AFORTUNA

Privacy Policy

This policy explains, in accordance with Articles 12 to 14 of the General Data Protection Regulation (GDPR), how personal data is processed when you visit this website or contact us. It applies to afortunaestates.com and its language versions.

1. Controller

Baumfalk Seo S.L.U. (Sociedad Limitada Unipersonal)
operator of the website presented as “AFORTUNA ESTATES”
Lugar Riquianez, 15
35412 Arucas, Las Palmas, Gran Canaria, Spain
NIF: B75407767
Represented by Marius Christoph Baumfalk, Sole Administrator

Email: info@serviciossosa.com
Telephone: +34 828 643 056

This address belongs to the controller and also handles data-protection requests concerning AFORTUNA ESTATES. No data protection officer has been published as a contact point; requests should be addressed directly to the controller.

2. Hosting and server logs

When the website is accessed, the web server processes connection data required for technical operation. This may include the IP address, date and time, requested URL, amount of data transferred, referrer, browser, operating system and HTTP status. The purposes are secure delivery, error analysis and prevention of abusive access.

  • Legal basis: Article 6(1)(f) GDPR; our legitimate interest in a secure and functional website.
  • Hosting provider: Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany
  • Retention: No dedicated access log is configured for the AFORTUNA Caddy virtual host; the application therefore does not retain access logs.
  • Area: The website is provided within the EU through the network of a provider established in Germany.

3. Contact form and other enquiries

We process the information you provide when contacting us. The contact form collects your name, email address, message and, where supplied, telephone number, property reference or enquiry subject. Mandatory fields are needed to allocate and answer the enquiry. A telephone number is voluntary unless clearly marked as mandatory in a particular form.

  • Purpose: handling and answering the enquiry, communication and, where applicable, taking steps before entering into a contract.
  • Legal basis: Article 6(1)(b) GDPR for pre-contractual enquiries; otherwise Article 6(1)(f) GDPR based on our legitimate interest in appropriate business communication.
  • Form: No functional backend is currently connected. The displayed form therefore does not transmit enquiries to the controller.
  • Email: When you contact us directly, the email service used for the published address processes communication and content data.
  • Retention: Enquiries are erased once they have been finally dealt with and no statutory retention, evidential or limitation requirements remain.

The mandatory form checkbox should confirm only that this policy has been read. It does not constitute consent to advertising or unnecessary processing. Any such consent would need to be voluntary, separate, informed and capable of being withdrawn at any time.

4. Cookies and local storage

Based on the current implementation, this website does not set any cookies and does not use the browser’s local storage or session storage. No analytics or advertising trackers are loaded and no consent banner is displayed. No consent for non-essential processing is requested.

External media, analytics, advertising or similar non-essential services are not used based on the current implementation. If this changes, this policy will be updated before the processing begins and a suitable consent mechanism will be put in place where required.

5. Recipients and processors

Within the organisation, access is limited to persons who need the data for their work. External recipients receive data only where required to provide the service, required by law or otherwise lawfully permitted. Current categories include hosting and email communication; IT support, tax or legal advisers may also be involved where necessary. No functional external form or CRM service is currently connected.

Processor categories are hosting and email services. IT support, tax advisers or legal advisers receive data only where this is necessary and lawful in the individual case. No form or CRM service is currently connected.

6. International transfers

No transfer of personal data outside the EU and EEA is intended under the current implementation. If services involving third-country processing are used in future, this will take place only under Articles 44 et seq. GDPR and this policy will be updated before those services are used.

7. Retention periods

Data is erased or anonymised when its purpose no longer applies unless statutory retention, evidence or limitation periods require further storage. Specific periods are stated with the relevant processing activity. Records relevant to commercial or tax law may be retained for the applicable statutory periods.

8. Your rights

Subject to the applicable conditions, you have the right to:

  • access under Article 15 GDPR,
  • rectification under Article 16 GDPR,
  • erasure under Article 17 GDPR,
  • restriction under Article 18 GDPR,
  • data portability under Article 20 GDPR,
  • object under Article 21 GDPR, and
  • withdraw consent with future effect under Article 7(3) GDPR.

To exercise your rights, contact info@serviciossosa.com. We may request suitable proof of identity where necessary to prevent unauthorised disclosure.

9. Objection to legitimate-interest processing

Where processing relies on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will stop processing unless compelling legitimate grounds override your interests or processing is required for legal claims. An objection to direct marketing is unconditional; no direct marketing is carried out based on the current implementation.

10. Right to complain

You may lodge a complaint with a data protection authority, in particular in the Member State of your habitual residence, place of work, place of the alleged infringement, or with the authority responsible for the controller’s Spanish establishment.

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
https://www.aepd.es/

11. Requirement to provide data

Technical connection data is required to deliver the website. For enquiries, only fields marked as mandatory must be provided; without them we may be unable to respond. Using this contact form is not a statutory requirement.

12. Automated decision-making

We do not use solely automated decision-making, including profiling, within the meaning of Article 22 GDPR. If this changes, this policy will be updated before the processing begins.

13. Security and policy updates

We apply appropriate technical and organisational measures to protect personal data. These include encrypted transmission, access controls, secure administration, updates and procedures for security incidents. This policy will be updated if the services, legal requirements or processing activities change.

Last updated: 31 August 2026