Privacy Policy

1. Controller

The controller for data processing on this website is DC FINEST REAL ESTATE MALLORCA S.L., represented by Hanns-Christopher Deppe, Avenida Mateo Bosch 16, 07157 Port d'Andratx, Islas Baleares, España, CIF: B57692741. No data protection officer is required. For any privacy matter, contact us at info@dc-finest.com.

2. Principles of data processing

We process personal data only on a legal basis under Art. 6 GDPR: your consent (Art. 6(1)(a)), performance of a contract or pre-contractual steps (point (b)), legal obligations such as anti-money laundering and tax law (point (c)), or our legitimate interests, for example in operating this website securely (point (f)). Spanish data protection law (LOPDGDD) applies in addition.

3. Hosting and server logs (Cloudflare)

This website is operated on infrastructure of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA); our database and image storage also run on Cloudflare. When you visit the site, Cloudflare processes technically necessary data (IP address, time of access, browser and device data) to deliver the page and to protect against attacks. The legal basis is our legitimate interest in secure and performant operation (Art. 6(1)(f) GDPR). Transfers to the USA are safeguarded by Cloudflare's certification under the EU-U.S. Data Privacy Framework and by EU standard contractual clauses.

All fonts are self-hosted; no fonts are loaded from external providers such as Google Fonts.

4. Contact and inquiry forms

When you send a property inquiry, a search request, a sale/valuation request or a favorites inquiry, we process the data you provide (name, email address, optionally phone number and message) together with the context of your request (e.g. the property concerned or your search criteria). The data is stored in our database and transferred for processing to our CRM system onOffice (onOffice GmbH, Aachen, Germany), with which a data processing agreement is in place.

The legal basis is the performance of pre-contractual steps (Art. 6(1)(b) GDPR) and the consent you give when submitting the form (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future. Inquiry data is deleted no later than three years after the inquiry has been dealt with, unless statutory retention obligations apply.

5. Spam protection (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect our forms against abuse. Turnstile evaluates technical browser signals to detect automated access; your IP address may be transmitted to Cloudflare in the process. No advertising tracking takes place. The legal basis is our legitimate interest in protection against spam and abuse (Art. 6(1)(f) GDPR).

6. Google Tag Manager, Google Analytics 4 and Google Ads (only with consent)

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to manage measurement and marketing tags. Tag Manager itself sets no cookies and collects no personal data; it loads the services described below only after you have given consent (Art. 6(1)(a) GDPR). We use Google Consent Mode v2 with the default set to "denied": without consent, no analytics or marketing cookies are set and no personal data is transmitted to Google. The Tag Manager script and the measurement requests of the services described below are loaded and sent via our domain (Google tag gateway) and forwarded from our server to Google; this transmits your IP address and approximate location (country, region). This does not change the consent requirement.

With your consent, Google Analytics 4 measures how this website is used (pages and properties viewed, favourites actions, submitted forms, technical details about browser and device). Google Analytics 4 does not store IP addresses; reports do not identify individuals. Data is deleted after 14 months.

With your consent, Google Ads conversion tracking records whether a visit via a Google ad led to an inquiry. When you submit an inquiry form, we transmit your email address and phone number to Google exclusively in hashed form (SHA-256, "enhanced conversions") so that the conversion can be attributed to an ad click; Google cannot derive the plain data from this. Transfers to the USA are safeguarded by EU standard contractual clauses and the EU-U.S. Data Privacy Framework. You may withdraw consent at any time via the cookie settings.

7. Cookiebot (consent management)

We use Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark) to obtain and document your consent. Cookiebot stores your decision in the "CookieConsent" cookie (12 months) and transmits your anonymised IP address, date and time and the consent status. The legal basis is the statutory obligation to demonstrate consent (Art. 6(1)(c) GDPR) and our legitimate interest in lawful operation (Art. 6(1)(f) GDPR).

8. Cookies and local storage

This website sets no analytics or marketing cookies without your consent; the only technically necessary cookie is that of the consent management (see section 7). Your favourites list is stored exclusively locally in your browser (localStorage, property numbers only) and is not transmitted to us; you can delete it at any time via your browser data.

9. Real estate mediation and legal obligations

In the course of a mediation we process the data required to initiate and perform the contract (Art. 6(1)(b) GDPR). As real estate agents we are obliged under the Spanish anti-money laundering act (Ley 10/2010) to verify the identity of our clients and to retain records; the supervisory authority is SEPBLAC. This data is subject to a statutory retention period of ten years (Art. 6(1)(c) GDPR).

10. Disclosure to third parties

Data is disclosed only to processors (Cloudflare, onOffice) on the basis of data processing agreements, to notaries, lawyers or banks where required for contract execution, and to public authorities where we are legally obliged. We do not sell your data.

11. Retention periods

Unless stated otherwise above, the following periods apply:

12. Your rights

Under the GDPR you have the following rights; to exercise them, contact info@dc-finest.com. We respond without undue delay and at the latest within one month.

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority in Spain is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also contact the authority of your country of residence.

14. Changes to this policy

We update this privacy policy when the website or the legal situation changes. The version published here applies.