1. DATA CONTROLLER

Version: 2026-09-25
Last updated: 25 September 2026

This Privacy Policy explains how personal data processed through the website realestatescostablanca.com (hereinafter, the Web), the REC application (hereinafter, the App) and the services, tools and features associated with both channels are collected, used, retained, disclosed and protected.

The Web and the App operate under the REC brand.

This Policy provides the additional or detailed data protection information applicable to the processing described in it. Where necessary, forms and specific data collection points may also display specific summary information about the relevant processing.

The Data Controller for personal data collected or processed through realestatescostablanca.com, the REC App and the associated services is:

Pascale Annie Degryse Meuleman
NIF: 48338942A

Avenida L'Albir, 66-68
03581 El Albir / L'Alfàs del Pi
Alicante
España

Email:

support@realestatescostablanca.com

For the purposes of this Policy, references to REC identify the brand and the services provided by the Data Controller identified above.

REC services include, among others, the Web, the App, REC Tools, property listing features, Professional services and related features offered through those channels.

2. SCOPE

This Policy applies to personal data processing carried out through:

• the website realestatescostablanca.com;
• the REC App;
• REC Tools;
• forms available on the Web or in the App;
• user accounts and profiles;
• property listings and enquiries;
• Professional services;
• image processing tools;
• favourites, searches, alerts and notifications;
• contracting and payment processes;
• communications with REC;
• contact initiated through listings;
• administrative, verification, billing or support processes;
• personalisation, security and abuse prevention features.

It also applies when a person:

• browses the Web;
• uses the App;
• creates or uses an account;
• lists, saves, views or manages properties;
• uses REC Tools;
• purchases products or services;
• uses a Professional account or profile;
• configures alerts, favourites or notifications;
• uses forms or contact methods;
• interacts with personalisation or security features.

Certain external services accessible from the Web or the App have their own terms and privacy policies.

3. PERSONAL DATA WE MAY PROCESS

Depending on the channel used and the service requested, REC may process the following categories of information.

Identification and account data

Name, email address, user identifiers, authentication data, sign-in provider, session information and other data necessary to create or administer an account.

Contact data

Email address, telephone number or WhatsApp details when provided for a specific purpose.

Professional data

Trading name, professional information, description, website, contact details expressly configured as public, tax or business information where necessary, declarations, supporting credentials and data associated with the service or plan purchased.

Property data

Information about properties, features, prices, location, address, photographs, documentation, description, references, publication status and other information necessary to list, search for, view or manage a property.

Images and files

Photographs and other files submitted through the Web or the App for publication, property management or processing through REC Tools.

Images may incidentally contain information that makes it possible to identify people, vehicle registration plates, documents, addresses or other personal elements.

Browsing, usage, preference and interest data

REC may process information about browsing the Web or the App, searches, favourites, properties viewed, areas, cities, property types, prices of interest, interaction with certain features and other signals used to provide or personalise the service.

REC may generate limited interest classifications or scores for personalisation, recommendations or commercial suggestions.

Technical and security data

IP address or other technical identifiers, device, browser, session information, tokens, integrity signals, technical logs, access attempts, usage limits and information necessary to prevent fraud, abuse, unauthorised access or improper use of the service.

Notifications

Device tokens, preferences and permissions relating to notifications.

Contracting and payment data

Product purchased, transaction identifiers, customer or subscription identifiers, payment status, tax and billing information and other data necessary to manage the contract.

Payments are processed through Stripe. When payment is made through Stripe-hosted Checkout, REC does not receive the full bank card number.

Data stored in the browser or device

REC may use browser or device storage to maintain drafts, favourites, preferences, navigation states, tool operations, payment returns and certain personalisation features.

Cookies and similar technologies are additionally governed by the Cookies Policy.

4. PURPOSES AND LEGAL BASES

REC processes personal data for the following purposes.

Provision of the service

Creating and administering accounts, listing and managing properties, providing REC Tools, managing Professional features, searches, favourites, alerts, notifications and other requested services.

Legal basis: performance of a contract or taking pre-contractual steps.

Handling enquiries and requests

Managing forms, information requests, support and communications received through the Web, the App, email or other available channels.

Legal basis: taking pre-contractual steps, performance of the service, legitimate interest in handling communications received or consent where applicable.

Payment and contract management

Managing payments, subscriptions, additional products, billing, issues and rights associated with the service purchased.

Legal basis: performance of the contract and compliance with legal obligations.

Publication of content

Publicly displaying property or profile data that must be made public to provide the requested service.

