Privacy Policy

The data controller is the owner of this website:

• Company name: SGRAEVENCASA, S.L.
• Tax ID (NIF): B92673342
• Registered office: Francisco Villalón, 13 Marbella Banús 4, 29600 – MARBELLA (Málaga)
• Mercantile Registry: registration details being confirmed
• Trade name: Questates
• Contact: C. Francisco Villalón, Nueva Andalucía, 29660 Marbella, Málaga · +34 952 81 91 74 · guy@questates.com

For any privacy question or request, write to guy@questates.com.

You can browse the map and every listing without giving us your name or creating an account. Personal data is collected only in these situations:

• When you ask to see a listing's price and address (the unlock form): your full name, email address, mobile number with country code, the listing you asked about, your consent and the date and time. To check that the contact details are yours, we send a one-time code to your email and another by SMS.
• When you use the website: like any website, our hosting provider receives the technical data your browser sends with each request — IP address, browser and device type, the page requested and the time. We do not use it to identify you.
• Only if you accept statistics: the pages and listings you view, whether you start the unlock form, clicks on our phone, WhatsApp and email links, the site language, the website you came from (domain only), your approximate country (derived from your IP address by our hosting provider) and your device type. To count each visitor once a day, our server derives a one-day pseudonymous code from your IP address, browser identifier and the date using a secret key. The IP address itself is not stored, and the code changes every day.
• When the map is shown: your browser loads the map images from CARTO's servers, which therefore receive your IP address and standard request data.

We do not ask for payment details, identity documents or special categories of data.

Giving your name, email and phone is needed only if you want to unlock a listing; without them you can still browse every listing and contact us directly. We do not take decisions about you based solely on automated processing.

We do not sell your data or give it to other companies for their own marketing. To run the website we use these service providers, which process data on our behalf:

• Netlify — hosting and server functions; all data sent through the website. The server functions run in the United States.
• Google Firebase / Cloud Firestore — the database where enquiries and, if you accepted statistics, daily statistics are stored. Location: Google's European multi-region (eur3).
• Twilio — sends the SMS verification code to your mobile number.
• Resend — sends the emails with the verification code and the listing details (your email address and name).
• Telegram — when an enquiry is completed, our team receives a notification with your name, email, phone and the listing in a private chat.
• CARTO — supplies the map images, so it receives your IP address when your browser loads the map.

Listing photos are normally delivered through our own server. If that fails, your browser may load a photo directly from where it is stored (for example the Resales-Online image server or Unsplash), which then receives your IP address.

We may also disclose data to public authorities, courts or law enforcement when the law requires it.

Some of these providers are established or process data outside the European Economic Area: in particular Netlify's server functions, Twilio and Resend in the United States, and Telegram, which operates outside the EEA. A transfer outside the EEA is only lawful if it is covered by an adequacy decision of the European Commission (for the United States, the EU–US Data Privacy Framework for certified companies) or by appropriate safeguards such as the Commission's standard contractual clauses. You can ask us which mechanism applies to each provider and request a copy of the safeguards, using the contact details above.

• Enquiries: until you ask us to delete them or withdraw your consent to be contacted, or until we no longer need them to handle your enquiry. After deletion, data may be kept blocked only where the law requires it, for the time needed to deal with possible liabilities (Art. 32 LOPDGDD), and is then destroyed.
• Verification: the verification cookie expires after 15 minutes. The SMS code itself is handled by Twilio.
• Statistics: stored as daily totals. The one-day pseudonymous codes are kept with that day's statistics and cannot be linked across days.
• Technical logs: kept by our hosting provider for its own limited period.
• Your cookie choice: 12 months (see the Cookie Policy).

You can ask us for access to your data, its correction or deletion, the restriction of or objection to its processing, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect processing carried out before. To exercise your rights, write to guy@questates.com or to the address above, stating the right you wish to exercise; we may ask you to prove your identity. You can change your cookie choice at any time in Cookie settings.

If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es or through its electronic office at sedeaepd.gob.es.

Access to enquiries is limited to our team's personal accounts, the website only works over encrypted connections (HTTPS), and our providers apply their own security measures. No system is completely secure; if a security breach puts your data at risk, we will act as the law requires.

We will update this page when the website or the way we use data changes. The date at the top shows the current version.