Privacy notice

Who the data controller is

• Controller: Tenerife Surprise 2017 S.L., NIF B76760909, Avenida Golf del Sur 25, San Miguel de Abona, Tenerife, Canary Islands, Spain. It is the company that owns Immobiliare alle Canarie.
• Privacy contact: info@immobiliareallecanarie.com, or WhatsApp at +34 642 796 365.
• Data protection officer: Luca Linder, info@immobiliareallecanarie.com.

What data we process and where it comes from

We receive almost all the data from you, when you write to us. Some technical data is collected automatically while you use the site: you'll find it below, along with the rest.

1. What you write to Inmobilio The messages in the conversation and the replies from Inmobilio, the site's artificial intelligence assistant. In the database we store the full text encrypted, plus a copy in which some personal details are replaced by a placeholder (we explain which further down). For each reply we also record, encrypted and separately, the details we replaced with a placeholder, each with its type, and a technical log of the call to the model without the text: the model used, how much text it processed, the cost and the outcome. If you arrive from the ‘Chat with us’ button on a listing, when you open Inmobilio we send it a ready-made question on your behalf with the listing's title and reference: that is part of the conversation too, and we record on the conversation the listing you opened it from. In the same way, if you open Inmobilio from the ‘Chat with Inmobilio’ button in the ‘Property finder’ box at the end of the listing grids, we send it the ready-made question ‘I'd like you to find a home for me’ (on the lists of businesses for sale, ‘I'd like you to find a business for me’) on your behalf, with the place of the page if there is one: that is part of the conversation too.
2. The homes it suggests and what you think of them Inmobilio suggests one home at a time, three at most per conversation, and the next one only after you've told us what you think of the previous one. We record which listing it suggested, in what order, the reason in two lines and your reaction (you like it, you don't, something else) in your words or a summary of them, in the placeholder copy, unencrypted. This information helps the people at the agency follow up with you, and the homes you liked reach us in the notification we receive when you leave us your contact details.
3. Your name and contact details if you leave them, your request if you describe the home you want When we need them to call you back or let you know, Inmobilio asks for your name and a way to contact you: a phone number, a WhatsApp number or an email address. If you leave them, we store them encrypted. You can also leave just your contact details. We also store a hash of your contact details, and of your name if you gave it, calculated with a secret key: this lets us recognise the same contact details, without decrypting them, when they turn up again in another conversation: for a phone or WhatsApp number the hash is calculated on the number reduced to its international form, so we recognise it even when it's written another way. If they're the first contact details you leave us in that conversation, we link the conversation to the person we already know. If instead you'd already left us other contact details in that conversation, and these belong to a person we already know, we don't merge anything on our own, and the same goes for the offer form and the mortgage advice form, and for the ‘Book a consultation’ form: we get a notification, and someone at the agency decides whether it's the same person or two different people. When someone at the agency decides to merge them, or enters by hand contact details of yours that we already have on another record, we merge the two records into one: two records with the same number, even written another way, or with the same email address become one, and where the details differ we keep those of the older record and the most recent consent. When you leave your contact details, Inmobilio asks you the question about contacting you again that you'll find under ‘Why we process it and on what legal basis’: your answer, yes or no, is kept with the date, the language and the exact wording of the question. In the placeholder copy we also replace your name when you introduce yourself (‘my name is…’ and the other phrases we list further down) or sign at the end of a message; a name written another way, or somewhere else in your messages, may stay readable. If you describe the home you're looking for, the home you're selling or letting, or the business you want to sell or take over, Inmobilio also records the request: type of transaction, budget, bedrooms, floor area, locations, property types, notes and, if you tell us, the timing (right away, within three months, within a year or just to find out) and, if you're selling or letting a home, or selling a business, the price you have in mind. It does this even if you don't leave contact details. We ask for your name and contact details so we can get back to you, and when you leave them we get a notification (we explain this under ‘Who receives the data’). We store these criteria as they are, without encryption. Inmobilio doesn't give price estimates: the valuation is done by a person at the agency.
