Back to home

Privacy policy

Controller

Bellavista Real Estate S.L., C/ de la Cadernera 9 A, Son Ferriol, 07198 Palma de Mallorca, Illes Balears, España. Privacy contact: info@bellavista-mallorca.de. See the legal notice for further operator details. These particulars require confirmation before publication. A data protection officer will be identified only if one has been appointed.

Website access and security

The infrastructure processes IP addresses, requested URLs, time and technical browser information as needed to deliver the website, troubleshoot and prevent abuse. The basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, reliable website. The current draft uses local fonts, images and video and our own website endpoints. Vercel is the selected host; the provider section below describes the confirmed infrastructure.

Contact, property enquiries and owner advice

We process the names, email address, telephone number, message and purpose you provide. Depending on the enquiry, this includes a property reference, buying or rental preferences, stay dates, guest count, move-in date, rental term, budget or details of your property. The enquiry and handling history are stored in our CRM and assigned to the relevant team. Requested pre-contractual assistance and contract performance rely on Article 6(1)(b) GDPR. Other correspondence relies on our legitimate interest in answering your enquiry under Article 6(1)(f). A privacy acknowledgement is not newsletter consent.

Member accounts and sign-in

Sign in with an email code, or with SMS, Google or Apple where offered. We store the verified sign-in identifier, name, registration and latest sign-in time, linked CRM contact and any search preferences you choose to provide. Search preferences are optional. Additional sign-in methods must be verified. Google and Apple provide an account identifier and, where shared, name and email; Apple may provide a relay address. Email codes use Resend; SMS codes use Twilio when enabled. You can edit your profile or delete your account from My Bellavista. Deletion removes the website account, sign-in links, favourites and search profile and ends every session. Existing enquiries or business records may be retained separately to handle the request and applicable retention requirements.

Saved properties and language

For signed-in users, favourites and preferred language are stored with the account and favourites are available across devices. Guest favourites remain in the browser. Contact form values are not stored in browser local storage.

Newsletters and promotional messages

The footer newsletter form does not currently submit a subscription; no mailing service is connected. A separate optional newsletter choice in the member profile is stored as a CRM preference and is not a condition of access. Before newsletter launch, the sending process, consent evidence and easy unsubscribe must be configured. Promotional email requires an appropriate legal basis. Planned newsletters rely on separate consent under Article 6(1)(a) GDPR and applicable LSSI rules. You may withdraw through the unsubscribe link provided with that service or by email.

Google Maps

Embedded maps load only after you actively allow them. Google then receives information including your IP address, browser data and requested map area, and may associate information with existing accounts or storage. The EEA provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing by affiliates, including in the USA, is possible. The basis is consent under Article 6(1)(a) GDPR and Article 22.2 LSSI where applicable. You may withdraw in privacy settings at any time, removing embedded maps. This cannot retrieve information already sent to Google. See Google’s privacy policy for recipients, transfers and safeguards. Following an external map link separately navigates to Google.

Social media and WhatsApp

Instagram, Facebook and WhatsApp are ordinary external links. Merely displaying the icons does not load social plugins. The provider processes data when you open its link. If you contact us there, we use the information you share to handle your enquiry. Email and telephone are available alternatives.

Recipients and transfers

Access is limited to authorised staff and the technical providers listed below. For a specific transaction, necessary information may be disclosed to involved owners, buyers, tenants, appointed advisers or competent authorities where necessary for the instruction and supported by a legal basis. International transfers and safeguards are described in the provider section.

Retention

Enquiry and profile data are needed while your request, requested assistance or account remains active. They should then be deleted or, where legal retention duties or reasonably anticipated claims apply, restricted to those purposes and protected against unrelated access. Contract, invoice and, where applicable, anti-money-laundering records follow the relevant statutory periods. Indefinite blanket retention is not intended. Technical session and browser durations are listed in the cookie information.

Your rights

Subject to legal conditions, you may request access, rectification, erasure, restriction and portability. You may object to legitimate-interest processing for reasons relating to your situation and object to direct marketing at any time. Consent may be withdrawn prospectively without affecting earlier lawful processing. Contact info@bellavista-mallorca.de. We may request information needed to identify the relevant records; do not send unsolicited identity-document copies. Requests are generally answered within one month; legally permitted extensions will be explained. You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

Automation, sensitive information and changes

The CRM may match stated search preferences to properties and prepare tasks or communication drafts. The reviewed website does not make solely automated decisions about concluding a sale or rental with legal or similarly significant effects. No external AI processing of personal enquiries was identified in the reviewed flow. Do not send identity, health or banking documents through general enquiry forms. Where needed, a separate secure process and further information are required. We update these notices before introducing relevant changes to services or providers.

Hosting, database, email and domain

Bellavista has selected the following providers for production. The local website preview does not establish that the technical migration has been completed.

The bases are the requested services under Article 6(1)(b) GDPR and secure technical operation under Article 6(1)(f), as described above. Processing on our behalf requires an Article 28 GDPR processing agreement.

Vercel, Supabase and Resend may process data outside the EEA, including in the USA. Exclusively European processing is not promised. Their linked processing terms provide, in particular, EU Standard Contractual Clauses for relevant transfers. The applicable service agreements and Chapter V GDPR transfer arrangements govern the specific processing. Contact us for information about the safeguards applicable to your data.

Optional website statistics

Statistics start only after your separate permission in Privacy settings. We measure page views, referring websites or campaign tags, approximate country when available, device category, pages visited in sequence and selected actions such as brochure, contact or viewing clicks. We do not store raw IP addresses, form contents, chat text or customer-account identifiers in these events. Browser and visit identifiers are pseudonymous. Raw measurement data is retained for up to 90 days. You can withdraw permission at any time; data associated with the current browser identifier is then removed. Visitor numbers are estimates for consenting browsers, not a complete count of people. Registration and enquiry totals are separate operational CRM counts.

This feature is not connected in the local design preview.