Privacy notice

This notice explains how Costa MLS processes personal data. It follows Regulation (EU) 2016/679 (GDPR, in Spanish RGPD) and Ley Orgánica 3/2018 (LOPDGDD). The Spanish version prevails over this English version.

1. Who is responsible

The controller is [COMPANY_LEGAL_NAME], tax ID [CIF], with its address at [REGISTERED_ADDRESS]. Costa MLS is part of Costa Tropical Real Estate and is provided at mls.costatropicalre.com.

For any question about your data, write to [CONTACT_EMAIL].

[ABOGADO: Must a data protection officer be appointed (article 37 of the GDPR), or is an internal contact point enough, given that the processing is small in scale and limited to professionals' data and buyers' names?]

2. What data we process

We process five groups of data.

• Data of agencies and their users. Name, job title, e-mail, phone, agency details (including the tax ID, NIF or CIF) and sign-in data. We ask for them when an agency joins and when users are created.
• Listing data. Listings are data about properties. They include the full catastral reference, which we use to detect duplicate listings. Other agencies see only its first 4 characters. We never store the property owner's details.
• Buyer data in client registrations. First name, surname, the date and time of the registration (set by the server) and, optionally, a planned viewing date and a note. We never store the buyer's phone number or e-mail.
• Google sign-in data. Members may sign in with Google (OpenID Connect) or with a one-time code sent by e-mail. If you choose Google, we receive only the e-mail address of your Google account, to match the invited user. We use no other Google data.
• Technical data. IP address, the date and time of requests and security logs. We use them to protect the service and to block access from certain countries.

[ABOGADO: Is the full catastral reference personal data when the listing contains no owner details, and should the notice treat it as such, bearing in mind that other agencies see only its first 4 characters?]

3. What we use the data for and the legal basis

We do not use your data for advertising or profiling. Alert and confirmation e-mails are service e-mails.

4. Buyer names in client registrations

A member agency registers a buyer on a listing to record that it brought that buyer. The listing agency receives an e-mail and either confirms the registration or declines it. The first timestamp is the evidence. Costa MLS does not judge disputes between agencies.

The legal basis is legitimate interest (article 6.1.f of the GDPR). Balancing note:

• Our interest and the agencies' interest is to avoid arguments about who brought the buyer.
• We keep the minimum: first name, surname and date. We keep no phone number and no e-mail.
• Only the agency that registered the buyer and the listing agency can see it.
• The buyer is already in contact with an agency and can reasonably expect it to keep a record of that.
• The data is deleted automatically after a fixed period (section 7).
• The buyer can object (section 8).

The data is not used for marketing.

Because we do not receive the data from the buyer, the member agency that registers the buyer must inform them (article 14 of the GDPR) at first contact or, at the latest, within one month. The terms of use require each agency to do this.

[ABOGADO: May the Costa MLS operator access client registrations and, if so, in which cases (for example, for the security of the service or on a lawful request), and must the notice say so?]

[ABOGADO: For buyer names in client registrations, is Costa MLS the sole controller, or a joint controller with the agency that registers the buyer (article 26 of the GDPR), and what arrangement must be published in that case?]

[ABOGADO: Is it enough that the member agency meets the duty to inform the buyer under article 14 of the GDPR, or should Costa MLS also provide an information text for the agency to give to the buyer?]

[ABOGADO: Is the legitimate-interest balancing in section 4 sound for processing buyers' names without their consent?]

5. Who receives the data

We do not sell data. It is received by:

• Other member agencies, only the professional contact details of agents and the data that each agency chooses to publish in a listing. The export to agency websites removes the name, contacts and photos of the source agency.
• Processors that provide services to us under a contract that meets article 28 of the GDPR:
  • the provider of the virtual private server (VPS) that hosts the service, OVH;
  • the e-mail provider that sends our service messages;
  • Google Cloud Translation, which translates listing texts.
• Authorities, when the law requires us to.

We send Google Cloud Translation only the title and the description of the listing. We do not send it any buyer or agent data.

If you choose to sign in with Google, Google also receives the information about that sign-in. That processing is governed by Google's own terms.

6. International transfers

Google Cloud Translation may process listing texts outside the European Union. If it does, it relies on the safeguards that the GDPR requires.

[ABOGADO: Which transfer safeguard (adequacy decision, standard contractual clauses or other) must be cited for Google Cloud Translation, and should this notice state where the OVH servers are located?]

7. How long we keep the data

• Agency and user data: while the account is active and, after that, for the legal periods.
• Client registrations: deleted automatically 24 months after the date of the registration. This period is a setting of the service. We apply the storage limitation principle (article 5.1.e of the GDPR).
• Technical and security data: the shortest time needed to protect the service.

[ABOGADO: Is a period of 24 months defensible for client registrations, given the ten-year record-keeping period in Ley 10/2010 (article 25), which requires agencies to keep their own files, and the limitation period for personal actions in the Código Civil (article 1964.2)?]

8. Your rights

You can exercise the following six rights (articles 15 to 22 of the GDPR):

• Access: know what data of yours we process and receive a copy.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data.
• Objection: object to processing based on legitimate interest.
• Restriction: ask us to block the processing while a doubt is resolved.
• Portability: receive the data you gave us in a common format.

Write to [CONTACT_EMAIL]. We may ask you to prove your identity. We reply within one month.

9. Complaints to the AEPD

If you think we do not process your data correctly, you can complain to the Spanish Data Protection Agency (AEPD, Agencia Española de Protección de Datos) through its online office at https://sede.aepd.gob.es, or by post at C/ Jorge Juan 6, 28001 Madrid. You can do this without contacting us first (article 77 of the GDPR).

10. Security and breaches

We apply technical and organisational measures to protect data. Access is limited to approved users and each agency sees only what it is entitled to see. If a security breach occurs, we will notify the AEPD within the legal time limit (article 33 of the GDPR) and the people affected where required.

11. Changes to this notice

If we change this notice, we will publish the new version with its date. The version and the date are at the top of each text.