4. The offer you make from a listing If you use the ‘Make an offer’ button, we store the home, the amount, the asking price at that moment, the date, the language of the page, the name and the phone or WhatsApp number you write, the email if you leave one, and your IP address reduced to a hash. We store the name, phone number and email encrypted, each with a hash calculated with a secret key. The hash of the phone number, calculated on the number reduced to its international form, links you to the person we already know, if you had left us the same number, even written another way, and counts the day's offers per number. If you had already left us a name, we don't overwrite it. The IP address, again as a hash, serves only to limit abuse: today, at most 2 form submissions an hour from the same address, and at most three offers a day per number and per home. To other visitors of the same listing we show only the number of people who have made an offer, never the amounts or who made them. The form remembers your name and phone number (not the email) in the browser tab's memory for 15 minutes, like Inmobilio, so that raising your offer doesn't ask for them again: after the 15 minutes, the next time you open the form they are deleted (we explain this on the Cookies page). The offer is not binding: it only becomes binding with a written agreement.
5. Asking for mortgage advice from a listing On the page of a home or business for sale there is a mortgage calculator (a finance calculator, for a business): the sums are done by your browser, and until you ask for advice the numbers you type don't reach us. If you ask for advice, we store the home, the numbers of the calculation (price, deposit, term, interest rate and the estimated monthly payment), the date, the language of the page, the name, and the phone or WhatsApp number or the email you write (one is enough, you can leave both). We store the name, phone number and email encrypted, each with a hash calculated with a secret key; the hash of the phone number, calculated on the number reduced to its international form, or that of the email if you leave no phone number, links you to the person we already know. If you had already left us a name, we don't overwrite it. We write the numbers of the calculation, unencrypted, in a note on your request for that home, the same one used for an offer, which opens or updates your request in our records. The IP address and the contact details, as hashes, are used only to limit abuse: today, at most 2 form submissions an hour from the same address, and at most three requests a day per contact detail and per listing. The form doesn't remember anything in your browser. The form also has an optional box for consent to being contacted again, with the question for people looking for a home that we quote further down, among the legal bases: if you tick it, we record your yes with the date, the language, the home and the exact words of the question; if you don't, we record nothing. The estimate is not an offer from a bank, and a person from our agency handles the advice: from the website this data doesn't go to any bank or other intermediary.
6. The consultation you book on the site If you use the ‘Book a consultation’ button, at the bottom of every page, we store the reason (moving here, or a home), whether you prefer a video call or one of our offices (Tenerife, Gran Canaria, Milan), the day and time you choose, the date of the request, the language of the page, the name, the phone or WhatsApp number and the email you enter (one of the two is enough), the note if you leave one, and the IP address reduced to a hash code. We store the name, contact details and note encrypted; the name and contact details also with a hash code calculated with a secret key: as with offers, the phone code, calculated on the number reduced to its international form, links you to the person we already know. If you had already given us a name, we don't overwrite it. Our server reads the free times from the agency's calendar and immediately marks the time you choose there as ‘Consultation to be confirmed’, without your name, contact details or note. We call you to confirm it; if none of us confirms it within 48 hours, or before it starts if that comes first, the time becomes free again on its own. If the calendar doesn't respond, the request arrives without a time and we call you to set one. The IP address, again as a hash code, is used only to limit abuse: currently at most 30 readings of the free times and 2 submissions of the form per hour from the same address, at most 2 pending consultations from the same address and 20 in total, and one pending per person. The consultation is paid in advance by bank transfer, with the details sent to you by whoever handles the consultation after confirming the time; the site takes no payment and asks for no payment details. The form saves nothing in your browser. The form also has an optional box for consent to being contacted again, with the same question for people looking for a home as the mortgage advice form: if you tick it, we record your yes with the date, the language and the exact words of the question; if you don't, we record nothing.