Legal basis: performance of the requested service.

Operational communications

Sending verification messages, account recovery messages, security notices, administrative communications, requested alerts and other communications necessary to provide the service.

Legal basis: performance of the service, compliance with legal obligations, legitimate interest where applicable or consent where required.

Personalisation

Using activity, preferences, searches and interest signals to rank or recommend content, provide a more relevant experience or suggest certain actions.

Legal basis: performance of the service, legitimate interest where appropriate and consent where legally necessary.

Security and abuse prevention

Detecting fraud, abuse, improper automated use, unauthorised access and anomalous operations, and protecting REC’s infrastructure, users and services.

Legal basis: REC’s legitimate interest in maintaining the security and reliability of its services and, where applicable, compliance with legal obligations.

Legal compliance and defence of rights

Complying with tax, accounting, administrative, regulatory, fraud prevention and, where applicable, anti-money laundering obligations, responding to requests from authorities, and establishing, exercising or defending legal claims.

Legal basis: compliance with legal obligations and legitimate interest in the defence of rights.

Commercial communications

Where a communication is commercial in nature and requires consent, REC will use the information only where there is a valid basis for doing so and will allow consent to be withdrawn or an objection to be made where applicable.

5. MANDATORY AND OPTIONAL DATA

Certain data are necessary to create an account, make an enquiry, list a property, purchase a service, carry out an operation or use a particular feature.

Where data are mandatory, the relevant interface will endeavour to indicate this.

Failure to provide necessary information may prevent the requested service from being provided.

Data that are not necessary for a particular purpose must not be understood as mandatory merely because fields for them are available on the Web or in the App.

6. PUBLIC AND PRIVATE DATA

REC distinguishes between information intended for publication and internal or private data.

When a user lists a property or publishes a Professional profile, certain information may become publicly accessible through the Web, the App or other REC presentation channels.

REC uses separate structures for public information and internal records.

Private contact, authentication, billing, security or administrative data do not automatically become public information.

In Professional profiles, public contact information comes from the configuration provided for that purpose. REC does not automatically use the account’s private email address or telephone number as public data.

The precision with which a property’s location is displayed depends on the configuration and feature used.

The user must review information configured as public before publishing it.

7. SOURCES OF DATA

Data may come:

• directly from the user;
• from forms used on the Web or in the App;
• from the use of REC services;
• from browsing and using the Web or the App;
• from the browser or device used;
• from operations carried out through integrated providers;
• from other users when they lawfully provide information relating to a transaction;
• from automated systems necessary for security, operation, personalisation or provision of the service.

When REC receives personal data from third parties, it will process only data that are necessary and have a lawful basis for the relevant purpose.

8. RECIPIENTS AND PROVIDERS

REC uses technology providers and external services necessary to provide certain features of the Web and the App.

Services currently integrated may include:

• Google / Firebase, for authentication, databases, storage, security and notifications;
• Google Gemini, for certain image processing or analysis features;
• OpenAI, for certain image editing features;
• IONOS, for transactional email communications;
• Stripe, for Checkout, payments, subscriptions, billing and associated tax features;
• Firebase Cloud Messaging, for notifications;
• App Check / reCAPTCHA Enterprise, for security and abuse prevention;
• OpenStreetMap and Nominatim, for maps and geocoding;
• Google Fonts, for font resources;
• WhatsApp, when the user chooses to open an external contact link.

Not all these providers or external services necessarily act in the same legal capacity.

Some may process information on behalf of REC, while others may provide services also subject to their own terms and responsibilities.

The infrastructure or specific providers used by the Web may be updated when the technical architecture changes. Where a change involves relevant new processing of personal data, this Policy will be updated where necessary.

REC does not sell users’ personal data.

9. INTERNATIONAL TRANSFERS

Part of the technological infrastructure used by REC may involve processing data outside the European Economic Area.

In particular, the infrastructure currently used for Firestore and Firebase Storage is located in us-central1, Iowa, United States.

This location must not be understood as the location of all Google services or all other providers used by REC.

Other technology services may use international infrastructure depending on the service, provider, configuration and actual location of processing.

Where processing involves an international transfer of personal data, the legal mechanism applicable to the specific service will be used, which may include:

• an adequacy decision of the European Commission;
• the EU-US Data Privacy Framework where applicable to the recipient and the processing;
• standard contractual clauses approved by the European Commission;
• or another valid safeguard under Chapter V of the GDPR.

