AFORTUNA

Privacy Policy

This policy explains, in accordance with Articles 12 to 14 of the General Data Protection Regulation (GDPR), how personal data is processed when you visit this website or contact us. It applies toafortunaestates.com and its language versions.

1. Controller

Baumfalk Seo S.L.U. (Sociedad Limitada Unipersonal)
operator of the website presented as “AFORTUNA ESTATES”
Lugar Riquianez, 15
35412 Arucas, Las Palmas, Gran Canaria, Spain
NIF: B75407767
Represented by Marius Christoph Baumfalk, Sole Administrator

Data protection contact: info@afortunaestates.com
Telephone: +34 828 643 036

This address belongs to the controller and also handles data-protection requests concerning AFORTUNA ESTATES. No data protection officer has been published as a contact point; requests should be addressed directly to the controller.

2. Hosting and server logs

When the website is accessed, the web server processes connection data required for technical operation. This may include the IP address, date and time, requested URL, amount of data transferred, referrer, browser, operating system and HTTP status. The purposes are secure delivery, error analysis and prevention of abusive access.

  • Legal basis: Article 6(1)(f) GDPR; our legitimate interest in a secure and functional website.
  • Hosting provider: Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany
  • Retention: No dedicated access log is configured for the AFORTUNA Caddy virtual host; the application therefore does not retain access logs.
  • Area: The website is provided within the EU through the network of a provider established in Germany.

3. Contact form and other enquiries

The general contact form processes your name, email address, message and any telephone number you choose to provide. If an enquiry is submitted after the online estimate, it also includes the selected municipality, stated area and age category. These details are stored as part of the enquiry. The indicative range displayed in the browser is not sent to the endpoint, recalculated there or stored as a verified value.

  • Purpose: handling the requested estimate, responding about the property, arranging an on-site visit and taking steps towards a possible agency agreement.
  • Legal basis: Article 6(1)(b) GDPR where processing is required at the data subject’s request in order to take steps before entering into a contract.
  • Form: The information is encrypted in transit to our own /api/contact endpoint. The endpoint validates the contact fields and stores the enquiry. It does not perform a property valuation.
  • Mandatory fields: Name and email address are required to handle the enquiry. The telephone number is optional.
  • Email: When you contact us directly, the email service used for the published address processes communication and content data.
  • Retention: Form enquiries are deleted by the daily automated clean-up after 365 days have elapsed. If an enquiry leads to an engagement, the information required for that engagement is transferred to the client file and retained there for the applicable statutory, evidential and limitation periods.

The mandatory checkbox confirms only that the privacy information has been read. It is not consent to the processing requested by the user. Advertising or other unnecessary processing requires separate, voluntary consent that can be withdrawn at any time.

4. Cookies and local storage

This website sets cookies under Google Analytics 4; details are set out in Section 5. A consent management banner on this website requests consent before the analytics cookies are placed. No further external analytics or advertising services are included based on the current implementation.

The following entries in the browser’s local storage and session storage are used:

  • localStorage["ga_consent"] — stores the consent decision as "granted" or "denied". The entry has no technical expiry and persists until changed via the consent settings on this website or until the user manually clears browser data.
  • sessionStorage["consent-focus-decline"] — a temporary UI entry used to restore keyboard focus to the decline button after a consent change; it is deleted immediately after use and expires at the end of the browser session at the latest.

If additional non-essential services are added in future, this policy will be updated before processing begins and a supplementary consent mechanism put in place where required.

5. Analytics with Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 records event-based usage data — page views, time on page, scroll depth, click events and navigation paths. Each event includes technical device characteristics (browser type, operating system, screen resolution, language setting) and the IP address. The IP address is used on Google’s EU servers for approximate geolocation and then discarded; it is not stored. User-level identifiers are stored in first-party cookies.