7. If you contact us by phone, on WhatsApp, in person or through a portal If you call us, write to us on WhatsApp, come to the agency, meet us at a viewing, reach us through a property portal or a social network, or because someone told you about us, and you ask us to help you, a person at the agency may record your name, a phone number or an email address and your request in our records: what you are looking for or offering, the area, the type of property or business, the budget or the price you have in mind, the timing and some notes, together with how you found us. We store your name and contact details encrypted, like those you leave with Inmobilio; the request and how you found us, unencrypted. If your contact details are already in our records, the request is added to the data we already hold. The person who records you looks after you, unless another person at the agency already does, and the rest of the team receives a notification with your name and the request. The legal basis is pre-contractual measures taken at your request (Article 6(1)(b) GDPR).
8. If your request changes Whether you wrote to us through Inmobilio or contacted us another way, if you change your mind after talking to us, a person at the agency updates your request, and if besides looking you also want to sell, let or transfer a business (or the other way round), they open a second one next to the first. They also correct your name, language, contact details and how you found us. The earlier request stays in your client record, as a history of what you asked us for. The legal basis is pre-contractual measures taken at your request (Article 6(1)(b) GDPR).
9. Personal links A person at the agency can send you a personal link to a listing, or Inmobilio could prepare for you (until 6 October 2026) a page with a selection: we store the title, a short message, the chosen listings, the language, who created it, how many times the link is opened and the time it was last opened. The title and message of a selection were written by Inmobilio and could contain your name; those of an agency link are a fixed sentence and a summary of the listing. The agency's link opens the listing's public page with the label ‘Chosen for you’; if the home leaves the site, it leads to the area page. WhatsApp and Telegram previews don't count as openings. The agency's links don't expire and stay tied to your client record in our archive; Inmobilio's expired after 30 days at most. The page doesn't appear in search engines, but anyone with the link can open it, so share it only with people you choose. We can withdraw a link at any time, and you can ask us to.
10. A session code When the first message goes to Inmobilio (the one you write, one of the suggested prompts or the ready-made question of a listing or of the ‘Property finder’ box), your browser creates a random code that holds the conversation together; we store it along with the conversation. In the tab's memory the browser keeps the code, a copy of the conversation so that you can find it again when you move to another page, and the time of the last message: they're valid for at most 15 minutes after the last message, and then the conversation starts over; ‘New conversation’ deletes them straight away, and they normally disappear when you close the tab (we explain this on the Cookies page).
11. Your IP address, only as a hash When you use Inmobilio, we read your IP address and immediately turn it into a hash, a code calculated with a secret key. We use it only to count requests and limit abuse: currently at most 60 messages an hour from the same address and 20 an hour per conversation. We don't store the IP address in readable form. Beyond these limits Inmobilio replies with a fixed text and the message is not stored, not even a phone number it contains. The same hash also limits the notifications we receive: currently at most 2 an hour for contact details left from the same address; beyond that, the contact details stay in our records, with no notification.
12. Your phone number, also as a hash If you leave us a phone or WhatsApp number, as well as storing it encrypted, we use a secret key to calculate a hash of the number converted to international format (digits only, with the country code). It lets us recognise the same number without reading it, however it's written: so we get only one notification a day for the same number, and we recognise you as the same person even when someone at the agency enters your number by hand, and in the summary we receive every morning we count how many times a number that already reached us that day turned up again in another conversation, and how many numbers were left without a notification because of the limit per IP address. The hash stays in our work queue, linked to the conversation. For an email address the hash is calculated on the address: for an email address, too, we get only one notification a day.
13. WhatsApp and email If you write to us on WhatsApp, we receive your number, your profile name and what you write; if you email us, your email address and your message. Some buttons on the site open WhatsApp with a message already written: you send it yourself, if you want to, and you can change it first.
14. The hosting provider's technical logs Like any hosting service, Vercel keeps technical logs of requests to the site, which may contain your IP address and the full address of the page requested, including search filters, the ready-made question from an old Inmobilio link and the address of a personal link. Vercel keeps these logs for one day.

