Sunset Hills (hereinafter referred to as “we”, “us”, “our” or “the Administrator”) respects your privacy and processes personal data in strict compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – “GDPR” / “RODO”), as well as with other applicable provisions of Polish and European Union law on personal data protection.

This Privacy Policy explains who we are, what personal data we collect through our website https://nh357.webvertio-projects.pl (hereinafter: “Website”), why and on what legal basis we process it, how long we store it, who has access to it, what rights you have in relation to your data, and how to contact us.

1. Data Controller (Administrator Danych Osobowych)

The controller of your personal data is:

Sunset Hills operated by / represented by an international real estate team based in Marbella, Spain Office address: Calle Ávila 17, Local 2, San Pedro de Alcántara, 29670 Marbella, Málaga, Spain

Contact details: Email: info@sunsethillsmarbella.com Phone: +34 677 264 202 / +34 711 011 581

For matters related to personal data protection, you can contact us directly at the above email address with the note “RODO / GDPR” or “Ochrona danych osobowych”.

2. Scope of processed personal data

We process only the personal data that you voluntarily provide to us or that is necessary for the proper functioning of the Website and the services we offer. Depending on the purpose and the way you interact with the Website, we may process the following categories of data:

• identification data (first name, last name, company name if applicable)
• contact data (email address, telephone number, country / city of residence)
• data related to your interest in real estate (preferred location on the Costa del Sol, type of property: villa / apartment / plot, budget range, number of bedrooms, intended use: primary residence / holiday home / investment, preferred language of communication)
• data provided in correspondence or enquiry forms (content of messages, attachments if any)
• technical data collected automatically (IP address, browser type and version, operating system, device type, approximate geographic location based on IP, date and time of visit, viewed pages, referral source, cookies and similar technologies)

We never process special categories of personal data (sensitive data) within the meaning of Art. 9 GDPR unless you explicitly provide them in the enquiry and it is necessary to respond to your request.

3. Purposes and legal bases for processing

We process your personal data only for clearly defined purposes and on an appropriate legal basis. The main purposes and corresponding bases are as follows:

a) Responding to your enquiries, presenting property offers, arranging viewings, negotiations and providing real estate consulting services – Legal basis: Art. 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract / performance of a contract (if already concluded) – Art. 6(1)(f) GDPR – legitimate interest of the Administrator (direct marketing of own services, building and maintaining business relationships in the real estate sector)

b) Sending commercial information (newsletter, offers of new properties, market reports, invitations to events) – only if you have given explicit consent – Legal basis: Art. 6(1)(a) GDPR (consent) + Art. 10 of the Act on Provision of Electronic Services / Art. 172 of the Telecommunications Law (electronic communication consent)

c) Ensuring the proper functioning of the Website, analysing traffic, improving user experience, detecting errors and security incidents – Legal basis: Art. 6(1)(f) GDPR – legitimate interest (operation and development of the Website, IT security, defence against cyberattacks)

d) Establishing, defending and pursuing claims – Legal basis: Art. 6(1)(f) GDPR – legitimate interest (protection of our rights)

e) Fulfilling legal obligations (tax, accounting, responding to requests from supervisory authorities) – Legal basis: Art. 6(1)(c) GDPR – legal obligation

4. Cookies and similar technologies

The Website uses cookies and other tracking technologies. Detailed information, including the types of cookies, their purposes and how to manage them (including withdrawal of consent), is available in our separate Cookies Policy, which is displayed via the cookie banner on first visit and is permanently linked in the footer of the Website.

5. Recipients of personal data

Your personal data may be transferred to the following categories of recipients:

• authorised employees and collaborators of Sunset Hills who need access to perform their duties
• entities providing technical and organisational support (hosting provider, cloud services, IT maintenance company, email marketing platform – only to the extent necessary and under data processing agreements)
• entities supporting marketing activities (only with your separate consent)
• law firms, tax advisors, auditors – in case of need to establish, defend or pursue claims
• public authorities (Police, Prosecutor’s Office, UODO / Polish SA, tax offices) – when required by law

We do not transfer your data to third countries outside the EEA unless appropriate safeguards are in place (standard contractual clauses, adequacy decision, binding corporate rules) and you have been informed in advance.

6. Data retention period

We store your personal data only for as long as necessary to achieve the purposes for which it was collected:

• enquiry / correspondence data – for the duration of the business relationship and thereafter for the period of limitation of claims (usually 6 years, or 3 years for consumer claims)
• marketing consent data – until consent is withdrawn
• technical / analytical data (logs, cookies) – up to 12–24 months or until the purpose expires
• accounting / tax documents – for the period required by law (usually 5 years)

After the retention period, data is either permanently deleted or anonymised.

7. Your rights under the GDPR / RODO

You have the following rights in relation to your personal data (subject to statutory conditions and exceptions):

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (“right to be forgotten” – Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing based on legitimate interest or for direct marketing (Art. 21 GDPR)
• right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)
• right to lodge a complaint with the supervisory authority – in Poland: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl

To exercise any of the above rights, please contact us at info@sunsethillsmarbella.com with the note “RODO / GDPR – exercise of rights”.

8. Data security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of transmission (HTTPS/SSL), access control, regular security updates, backup procedures and monitoring for unauthorised access attempts.

9. Changes to the Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology or our services. The current version is always available on the Website with the effective date indicated at the top. Significant changes will be communicated via a prominent notice on the Website or by email (if we have your address for communication).

10. Final provisions

This Privacy Policy is governed by Polish and European Union law. Any disputes shall be resolved by the competent courts having jurisdiction over the registered office of the Administrator.

If you have any questions regarding the processing of your personal data, we encourage you to contact us directly – we are happy to provide explanations and support.

Thank you for your trust.