Privacy Policy

1. Data controller

The controller of your personal data is:

• Owner and operator: Szilvia Mónika Bodnár, trading as Canary Islands Investments (sole trader).
• NIF/NIE: Y6028809V
• Registered address: Calle Churruca 24, 35010 Las Palmas de Gran Canaria, Las Palmas, Spain
• Email: info@canaryislandsinvestments.com
• Telephone: +34 659 445 821
• Website: canaryislandsinvestments.com

2. Personal data we may process

Depending on how you interact with us, we may process the following categories of personal data:

• Identification and contact data: name, email address, telephone / WhatsApp number, country of residence and preferred language.
• Enquiry data: your property requirements, budget range, purpose of purchase, preferred areas, property type and timeframe.
• Property and viewing data: property or listing URLs, property location, asking price, chosen package, requested viewing dates, estate-agent or agency contact details you supply, and whether an appointment has already been arranged.
• Your questions and concerns: buyer-specific questions you ask us to raise, priorities and concerns you describe.
• Correspondence: emails, WhatsApp and other messages exchanged with us, and our internal notes about your request.
• Booking data: package purchased, price, date and time of acceptance of our Terms & Conditions and cancellation policy, the version of the terms accepted, any early-performance (withdrawal) acknowledgement, and booking status.
• Billing and payment-related data: billing name and address, invoice records and payment status or payment reference supplied by our payment provider. We do not receive or store full card numbers.
• Service records: viewing notes, photographs and videos taken at the property, and the client report produced for you.
• Technical data: information generated by the secure operation of the website, such as server log data (including IP address) held by our hosting provider for security and diagnostic purposes.

3. Photographs and video

Photographs and videos taken during a viewing are made to document the property. We ask agents and sellers for permission where required, and we avoid capturing identifiable individuals where reasonably possible. If a person is unintentionally captured and asks us to remove the image, we will do so.

4. Purposes and legal bases

We only process personal data where we have a lawful basis under Article 6 of the GDPR. The basis depends on the purpose:

• Responding to enquiries and arranging a free consultation — performance of a contract or steps taken at your request before entering into a contract (Art. 6(1)(b)); where you also tick a consent box for contact, that consent (Art. 6(1)(a)).
• Managing viewing requests, confirming availability and agreeing a booking — pre-contractual steps and performance of the contract (Art. 6(1)(b)).
• Contacting estate agents, sellers or their representatives to arrange access and ask your questions — performance of the contract (Art. 6(1)(b)).
• Delivering purchased services, attending the property, recording observations and producing your client report — performance of the contract (Art. 6(1)(b)).
• Customer communication about your booking and report — performance of the contract (Art. 6(1)(b)).
• Billing, invoicing and accounting — legal obligation under Spanish tax and accounting law (Art. 6(1)(c)).
• Legal compliance, responding to lawful requests and establishing, exercising or defending legal claims — legal obligation (Art. 6(1)(c)) and our legitimate interests (Art. 6(1)(f)).
• Security of the website and administration area, prevention of abuse, fraud and unauthorised access — our legitimate interests in protecting the service and our clients (Art. 6(1)(f)).
• Service improvement based on our own records — our legitimate interests (Art. 6(1)(f)).
• Optional marketing emails, if we ever offer them — your consent (Art. 6(1)(a)), withdrawable at any time.

5. Providing your data

Providing the data marked as required in our forms is necessary in order to answer your enquiry or deliver the service. If you do not provide it, we may be unable to arrange a consultation, request a viewing or produce a report.

6. Recipients and processors

We do not sell personal data. We share it only where necessary to deliver the service or to comply with the law. Recipients may include:

• Estate agents, sellers and their representatives — limited to what is necessary to arrange access and ask your questions (for example the fact that a buyer's representative will attend, and the questions you want asked). We do not disclose your budget, financial position or personal contact details to an agent unless you ask us to.
• Our hosting, application and database provider, which hosts this website and stores enquiries, bookings, reports and uploaded photographs and videos on our behalf.
• Our email provider, used to correspond with you.
• A payment provider, where you pay for a service. The payment provider processes the payment itself and provides us with a payment status and reference. Card details are entered on the provider's own secure systems, not ours.
• Our accountant or tax adviser and the Spanish tax authorities, for invoicing and statutory accounting purposes.
• Professional advisers, public authorities or courts, where we are legally required or entitled to disclose data.

7. International transfers

Some of our providers are international organisations and may process or store data outside the European Economic Area, for example on infrastructure operated by providers with a global presence. Where this happens, we rely on the transfer safeguards offered by those providers, such as European Commission adequacy decisions or Standard Contractual Clauses.

If you would like details of the safeguards applying to a specific provider, contact us at info@canaryislandsinvestments.com and we will provide the information we hold.

8. Retention

We keep personal data only as long as necessary:

• Enquiries and consultation requests that do not lead to a booking: normally up to 24 months from the last contact, so we can respond if you come back to us, after which they are deleted or anonymised.
• Booking, service and report records, including photographs and videos: for the duration of the service and afterwards for the period in which a claim may be brought in relation to the contract, normally up to 5 years from completion of the service under Spanish contractual limitation rules.
• Invoices and accounting records: for the periods required by Spanish tax and commercial law, generally between 4 and 6 years, and longer where a specific legal obligation applies.
• Records of consent, terms acceptance and withdrawal acknowledgements: for as long as needed to demonstrate compliance, normally for the same period as the related booking record.
• Security and server logs: for the short period applied by our hosting provider for security and diagnostic purposes.

9. Your rights

Under the GDPR and Spanish data-protection law (LOPDGDD) you have the right to:

• Access the personal data we hold about you and receive a copy.
• Request rectification of inaccurate or incomplete data.
• Request erasure of your data where the conditions for erasure are met.
• Request restriction of processing in the cases provided by law.
• Object to processing based on our legitimate interests, on grounds relating to your particular situation.
• Receive data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means (portability).
• Withdraw your consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10. How to exercise your rights

Write to info@canaryislandsinvestments.com or to Calle Churruca 24, 35010 Las Palmas de Gran Canaria, Spain, stating the right you wish to exercise. We may ask for proof of identity before acting. We will respond within one month, extendable by two further months for complex requests, in which case we will tell you.

11. Complaints

If you believe we have not handled your personal data correctly, please contact us first so we can put it right. You also have the right to lodge a complaint with the competent supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also complain to the supervisory authority of the EU country where you live or work.

12. Security

We apply appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access control to our administration area restricted to authorised accounts, private storage for photographs and videos accessible only through expiring secure links, and client reports shared through unique private links that are not indexed by search engines.

13. Automated decision-making

We do not carry out automated decision-making producing legal or similarly significant effects, and we do not profile you for advertising purposes. Where we use automated translation to produce a Hungarian version of your report, the content is based on the observations recorded during your viewing and is reviewed before the report is shared with you.

14. Children

Our services are aimed at adults. We do not knowingly collect personal data from children. If a child's data reaches us, please contact us and we will delete it.

15. Changes to this policy

We may update this policy to reflect changes in our services or in the law. The current version is always published on this page with its date of last update.