The specific applicable safeguard may vary according to the provider, service, contracting entity and actual location of processing.

10. DATA RETENTION

REC retains data only for as long as necessary for the purpose for which they were collected and for any additional periods necessary to comply with legal obligations or address potential liabilities.

Account and service

An account’s operational data are retained while the account remains active and are subsequently deleted, restricted or retained according to their nature and purpose.

Business, contractual and accounting documentation and supporting records

Where data form part of documentation that must be retained under applicable business obligations, they may be retained for six years, without prejudice to other legally required special periods.

Tax obligations

Data necessary for tax obligations will be retained for the legally required periods and, where they form part of documentation justifiably subject to a longer period, for that period.

Prevention of money laundering

Where REC processes documentation specifically subject to legal obligations concerning the prevention of money laundering or terrorist financing, it may retain it for ten years on the terms required by law.

This period does not automatically apply to all account data or all users.

Evidence of contracting and declarations

Acceptance of terms, versions, dates, declarations, supporting records and evidence necessary to demonstrate a contractual relationship may be retained for the period necessary to comply with legal obligations or establish, exercise or defend legal claims.

Security and abuse prevention

Records intended for security, usage limits, fraud prevention or investigation of incidents will be retained only for the period necessary for those purposes.

REC Tools

Temporary files used for image processing through REC Tools may be retained for a maximum operational period of seven days and may be deleted earlier when no longer necessary.

Temporary download URLs may expire before the file itself.

Following the operational deletion of an object, technical recovery or backup copies managed by the infrastructure provider may temporarily remain, without this meaning that the file remains normally available through REC.

Local device data

Locally stored data may remain until they are deleted, expire, are replaced or the account is closed, depending on their purpose.

When an account is deleted, REC deletes local data attributable to that account that it can safely identify, without indiscriminately deleting information belonging to other users or scopes.

When data are no longer necessary, they will be deleted, anonymised where appropriate or retained with restricted use where there is a legal obligation or legitimate need to retain them.

11. SECURITY

REC applies technical and organisational measures intended to protect information against loss, alteration, unauthorised access, misuse or disclosure.

Measures used may include:

• authentication;
• authorisation controls;
• separation of public and private information;
• record ownership controls;
• App Check and reCAPTCHA Enterprise;
• request rate limiting;
• anti-fraud and anti-abuse mechanisms;
• temporary links;
• integrity checks;
• restrictions on access to internal data.

No system connected to the Internet can guarantee absolute security.

REC will review and adapt its measures when risks or infrastructure change.

12. AUTOMATED DECISIONS, PERSONALISATION AND ARTIFICIAL INTELLIGENCE

REC uses certain automated processes for operation, security, personalisation and provision of the service.

These may include:

• matching searches with properties;
• interest scores or classifications;
• recommendations;
• ranking or identifying opportunities;
• quota controls;
• payment validation;
• abuse prevention;
• automated image checks.

REC may carry out limited interest profiling based on user activity, such as properties viewed, preferences, searches or interaction signals.

Under the architecture currently implemented, interest classifications used for personalisation or commercial suggestions are not used to determine prices, grant financing or make legal decisions about a person.

Some automated controls may temporarily restrict operations for reasons relating to security, quotas, payment or service integrity.

Certain Professional processes retain administrative involvement.

REC does not intend to subject users to decisions based solely on interest profiles that produce legal effects or similarly significantly affect them.

Where the legal rules on automated decision-making apply, the user may exercise the rights provided by law.

13. PHOTOGRAPHS, IMAGES AND REC TOOLS

Images uploaded through the Web or the App may be used to publish or manage a property or to run a tool requested by the user.

Depending on the tool:

• Improve Photos may send the image and necessary instructions to Google Gemini;
• Remove Objects may send the image, mask and instructions to OpenAI;
• Privacy Protect may send the original image to Google Gemini to detect potentially sensitive regions; the final blurring, pixelation or masking is applied in the browser.

Privacy Protect must therefore not be understood as an entirely local feature.

REC endeavours to limit the information transmitted to what is necessary to run the relevant tool.

A photograph may contain personal data even if the user has not expressly entered them in a form.

The user must avoid uploading images or documents containing third parties’ personal data where the user does not have a lawful basis for using them.

Files downloaded by the user to their own device remain under their control and cannot subsequently be deleted from that device by REC.

14. THIRD-PARTY DATA

When a user provides another person’s personal data, publishes photographs showing third parties or provides information relating to owners, representatives, clients or other people, the user must have a lawful basis for doing so.

