Privacy policy
Last updated: 28 October 2026
1. Controller
Selected Property Real Estate S.L.
Registered office: C./ Sant Pere Pescador 18
17474 Torroella de Fluvià, Spain
Office: Av. de la República Catalana, Flamicell 30, local 1a
Empuriabrava, Spain
office@selected-property.com
+34 972 450 637
2. Website and hosting
When you visit this website, we process technically necessary connection data, including your IP address, time, requested page, browser and device information and, where applicable, referrer and error data. This enables delivery, stability and protection against misuse. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in operating a secure website.
Hosting is provided through ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Technical data is retained only as long as required for operation, troubleshooting and security and, where necessary, until a security incident has been resolved.
3. Contact and property enquiries
Our contact, seller and property forms transmit your enquiry to office@selected-property.com without opening an email application on your device. Name, email address and message are required. Phone number and, for seller enquiries, property location and type are optional. Property enquiries include the relevant property or reference. We also process the accepted version of the enquiry terms, the submission time and technical information needed for secure handling.
Property enquiries are handled for pre-contractual steps or an existing business relationship under Article 6(1)(b) GDPR. General enquiries rely on Article 6(1)(f) GDPR; our legitimate interest is appropriate communication. Legally required processing, including privacy rights requests, relies on Article 6(1)(c) GDPR. Without the necessary contact details, we cannot provide a reply through the form.
Before sending, you accept the enquiry terms and acknowledge the privacy information. This is neither a brokerage instruction nor consent to advertising, a newsletter, Google Analytics or Meta Pixel. The accepted version is documented in the enquiry message so that the submission and information provided can be identified. The basis is our legitimate interest in documentation and, where necessary, establishing or defending claims (Article 6(1)(f) GDPR).
Access is limited to staff handling the enquiry and necessary technical providers. Relevant enquiry and contact data may be transferred into onOffice as described below. There is no automatic newsletter subscription. Please do not initially submit identity document copies, bank details, health information or other sensitive data. Necessary documents and a suitable transmission method will be arranged separately.
4. Customer information in onOffice
We use onOffice to manage prospective and existing customer contacts, property enquiries and related communications. The provider is onOffice GmbH, Charlottenburger Allee 5, 52068 Aachen, Germany. We process the contact and enquiry information needed for each customer relationship. Depending on the activity, the legal basis is Article 6(1)(b) or (f) GDPR, or Article 6(1)(c) GDPR where a legal obligation applies.
onOffice states that it hosts data on servers in Germany. Provider information: onOffice privacy information.
5. Cookies and your choices
We use Complianz to record and respect your decisions about optional technologies. Necessary consent cookies store acceptance or refusal and do not themselves carry out advertising tracking. Their configured duration is 365 days. Non-essential storage or access on your device requires consent under Article 22(2) of the Spanish LSSI; associated personal data processing relies on Article 6(1)(a) GDPR. Necessary technical operations and storage of your choices support secure operation and respect for your decision (Article 6(1)(f) GDPR).
Names, purposes and durations are listed in the Cookie policy. You may change or withdraw consent for the future at any time in Cookie settings. Withdrawal does not affect the lawfulness of earlier processing based on valid consent.
6. Google Maps and YouTube
Property pages may contain Google Maps and YouTube videos. These load only after you consent to the relevant service. The provider for the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Loading them may send your IP address, browser and device information, the page visited and usage data to Google. Google may use cookies or similar technologies and the data for its own analysis, security and personalisation purposes. If you are signed into Google, information may be associated with your account.
Google describes worldwide processing, including the United States, and the use of adequacy decisions and standard contractual clauses as transfer mechanisms. Information about recipients, safeguards and individual rights is in the Google privacy policy. You can still use our property information and enquiry form if you reject external content. An external link that you expressly select opens the relevant operator’s website.