The site has no accounts, sign-ups, newsletters or contact forms: the only forms are the one behind the ‘Make an offer’ button and the mortgage advice form in the calculator on a listing, and the one behind the ‘Book a consultation’ button above the footer of every page, all described above. We don't use visitor statistics tools, advertising pixels or cookies.

Don't write to Inmobilio anything that isn't needed to look for a home, such as identity documents, bank details or health information. To be called back, a name and a way to contact you are enough.

Why we process it and on what legal basis

1. Replying to you and following up your request Answering your questions, searching for suitable properties, calling you back and, only if you expressly ask us to, letting you know when the home you're looking for comes up. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR): you're the one who writes to us and asks us to help you. Without a request from you, or your yes to the question about contacting you again (below), we don't send you proposals by email or on WhatsApp, as Article 21 of the LSSI-CE also requires.
2. Recording your offer and having it assessed Receiving the offer you make from a listing, passing it to the people at the agency, calling you back to discuss it and counting how many people have made an offer on a home, to tell the other visitors to the listing. The legal basis is pre-contractual measures taken at your request (Article 6(1)(b) GDPR).
3. Answering your request for mortgage advice Receiving the request you make from the calculator on a listing, passing it to the people at the agency and getting back to you to talk it over, with the numbers of the calculation. The legal basis is pre-contractual measures taken at your request (Article 6(1)(b) GDPR).
4. Arranging the consultation you ask for Receiving the consultation request, holding the time you choose for you in the agency's calendar, passing it to the people at the agency and calling you to confirm or arrange it. The legal basis is the pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
5. Handling the sale or rental, if you become our client If you entrust us with selling or letting a home, or if you buy or rent through us, we keep the dates of your file (accepted offer, arras, notary, mortgage, contract and its expiry) and of the property's documents (mandate, energy certificate, nota simple, cédula de habitabilidad), and we remind the person at the agency who looks after you. None of these dates goes through an artificial intelligence model. The legal basis is the performance of the mandate or contract you are a party to (Article 6(1)(b) GDPR).
6. Security and preventing abuse Limiting the number of requests, offers and consultations, what Inmobilio spends and the notifications we receive for contact details left from the same IP address, spotting attempts to manipulate Inmobilio and keeping a technical log of operations. Inmobilio has a daily spending cap: once the cap is reached (until midnight, Canary Islands time) or when we switch the model off, Inmobilio replies with a fixed text, not written by artificial intelligence, with our WhatsApp number and email address. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in keeping the site and Inmobilio secure and available to everyone, in protecting the data we hold and in making sure genuine requests still reach us when a lot of contact details come from the same address. Even then, the message you wrote is stored like the others, and if it contains only one phone number we recognise, not counting our WhatsApp, we record it so we can call you back (with two different numbers we record none, because we cannot tell which one is yours): this falls under ‘Replying to you and following up your request’, with its own legal basis.
7. Showing you the map and running the site Showing you the area of a listing on the map and keeping the hosting provider's technical logs. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in showing you where the home is and in running the site reliably and securely. You can object by writing to us.

You're not obliged to give us any data: you can use the site and Inmobilio without saying who you are. Without contact details, though, we can't call you back or notify you.

Only one kind of processing is based on your consent: contacting you again to suggest other properties similar to what you're looking for or, if you're selling or letting a home or selling a business, to put you in touch later on, too, with people looking for something like what you're offering. After you leave us your contact details, Inmobilio asks you a question, always the same one: if you're looking, ‘If something similar comes up, may my colleagues contact you again? Reply yes or no.’; if you're selling or letting a home or selling a business, ‘Later on too, if someone comes along looking for something like what you are offering, may we contact you again? Reply yes or no.’ If you've already answered in an earlier conversation with the same contact details, it doesn't ask again. Answering is up to you, and you can say no with no consequences: without your yes nobody at the agency contacts you again to suggest homes or people looking for what you're offering, but we do call you back about the request you made. With your yes, if something similar comes up or someone comes along looking for what you're offering, a person at the agency contacts you, by phone, on WhatsApp or by email: no automated messages. You can also give us your consent verbally, when you talk to us by phone, on WhatsApp or in person: the person at the agency who takes it records it with their name, the date, the channel and the question they asked you. It counts the same as the consent you give Inmobilio, and you withdraw it in the same way. You can withdraw your consent whenever you want by writing to info@immobiliareallecanarie.com, without affecting what was done before. In the mortgage advice form the same question for people looking for a home, without ‘Reply yes or no’, is an optional box: ticked, it counts as the yes given to Inmobilio, with the same proof and the home you ticked it from; unticked, we record nothing. The same goes for the ‘Book a consultation’ form: the same box, with the same proof, without the home. The legal basis is your consent (Article 6(1)(a) GDPR).

Who receives the data

The data is handled by the people at the agency, the providers that work for us and some third-party services. We list them one by one, with what each of them receives.

