Your privacy.

Contact CostaSpace

For privacy questions or to exercise your data protection rights, email info@costaspace.com or call +34 951 255 878. Our local base is Centro Comercial El Zoco, Calahonda, Mijas Costa, Málaga, Spain.

Information you provide

Enquiry forms collect your name, email address, message and the telephone number, contact preferences, property reference, location or budget you choose to provide. Appraisal requests can also include property type, bedrooms, approximate area, occupancy and selling plans. We record the enquiry type, source page, your contact and marketing choices, and when it was received.

Authorised team members use our administration system to reply, arrange viewings or appraisals, and follow up your request. Required fields are needed to submit and handle the request. Please avoid sending identity documents, financial documents or sensitive information in an initial enquiry or chat.

Why we use it

• Your enquiry: to respond and take steps you request towards a property service or transaction. Where this concerns a prospective or existing contract with you, our legal basis is taking pre-contractual steps at your request or performing that contract.
• General correspondence and security: our legitimate interests in answering questions, operating the website, and preventing spam, misuse and unauthorised access. Technical request information may be processed for these purposes. Rate limiting uses temporary hashed network identifiers.
• Property news: your separate consent when you subscribe. Marketing is optional and is not a condition of making an enquiry. Withdraw through an email unsubscribe link or by contacting us.
• Website analytics: your consent to optional Google Analytics. Rejecting or withdrawing this choice does not prevent searching, enquiries or property services.
• Required records: compliance with legal obligations where applicable law requires us to keep or disclose information.

Saved searches and property alerts

If you request property alerts, we save your email, optional name, preferred areas, budget, property types and bedrooms, together with your consent and confirmation timestamps. This is separate from our general newsletter. We send a confirmation link before activating daily matching-property emails. You can choose price-reduction alerts, change your search, or unsubscribe through a secure link in an email. Unsubscribing stops this saved search; it does not change separate newsletter choices.

We keep your preferences, the last matching check and minimal delivery records to operate the alerts, prevent duplicate sends and respect opt-outs. Authorised team members can see your saved search and stop alerts. Brevo receives the recipient address and email content when sending is enabled. Signed account links provide access to your search; keep them private and do not forward them.

Services that help us operate

The website runs on Sites hosting using Cloudflare infrastructure, including database and file storage. These services process information needed to deliver, secure and operate the website. Brevo processes necessary recipient details and message content when email notifications or property-update emails are enabled.

ReSales Online supplies property information. Browsing the property feed does not itself send your enquiry details to ReSales. If the team chooses to forward a particular enquiry to its ReSales CRM to handle your request, relevant contact and enquiry details are shared for that purpose. Relevant details may also be shared with an agent or professional involved in a service or transaction you request.

Some property photographs load from external image hosts. Loading an image sends that host the technical information needed to deliver it, such as your IP address. WhatsApp, social media and other external links take you to services with their own privacy information.

Depending on the service used, providers may process information outside the European Economic Area. Such transfers are subject to the applicable GDPR transfer requirements. Contact us for information about the providers, processing locations and transfer safeguards relevant to your request.

Emma, the AI property assistant

Our team receives email alerts with a secure link to your saved conversation.

Emma is an AI system, not a human member of staff. Before starting a saved chat, we ask permission to retain the conversation and any property requirements or contact details you choose to provide, so CostaSpace can understand and follow up your enquiry. This permission is separate from marketing; chatting does not subscribe you to newsletters.

Conversation text is processed by OpenAI to produce replies and structured requirements. We request response storage to be disabled; this does not exclude the provider’s security or abuse-monitoring processing. Questions about changing rules, areas or a published property’s location may use web search. Contact details are omitted from the conversation supplied to a web-enabled answer, and Emma is instructed not to search for private personal details. Please do not send identity, bank, health or other sensitive documents.

Saved conversation content and the requirements summary are encrypted in our website database and accessible only to authorised administrators and the visitor using their private chat token. Team members can review the conversation and create a linked client enquiry and follow-up task from details supplied for that purpose. You can review and submit your own contact request in the panel. Marketing remains a separate choice. AI summaries can be mistaken; staff should check the original messages.

Unlinked chats are deleted after 30 days without activity, with cleanup when chat or administration is next used. Conversations linked to submitted enquiries follow the enquiry retention criteria below. The Delete my saved chat control deletes the chat record; it does not erase an enquiry you already submitted. To manage that enquiry or withdraw permission, contact info@costaspace.com. Anonymous monthly usage totals and temporary hashed request counters contain no transcript.

Emma does not decide eligibility, provide an official valuation, confirm a viewing or conclude a transaction. Current factual legal and tax information uses official sources where available; obtain independent qualified advice about your circumstances. You can use WhatsApp, telephone or an ordinary enquiry form instead of AI chat.

How long information is kept

Enquiries are kept while needed to answer and follow up your request, manage any resulting relationship or transaction, meet applicable record-keeping obligations, or establish, exercise or defend legal claims. The appropriate period depends on the request and any resulting transaction. Marketing details are used until you unsubscribe or withdraw consent; limited records may remain where needed to respect or demonstrate that choice.

Cookie choices and minimal consent receipts expire after 180 days. Expired database receipts are removed when consent records are next processed. Temporary anti-abuse counters have short expiry periods and are cleaned up on subsequent requests. Saved properties remain on your device as described in our cookie and browser storage policy. Contact us to ask about the retention applying to your records or to request a deletion review.

Your rights and choices

You can ask for access to your personal information, correction, erasure, restriction of processing, or a portable copy where applicable. You may object to processing based on legitimate interests, including direct marketing. Where processing depends on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

Send your request to info@costaspace.com. We may need proportionate information to confirm your identity. You can also complain to Spain’s data protection authority, the Agencia Española de Protección de Datos (AEPD). Its rights guidance explains the available rights.

Cookies and saved properties

With your separate Analytics consent, Google Analytics measures public-page visits and actions such as enquiry submissions, newsletter signups and contact clicks. Google receives technical browser and connection data; our custom events do not include names, emails, telephone numbers, enquiry messages or chat text. Google may process information outside the EEA under the applicable transfer arrangements. We do not enable Google Signals or advertising personalisation. You can withdraw Analytics permission at any time in Cookie preferences. We use no advertising trackers. You separately choose whether this device remembers saved properties between visits. Essential storage supports your cookie choice and secure team sign-in. Read the cookie and browser storage policy to see what is stored and change your preferences.