  • Purpose: measuring website usage, statistical analysis of user behaviour and improving the service.
  • Legal basis: Article 6(1)(a) GDPR and, for access to the terminal equipment, Article 22.2 LSSI-CE; consent of the data subject, given through the consent management banner on this website.
  • Processor: Google Ireland Limited acts as processor under the Google Ads Data Processing Terms. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA is a sub-processor. Transfers of data to the USA rely primarily on the European Commission's adequacy decision under Article 45 GDPR based on the EU-US Data Privacy Framework (DPF), for which Google LLC holds an active certification; Standard Contractual Clauses under Article 46 GDPR may apply as a supplementary safeguard.
  • Cookie lifetime: GA4 cookies (_ga, _ga_<measurement ID>) expire after 60 days.
  • Event data retention: Event data is retained in Google Analytics for two months.
  • Consent Mode v2: On every page, all four Consent Mode signals — analytics_storage, ad_storage, ad_user_data and ad_personalization — are set to "denied" before any consent is given. The GA4 measurement script is not loaded until explicit consent is granted. On consent, only analytics_storage is set to "granted"; ad_storage, ad_user_data and ad_personalization remain permanently "denied". No advertising or personalisation is enabled.
  • Withdrawal: Consent may be withdrawn at any time with future effect via the consent settings on this website. The Google Analytics Opt-out Browser Add-on also prevents data collection regardless of the consent setting. Data collected before withdrawal is retained until the end of the storage period.

6. Recipients and processors

Within the organisation, access is limited to persons handling the enquiry. The form endpoint and enquiry data are processed on infrastructure hosted by Hetzner. Other recipient categories are the email service and, where necessary and lawful for the individual matter, IT support, tax advisers or legal advisers. No external form or CRM service is connected.

For the Google Analytics 4 web analytics service, Google Ireland Limited acts as processor; Google LLC (USA) is a sub-processor. The basis for the transfer to the USA is set out in Section 7.

7. International transfers

Under the Google Analytics 4 service, data is transferred to Google LLC in the USA. The primary basis is the European Commission's adequacy decision under Article 45 GDPR based on the EU-US Data Privacy Framework (DPF), for which Google LLC holds an active certification. Standard Contractual Clauses under Article 46 GDPR may apply as a supplementary safeguard. No further transfers of personal data outside the EU and EEA take place based on the current implementation. If services involving third-country processing are added in future, this will only be done under Articles 44 et seq. GDPR and this policy will be updated before those services are used.

8. Retention periods

Data is erased or anonymised when its purpose no longer applies unless statutory retention, evidence or limitation periods require further storage. Specific periods are stated with the relevant processing activity. Records relevant to commercial or tax law may be retained for the applicable statutory periods.

9. Your rights

Subject to the applicable conditions, you have the right to:

  • access under Article 15 GDPR,
  • rectification under Article 16 GDPR,
  • erasure under Article 17 GDPR,
  • restriction under Article 18 GDPR,
  • data portability under Article 20 GDPR,
  • object under Article 21 GDPR, and
  • withdraw consent with future effect under Article 7(3) GDPR.

To exercise your rights, contactinfo@afortunaestates.com. We may request suitable proof of identity where necessary to prevent unauthorised disclosure.

10. Objection to legitimate-interest processing

Where processing relies on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will stop processing unless compelling legitimate grounds override your interests or processing is required for legal claims. An objection to direct marketing is unconditional; no direct marketing is carried out based on the current implementation.

11. Right to complain

You may lodge a complaint with a data protection authority, in particular in the Member State of your habitual residence, place of work, place of the alleged infringement, or with the authority responsible for the controller’s Spanish establishment.

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
https://www.aepd.es/

12. Requirement to provide data

Technical connection data is required to deliver the website. For enquiries, only fields marked as mandatory must be provided; without them we may be unable to respond. Using this contact form is not a statutory requirement.

13. Automated decision-making

We do not use solely automated decision-making, including profiling, within the meaning of Article 22 GDPR. If this changes, this policy will be updated before the processing begins.

14. Security and policy updates

We apply appropriate technical and organisational measures to protect personal data. These include encrypted transmission, access controls, secure administration, updates and procedures for security incidents. This policy will be updated if the services, legal requirements or processing activities change.

Last updated: 2 September 2026