1. The people at the agency When you leave us your contact details (a phone number, a WhatsApp number or an email address), we get a notification with what Inmobilio has gathered: the name and contact details you left, the language of the page you're writing from, the request as you have described it to us up to that point and, if there is one, the title and link of the selection with the number of visits, the homes you liked among those Inmobilio suggested and your answer about being contacted again. We need it to call you back. The same goes for an offer: it reaches us with the home, the amount, the name and contact details, and the language. For offers, beyond ten notifications in an hour the offer stays in our records with no notification, and the morning summary says how many there are. The same goes for a request for mortgage advice: it reaches us with the home, the numbers of the calculation, the name and contact details, the language and, if you ticked it, the box about contacting you again; beyond ten notifications in an hour the request stays in our records with no notification, and the morning summary counts these too. And for a consultation: it reaches us with the day and time, the reason, the format, the name, contact details, the note, the language and the box about contacting you again, if you ticked it; whoever among us confirms it, or frees up the time, tells the others. The notification carries the contact details we hold for you. For the chat, we get at most one per conversation and one a day for the same contact details, and for contact details left from the same IP address, at most two an hour: beyond that, the contact details stay in our records, with no notification. If more than ten arrive in an hour, the rest reach us together in a single message after the hour ends: with the details of at most eight and, for the others, only how many there are (their details stay in our records). A request left without contact details stays in our records, with no notification. The notifications and the request data are received, in addition to the controller, by two self-employed collaborators who work with the agency and are bound by confidentiality and by a data processing agreement (Article 28 GDPR). We don't pass them on to other agencies. From the website we don't pass the data of a request for mortgage advice on to banks or other intermediaries.
2. Google, for the Gemini model that writes Inmobilio's replies To write each reply, Inmobilio sends Google your message and the latest messages in the conversation. Before sending, we replace the following with a placeholder: email addresses; phone numbers from Spain, Italy, Germany, France, the United Kingdom and the Netherlands that we recognise, even when written without a country code; DNI, NIE and CIF numbers; IBANs; cadastral references; and the addresses we recognise. We also replace your name when you introduce yourself with one of these phrases: ‘mi chiamo’, ‘il mio nome è’, ‘me llamo’, ‘mi nombre es’, ‘my name is’, ‘ich heiße’, ‘mein Name ist’, ‘je m'appelle’, ‘mon nom est’; and your signature at the end of a message, on the line after the sign-off (‘Kind regards’ and the like), including when two of you sign (‘Tom and Anna’). A name recognised this way is also replaced wherever it appears again, spelt the same, in the same message. What stays readable: a name written another way (for example ‘I'm Anna’, or a signature on the same line as the sign-off); a name written all in lower case or all in capitals; part of a name written on its own (just the first name, after you introduced yourself with your full name); a name written in another message without one of these phrases; and someone else's name. The recognition is automatic: sometimes it covers a word that isn't a name (for example a town written on its own at the end of a message, after the sign-off), and sometimes it lets through a name written in a form it doesn't recognise. A phone number from another country, or written in a form we don't recognise, can go through as it is. Google doesn't receive your IP address or the session code. If you open the chat from a listing, with every message of the conversation, even if you then change page, Google also receives the whole page of that listing (price, floor areas, bedrooms, description, features, the facts about the area): that is data about the home, not about you. If you ask a practical question, Google also receives the title and opening summary of the site guides closest to the question, at most three per search, and the text of the guide that answers it (the title, the opening summary and some frequently asked questions): that is text from the site, not about you. The notifications to the agency, with name, budget and notes, and those for an offer, with the home and the amount, or for a mortgage request, with the home and the numbers of the calculation, or for a consultation, with the day, time, reason and format (not the note), can also go back to Google with the same replacements, because the assistant we use at work rereads the latest messages every time we write to it. In the copy it rereads, we also replace your name, as Inmobilio recorded it or as you wrote it in the offer form, the mortgage advice form or the ‘Book a consultation’ form, with a placeholder wherever it appears spelt the same way (next to your contact details, in the notes, in the selection's title); in the notifications for an offer, a mortgage request or a consultation we also replace your contact details in the same way; in the notification we receive, the name and contact details stay in full. What can stay readable: part of the name written on its own; the name written another way; and someone else's name. We use Google's paid service: Google processes these messages on our behalf, as a processor, under its data processing agreement, and does not use them to improve its products. It keeps them for a limited period, only to detect violations of its rules.
3. Google Calendar, the agency's calendar For the consultation, our server reads the busy times from the agency's calendar on Google Calendar and marks the time you choose there as ‘Consultation to be confirmed’, with the reason and the format. We don't write your name, contact details or note there, and Google doesn't receive your IP address: your browser only talks to our site.
4. Supabase, the database Conversations, contact details, requests, offers, consultations, personal links and selections are kept in a Supabase database, with the data stored in the European Union, in Paris. Only our server can reach it, never your browser.
5. Vercel, which hosts the site The site is hosted by Vercel, with the server functions in Frankfurt. Messages to Inmobilio and the technical logs of visits pass through there.
6. Telegram, where we receive notifications The notifications with your data reach us on Telegram, the messaging service we use at the agency. We also keep a copy in our database, as with Inmobilio's messages: the full text encrypted and a copy with placeholders. Telegram doesn't work on our behalf: it processes these messages as an independent controller, under its own privacy policy (telegram.org/privacy). It keeps the data of European users in the Netherlands and may transfer it to the companies in its group in the British Virgin Islands and in Dubai, with the European Commission's standard data protection clauses.
7. OpenStreetMap, for the map on listing pages On listing pages with a location, your browser downloads the map tiles from OpenStreetMap without you needing to click, when you open the page or, at the latest, when you scroll down to the map. OpenStreetMap receives your IP address, your browser's details, the area shown and our site's name, as the site you're coming from. It receives nothing else. The OpenStreetMap Foundation, based in the United Kingdom, doesn't work for us: it processes this data as an independent controller, under its own privacy policy (osmfoundation.org).
8. WhatsApp, if you write to us there The messages you send us on WhatsApp pass through WhatsApp's servers. We use the WhatsApp Business app: for your contact details, WhatsApp Ireland Limited works on our behalf, as a processor, under its data processing terms for businesses; for everything else, it processes the messages under its own terms. The chats stay on the agency's phone, with an encrypted backup in the agency's Google account.
9. The email provider The emails you send us pass through the provider of our mailbox, SiteGround (SiteGround Hosting Ltd., United Kingdom), which processes them on our behalf, as a processor, under its data processing agreement.

