Privacy policy

1. Data controller

Go2lloret (sole trader), tax ID ESX8363674T, registered at Calle Rector Coch, 5, 17310 Lloret de Mar (Girona), Spain, is the controller of the personal data collected through allcostabrava.com.

You can reach us at info@allcostabrava.com or on +34 722 465 683.

We have not appointed a data protection officer, as none of the cases set out in Article 37 of Regulation (EU) 2016/679 (GDPR) applies. For any privacy matter, please write to the email address above.

2. Data we process

Data you give us: name, phone number, email address, language and the content of the message you send through the contact forms, the property enquiry forms or the property listing form. In the latter we also process the details of the home you want to sell or rent out (address, features, price and photographs).

Data generated in the virtual assistant: the messages you type in the site chat and the replies generated, together with any contact details you choose to share in that conversation.

Browsing data: if you have accepted analytics cookies, information about the pages visited, your device, your browser, the approximate country inferred from your IP address and the session recording (on-screen movements and interactions, with form fields masked).

We do not process special categories of data. Please do not include health data, political opinions, ethnic origin or sensitive information about third parties in the messages you send us.

3. Purposes and legal bases

To answer your enquiries and handle your request about a property, including steps taken before a possible sale or rental agreement. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) and your consent when submitting the form (Art. 6(1)(a) GDPR).

To process properties you propose to us for marketing and to publish their listing in the catalogue. Legal basis: pre-contractual measures and performance of the engagement (Art. 6(1)(b) GDPR).

To reply through the virtual assistant and follow up on the conversation. Legal basis: your consent when starting the chat (Art. 6(1)(a) GDPR).

To analyse how the site is used in order to improve its content and usability. Legal basis: the consent you give in the cookie notice (Art. 6(1)(a) GDPR).

To comply with our legal obligations, in particular tax and accounting duties and those arising from anti-money-laundering rules when we act as intermediary in a property transaction. Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

We do not take automated decisions producing legal effects concerning you or similarly significantly affecting you, nor do we carry out profiling for that purpose.

4. Retention periods

Enquiry data that does not lead to a contractual relationship is kept while the enquiry is handled and, afterwards, for one year, unless you ask us to erase it earlier.

Data linked to a property transaction is kept for the duration of the relationship and, once it ends, for the applicable limitation periods: up to six years for accounting and commercial obligations, four years for tax matters and ten years where anti-money-laundering rules apply.

Virtual assistant conversations are kept for a maximum of twelve months.

Analytics data is kept for a maximum of twelve months from the last visit.

5. Recipients and processors

We do not disclose your data to third parties except where legally required. We do rely on providers that process data on our behalf under a processing agreement pursuant to Article 28 GDPR:

Neon Inc. — PostgreSQL database where enquiries and property listings are stored, hosted in the European Union.

Netlify Inc. — website hosting and execution of its server functions.

Cloudflare, Inc. — storage of photographs and other uploaded files (Cloudflare R2) and content delivery.

Resend, Inc. — sending email notifications when an enquiry is received.

PostHog, Inc. — usage analytics and session recording, on its European Union hosting region, and only if you have accepted analytics cookies.

Telegram Messenger Inc. — internal notifications of new enquiries and the virtual assistant conversations are sent to our team’s working channel on Telegram.

NVIDIA Corporation (NVIDIA NIM) and Groq, Inc. — providers of the language model that generates the virtual assistant’s replies: the messages you type in the chat are transmitted to them to produce the answer. Their terms for business use of the programming interface do not allow that content to be used to train models.

6. International transfers

The database and the analytics are hosted on servers in the European Union. Some of the providers listed are companies established outside the European Economic Area and may process data in the United States.

Those transfers rely on the adequacy decision for the EU–US Data Privacy Framework where the provider is certified and, failing that, on the standard contractual clauses approved by the European Commission, together with any supplementary measures required. You can request a copy of the safeguards in place by writing to info@allcostabrava.com.

7. AI-powered virtual assistant

The site chat is handled by a generative artificial intelligence system, not by a person, although our team can read the conversations and continue them.

The content of your messages is transmitted to the language model provider to produce the reply and is passed on to our team. Do not enter data in the chat that you would not want to share with us, or personal information about other people.

8. Cookie-free audience measurement

We count views of each property listing with our own system, which records only an aggregate counter per property. It sets no cookies, stores no IP address or identifier that could recognise you, and is not cross-referenced with any other data.

It therefore qualifies as audience measurement exempt from the consent requirement, and it works regardless of the choice you make in the cookie notice.

9. Your rights

You may request access to your personal data, its rectification or erasure, the restriction of its processing, the portability of the data you have provided, and you may object to processing based on our legitimate interest. Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, write to info@allcostabrava.com or to Calle Rector Coch, 5, 17310 Lloret de Mar (Girona), Spain, stating the right you are exercising and enclosing a copy of a document proving your identity. We will reply within one month.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, calle Jorge Juan 6, 28001 Madrid) or with the Catalan Data Protection Authority.

10. Minors

The services on this site are aimed at adults. We do not knowingly collect data from children under fourteen; if we find that such data has been provided to us, we will delete it.

11. Changes to this policy

We may update this policy to reflect legislative changes or new processing activities. The version in force is always the one published on this page, with the last-updated date shown above.