, browser model and version, operating system, referring URL, session identifiers, and approximate location (country/city derived from IP).
• Usage and analytics data: pages visited, time spent per page, navigation paths, and interactions (collected via Google Analytics 4 / Google Tag Manager strictly subject to your prior consent).

3. How We Collect Personal Data

We collect personal data through the following channels:

• Directly from you: when you reach out via email, telephone, WhatsApp messaging, contact forms, or when applying for the Investor Club.
• Automatically during Website visits: through essential cookies and browser storage (LocalStorage) required for site operation, and through optional analytics tools where consent has been granted.
• Social media interactions: when you communicate with our official social media channels (such as Instagram).

4. Purposes and Lawful Bases of Processing

Under GDPR Article 6, we only process personal data where an established lawful basis applies. The table below outlines our processing purposes and corresponding legal grounds:

5. Recipients of Personal Data

We only share personal data with trusted third parties where necessary and lawful:

• Technology and IT service providers: hosting companies, server infrastructure operators, email service providers, and domain management services.
• Analytics providers: Google Ireland Limited (Google Analytics 4, Google Tag Manager, Google Search Console), activated solely upon your consent.
• Professional industry partners: reputable developer partners on Costa del Sol (such as Costa Paradise), licensed architects, structural engineers, and legal or notary advisors involved in property transactions, strictly when required to fulfil your request.
• Professional advisers: certified accountants, legal counsel, and tax consultants.
• Public authorities: law enforcement bodies, tax authorities, or courts where mandated by binding legal obligations.

6. International Data Transfers

Our primary data processing takes place within the European Economic Area (EEA). However, when utilizing tools provided by global technology vendors such as Google LLC, technical information may be processed on servers located outside the EEA (such as in the United States).

Such international transfers are safeguarded under valid legal transfer mechanisms recognised by the European Commission:

• The EU-U.S. Data Privacy Framework adequacy decision adopted by the European Commission on July 10, 2023.
• Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) GDPR.

7. Data Retention Schedule

We retain personal data only for the period necessary to fulfil the purposes for which it was gathered:

• Client enquiries and communication: retained for up to 24–36 months following the last interaction, unless an active contractual relationship ensues or you exercise your right to object.
• Contract and transaction records: retained for the duration of the agreement and thereafter for the statutory limitation period under commercial, civil, and tax law (generally 5 years following the relevant fiscal year).
• Analytics data (GA4): maximum of 14 months, in accordance with Google Analytics retention configuration.
• Cookie consent records in browser storage: up to 12 months, or until cleared by the user.

8. Your Rights Under the GDPR

Under the GDPR, you enjoy the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): obtain confirmation of whether your data is being processed, and request a copy of that data.
• Right to rectification (Art. 16 GDPR): request prompt correction of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten” – Art. 17 GDPR): request deletion of data where it is no longer needed or where consent has been withdrawn.
• Right to restriction of processing (Art. 18 GDPR): restrict processing under circumstances specified by law.
• Right to data portability (Art. 20 GDPR): receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): object to processing based on legitimate interests (Art. 6(1)(f) GDPR).
• Right to withdraw consent (Art. 7(3) GDPR): withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, simply email us at: Officecostamodular@gmail.com.

9. Automated Decision-Making and Profiling

We do not subject your personal data to automated decision-making processes or profiling that produces legal effects concerning you or similarly significantly affects you (pursuant to Article 22 GDPR).

10. Cookies and Tracking Technologies

Our Website uses cookies and local browser storage (LocalStorage). Essential cookies are used to operate the site securely and remember your privacy settings. Non-essential analytics cookies (Google Analytics 4 / Google Tag Manager) are only loaded after you give consent.

For a comprehensive table of all cookies, purposes, expiry dates, and options to change your preferences, please consult our dedicated Cookie Policy.

11. Data Security Measures

We employ state-of-the-art technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure, accidental loss, or destruction. All Website communications are encrypted via SSL/TLS protocol.

12. Protection of Minors

Our Website and services are intended exclusively for individuals aged 18 and older. We do not knowingly solicit or collect personal information from minors.

13. Updates to this Policy

We may update this Privacy Policy from time to time to reflect legal or operational developments. The most current version will always be published on this page, accompanied by the latest update date.