7. Statistics and social media
We use Google Tag Manager (container GTM-NT6ZD7CB) to manage optional measurement scripts. The container loads only after you consent to the Statistics category in the cookie banner. This establishes a connection to Google and may transmit, in particular, your IP address and browser and device information. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is your consent (Article 6(1)(a) GDPR and, where access to your device occurs, Article 22(2) of the Spanish LSSI). Google’s privacy policy linked above explains worldwide transfers and safeguards. Statistics consent does not grant advertising consent.
After you consent to Statistics, we use Google Analytics 4 to analyse use of our website. Through the Tag Manager described above, it processes in particular page views, usage duration, referral sources, browser and device information and pseudonymous user and session identifiers. Google may derive an approximate region. The provider is Google Ireland Limited; processing outside the EEA, including in the United States, is possible. The information above about Google, transfers and legal bases also applies. Neither the container nor Analytics loads without Statistics consent. Reject all keeps this measurement blocked; you can withdraw consent at any time in Cookie settings in the footer.
Our integration disables Google Signals, advertising personalisation, automatic detection of email addresses, telephone numbers, names and addresses, and automatic form-interaction measurement. We do not deliberately send contact-form contents to Analytics. Email redaction and a list of sensitive URL parameters to redact are also configured.
GA4 is currently configured to retain event-level detail for two months and user-level detail for 14 months. The user-data period resets on new activity. These settings do not affect most aggregated standard reports. Analytics cookie lifetimes are described separately in the Cookie policy.
Meta Pixel and embedded Facebook or Instagram content remain disabled. Any later integration requires separate configuration and updated information and consent settings.
8. Recipients and retention
Within our business, data is available to the people handling the relevant matter. Necessary hosting, IT, email and CRM providers and, where applicable, professional advisers or legally authorised bodies may also receive data. Disclosures are limited to what the purpose requires or the law mandates.
Enquiry and customer data is retained while needed to handle your request, maintain a business relationship or establish or defend legal claims. It is then deleted unless statutory retention duties apply. Documents subject to those duties are retained until the applicable period ends, with further use limited to that purpose. The duration depends on the nature and content of the matter and applicable commercial and tax obligations.
9. Your rights
Subject to legal conditions, you have rights of access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation, and to direct marketing at any time. You may withdraw consent for the future.
Contact office@selected-property.com. You may also complain to a data protection authority, particularly the Spanish Data Protection Agency (AEPD). We do not make solely automated decisions through this website that have legal or similarly significant effects.
You can exercise privacy rights through the contact form, at office@selected-property.com or by writing to the registered address. Requests are normally answered within one month. Where complexity or the number of requests requires it, the period may be extended by up to two further months; we will explain the extension and reasons within the first month. If there are reasonable doubts about identity, proportionate additional information may be needed to confirm it. Choosing another suitable contact method must not prevent you exercising your rights.
10. Protection and changes
We use Limit Login Attempts Reloaded in local mode to protect WordPress sign-in. IP addresses, attempted usernames, timestamps and counts of failed sign-ins are processed to temporarily block repeated attempts. The cloud feature and sharing of sign-in IP data with the provider’s network are not enabled. The basis is our legitimate interest in securing access (Article 6(1)(f) GDPR). Security data is retained only as long as needed to detect and investigate misuse; operational attempt counters reset after 24 hours.
To protect forms from automated abuse, we use a security token, input checks, a hidden spam field and sending limits. Cryptographically protected, time-dependent counter keys are derived from the server-provided IP address and the email address entered. The raw values are not stored in those counters, which last no more than ten minutes. We also detect identical repetitions using a cryptographically protected key derived from the form type, property identifier, email address and normalised message text. This key also lasts no more than ten minutes; message texts are not stored in the protection counters. Limits apply per sender and across the website. We do not load an additional external CAPTCHA service for this protection. The basis is our legitimate interest in protecting the forms and message delivery (Article 6(1)(f) GDPR).
Information sent through this website is encrypted using HTTPS. Please provide only the information needed for your enquiry. We will update these notices when our services or legal requirements change.