Data outside the European Economic Area

Google, Vercel, Telegram and Supabase are companies that also operate outside the European Economic Area: even when the data is stored in Europe, like our database in Paris, some of it may be processed elsewhere, under their contracts. The OpenStreetMap Foundation is based in the United Kingdom. Chapter V of the GDPR allows these transfers only to countries for which the European Commission has decided that the protection is adequate (Article 45), or with appropriate safeguards, such as the standard data protection clauses adopted by the Commission (Article 46).

• Google: standard data protection clauses, and Google LLC participates in the EU-US Data Privacy Framework.
• Vercel: the EU-US Data Privacy Framework and standard data protection clauses, in its data processing agreement.
• Supabase: standard data protection clauses, in its data processing agreement; our database is in the European Union, in Paris.
• Telegram: standard data protection clauses, as Telegram states in its privacy policy.
• WhatsApp: the EU-US Data Privacy Framework for transfers to WhatsApp LLC and Meta Platforms, Inc., and, as an alternative, standard data protection clauses.
• SiteGround: the United Kingdom, where it is based, has an adequacy decision; for other transfers, standard data protection clauses.
• OpenStreetMap Foundation (United Kingdom): adequacy decision (EU) 2021/1772, renewed by Implementing Decision (EU) 2025/2574 until 27 December 2031.

The safeguards can be found on each provider's public pages on data processing; you can also ask us for a copy, at info@immobiliareallecanarie.com.

How long we keep the data

We keep the data of people who don't become our clients for 24 months from the last contact: every time you write to us again, or we speak, the clock starts again. When that period ends, we block the name, contact details, messages and requests: they leave our working records, the contact details can no longer be recognised and we no longer use them; they are kept restricted, only for courts and authorities, until any liabilities are time-barred, and then we destroy them. We delete those that came in on WhatsApp and by email, and in the end only anonymous figures remain for statistics. If you become our client, we keep the data for as long as the relationship lasts and then, for the data that anti-money-laundering law requires estate agents to keep, for ten years from the end of the relationship or from the transaction (Ley 10/2010, art. 25).

When the data expires, or when you ask us to delete it, we block it as described above and then destroy it. From our database we remove straight away the placeholder copy of the messages, the notes on the requests and the reasons for, and the words of your reactions to, the homes Inmobilio suggested, and your client record leaves our working records; the name, contact details and encrypted text of the messages stay blocked until they are destroyed. We remove the details we had replaced with a placeholder once they are more than 24 months old. We also delete the notifications from the Telegram chats of the people at the agency and from the memories of the assistant we use at work, and the conversations from WhatsApp and from email. All that remains in the technical log is the fact that a deletion took place, without your data. Once a month the system shows us who has passed the 24 months, and the data are blocked only when someone from the agency confirms it; when you are the one asking us, we do it within one month of the request.

A personal link from the agency doesn't expire: it stays open until we withdraw it, even if the home leaves the site (it then leads to the area), and it stays in the database with your client record, under the same 24-month rules; if we delete your client record, the link disappears with it. The link to an Inmobilio selection stops working when it expires, but the selection stays in the database until we delete it. Offers and consultations stay with your client record for the same time and disappear with it. The same goes for requests for mortgage advice. You can ask us to delete your data at any time by writing to info@immobiliareallecanarie.com.