The user must not use the Web, the App or REC services to publish third-party data unlawfully, unnecessarily or disproportionately.

REC may remove or restrict content where there is a legitimate reason to protect third-party rights or comply with legal obligations.

15. MINORS

The Web and the REC App are not specifically directed at minors.

In Spain, where consent-based processing relates to a person under fourteen years of age, consent from the person exercising parental responsibility or guardianship will be required on the terms established by law.

Certain services, particularly those relating to contracting, professional publication or legal relationships concerning property, may require the user to be of legal age or have sufficient legal capacity.

16. INDIVIDUAL RIGHTS

The data subject may exercise, where applicable, the rights recognised by data protection law, including:

• access, to find out what data REC processes;
• rectification, to correct inaccurate data;
• erasure, to request deletion where applicable;
• objection, to object to certain processing;
• restriction, to request that processing be restricted in certain circumstances;
• portability, where applicable;
• withdrawal of consent, without affecting the lawfulness of processing before its withdrawal;
• and applicable rights concerning certain automated decisions.

Exercising a right does not necessarily entail the deletion of all information.

REC may be required or entitled to retain certain data with restricted use for tax, accounting, contractual, regulatory or security reasons, or to establish, exercise or defend legal claims.

Requests may be sent to:

support@realestatescostablanca.com

REC may request reasonable information to verify the requester’s identity before acting on a request.

17. COMPLAINT TO THE AEPD

If a person considers that REC has processed their data in breach of the law, they may lodge a complaint with the:

Agencia Española de Protección de Datos — AEPD

It is not mandatory to complain to REC first in order to exercise this right, although the data subject may contact REC if they wish to try to resolve the matter beforehand.

18. ACCOUNT DELETION

The user may request deletion of their account through the mechanisms available in REC or by contacting the Data Controller.

Account deletion aims to remove operational information associated with the user and eliminate their public presence where applicable.

For a Professional account, deletion entails, among other consequences:

• removal of the public profile;
• preventing the reserved slug from resolving to an active profile;
• removal of the public presentation and Branding;
• removal of public contact details;
• removal of Professional listings that remain publicly active;
• release of the associated capacity;
• deletion of files attributable to the account where applicable.

REC may retain a minimal internal record allowing it to demonstrate that the account was deleted, prevent incorrect reactivation, manage previously used identifiers or retain evidence that must lawfully be kept.

Account deletion does not entail the immediate destruction of documentation that REC is required or entitled to retain for legal, tax, accounting, contractual, regulatory or security reasons, or for defence against legal claims.

These data will be restricted to those purposes and will not be used to maintain the deleted public profile.

19. PRIVACY AND PUBLICATIONS

The user must distinguish between information provided to REC privately and information they choose to publish through the Web or the App.

Data intended for a public listing, Professional profile or other publication may be viewed by third parties.

Once published, third parties may have viewed, saved or shared them outside systems controlled by REC.

Deleting a publication from REC prevents its future availability through systems controlled by REC, but does not allow REC to guarantee the deletion of copies previously made by third parties or lawfully retained outside REC.

REC endeavours to apply the principle of data minimisation and not to make public data that are unnecessary for the relevant publication purpose.

20. CHANGES TO THIS POLICY

REC may update this Policy when there are changes to:

• the Web or the App;
• services and features;
• processing activities;
• relevant providers;
• legislation;
• authorities’ guidance;
• technical and organisational measures.

The applicable version will be identified by its date or version number.

Where a change is relevant to users’ rights, REC will use reasonable means available through the Web, the App or other appropriate channels to inform users about it.

21. PRIVACY INFORMATION AND CONSENT ARE NOT THE SAME

The presentation, reading or acceptance of this Privacy Policy does not, by itself, constitute general consent to all the processing described.

This Policy is intended to explain how personal data are processed.

Each processing activity must have its own legal basis.

Where REC needs consent for a specific purpose, it will request it separately or through a clear action linked to that purpose.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal or processing that may lawfully continue on another legal basis, such as compliance with a legal obligation, performance of a contract or defence of legal claims.

22. CONTACT

For matters relating to privacy, data protection or the exercise of rights arising from processing carried out through realestatescostablanca.com, the REC App or the associated services:

REC

Data Controller:

Pascale Annie Degryse Meuleman

NIF:

48338942A

Avenida L'Albir, 66-68
03581 El Albir / L'Alfàs del Pi
Alicante
España

Email:

support@realestatescostablanca.com

Version of this Privacy Policy: 2026-09-25