When we delete data, Spanish law (Article 32 LOPDGDD) first requires us to block it: we no longer use it for any purpose and keep it confidential only so that it can be made available to the courts and the authorities in connection with any liability, until that liability is time-barred. Then we destroy it.

How we protect the data

• The full text of messages, and the name and contact details you leave us, and the consultation note, are stored encrypted. What isn't encrypted: the placeholder copy of the messages, where the names we don't replace and some details we don't recognise remain readable; the criteria, notes and timing of the request and the price you have in mind; how you found us, if we record you ourselves, and who took your verbal consent; the reasons for, and your reactions to, the homes Inmobilio suggests; your answer about being contacted again; the amount and asking price of offers; the reason, format, day and time of consultations; the numbers of the mortgage calculation you send us; the title and message of personal links and selections.
• The IP address immediately becomes a hash calculated with a secret key and is not stored in readable form.
• Your phone number, too, becomes a hash calculated with a secret key, so we can recognise it without reading it; in our contact records the real number stays encrypted.
• The artificial intelligence model receives the messages with placeholders instead of the details we can recognise.
• Only the site's server can reach the database; your browser never talks to it directly.
• In the site's error logs we write the technical message, never the text you wrote.

Your rights and how to exercise them

You have these rights over your data, under Articles 15 to 22 of the GDPR and the LOPDGDD:

• Access: to know whether we process your data and to get a copy.
• Rectification: to correct data that is inaccurate or incomplete.
• Erasure: to have it deleted when it's no longer needed or if we process it without a legal basis.
• Restriction: to ask us to suspend processing, for example while we check something you've contested.
• Portability: for the data you gave us yourself so that we could follow up your request, to receive it in a structured, commonly used and machine-readable format, or to have it sent to another controller.
• Objection: to object to processing based on our legitimate interest.
• Withdrawal of consent: where processing is based on consent, to withdraw it at any time.

To exercise them, write to info@immobiliareallecanarie.com, saying which right you want to exercise and giving the name or contact details you left us, or the date of the conversation, so that we can find your data. It's free. We reply within one month; if the request is complex, this can be extended by two further months, and in that case we'll tell you. If we're not sure the request comes from you, we may ask you for some information to verify this.

If you're not satisfied: making a complaint

If you think we're handling your data improperly, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD), the Spanish data protection authority, through its online office (sede electrónica), or with the supervisory authority of the EU country where you live or work. If the problem concerns a right we haven't honoured, the AEPD asks you to contact us first: write to us, and we'll try to sort it out.

Artificial intelligence and automated decision-making

Inmobilio is an artificial intelligence: it searches the published listings, records the contact details you leave us and what you tell it you're looking for or offering (a home to buy, sell or rent, a business to sell or take over); it answers practical questions with the site's guides: our server searches, without artificial intelligence and without storing anything more, for the guides closest to the keywords Inmobilio draws from your question; from these Inmobilio picks the one that answers it, and uses its text. It uses the criteria you give us only to suggest suitable properties: no decision producing legal effects concerning you or similarly affecting you, no advertising profiles, no cross-referencing with other data.

In our records every request has a stage, for example ‘new’, ‘viewing’ or ‘offer’, and someone from the agency who follows it. For people looking for a home we also work out a priority, hot, warm or cold, with written rules that are the same for everyone: whether you have left us a phone number, a budget, an area and the type of home, whether we have already reached the viewing or the offer, and how many days have passed since you last wrote to us or we last spoke. It is only for us, to know whom to call back first: it decides nothing about you and has no effect on you. Every night a program, with written rules and without artificial intelligence, reads through our records and prepares a list of reminders for the people at the agency: a request nobody is following, or someone we haven't spoken to yet; a request stuck at the same stage for weeks; people selling or letting with us whom we haven't spoken to for a week; properties, ours or from the agencies we work with, that match the criteria you have given us. This too is only for us: it writes nothing to you, sends your data to no one and decides nothing about you; every step is decided by someone from the agency.

Negotiations, prices, terms and every commitment are decided by someone from the agency, who is also the person who calls you back.

If this notice changes

If we change the way we process data, for example with a new provider or a new service on the site, we update this page and the date of the last update before the change takes effect.