Data Privacy – hellospainproperties.com

Privacy Policy

At HOLBILLY S.L., we take the protection of your personal data seriously. This Privacy Policy outlines how we collect, use, and protect your personal information when you interact with our website.

We ensure that your data is processed in compliance with the EU General Data Protection Regulation (GDPR), Spanish data protection laws, and other applicable regulations.

1. Data Controller

HOLBILLY S.L.

C/ Azucena 4

29651 Mijas, Málaga

Spain

CIF/NIF: [Insert Number]

Email: [email protected]

2. Scope of Application

This Privacy Policy applies to the website hosted at [insert your domain], including all subpages, blog sections, and services provided through WordPress, Elementor, plugins, social media integrations, contact forms, analytics, and advertising platforms.

3. What Personal Data We Collect

a) Information you provide directly:

Full name
Email address
Phone number
Comment content (including timestamp and IP address)
Inquiry form submissions
User account data (username, email, password)
Newsletter preferences
Saved property data (if applicable)

b) Automatically collected data:

IP address
Device information and browser type
Screen resolution
Operating system
Referring URL
Pages visited, clicks, time on page
Approximate location (city/country)
Emojis used (may trigger CDN requests)

4. How We Collect Your Data

We collect your data through:

WordPress and Elementor contact forms
Blog comments
User account registration and login
Newsletter signups
Website cookies and tracking scripts
Social media plugins
Embedded content and media
Hosting infrastructure logs

5. Purpose of Data Processing

Your data is used to:

Answer property inquiries or general questions
Provide requested content or services
Allow comment publication and moderation
Enable user accounts and saved searches
Send newsletters and marketing communications (only with consent)
Improve website design, performance, and personalization
Analyze visitor behavior (Google Analytics, Facebook Pixel)
Run targeted advertising campaigns (Google Ads, Meta Ads)

6. Legal Basis for Processing

Your data is processed lawfully based on:

Art. 6(1)(a) GDPR – Consent: for cookies, newsletter signups, etc.
Art. 6(1)(b) GDPR – Contract: e.g., responding to contact requests
Art. 6(1)(f) GDPR – Legitimate interests: ensuring functionality, optimizing services, marketing

7. Who We Share Data With

We may share your data with the following trusted providers:

Hosting provider:
All-Inkl.com / Neue Medien Münnich
Hauptstraße 68, 02742 Friedersdorf, Germany
(GDPR-compliant with servers in Germany)
Email services (e.g. SMTP provider, Mailchimp, Brevo)
Google Ireland Ltd. – Google Analytics, Google Ads, Google Maps
Meta Platforms Ireland Ltd. – Facebook, Instagram, Messenger
Pinterest Inc. – Widgets or social integrations
YouTube / Google LLC – Embedded video content
Anti-spam tools (e.g., Akismet, reCAPTCHA)
WordPress Plugin Developers (under DPA if applicable)
Freelance developers or team members under confidentiality agreements

All providers process your data exclusively based on signed Data Processing Agreements (DPAs) in accordance with GDPR.

8. Cookies and Tracking Technologies

We use cookies and tracking technologies to:

Maintain sessions and security
Save preferences (e.g. saved properties, language)
Measure traffic and user behavior
Track ad performance and retargeting

Tools in use:

Google Analytics 4 (with IP anonymization)
Facebook Pixel
Google Ads Conversion Tracking
Elementor functional cookies
WordPress session cookies
Real Estate Plugin cookies
Emoji and CDN cookies
YouTube and Pinterest embedded cookies

You may control or disable cookies via your browser settings or opt-in/out via our cookie banner.

9. Google Fonts

Our website uses Google Fonts, which are self-hosted locally on our servers to prevent any direct connection to Google’s servers.

No personal data is transmitted to Google during font loading. This complies with GDPR best practices.

10. Embedded Content & Third-Party Services

We embed or link to the following external services, which may collect your data when you interact with them:

Google Maps (property locations)
YouTube / Vimeo (video tours, blog media)
Instagram Feed or Widgets
Facebook Social Plugins or Messenger
Pinterest Pins / Widgets
WhatsApp Contact Buttons
Calendly / Booking Widgets

These services operate under their own privacy policies and may set cookies or process IP and usage data.

11. Blog Comments, Emojis & User Interaction

When visitors leave comments, we collect:

Name or pseudonym
Email address (not published)
IP address and browser data
Timestamp and comment content

To enhance engagement, we may display emoji reactions, which may trigger requests to WordPress or CDN networks and register anonymous usage data.

Comments are reviewed and moderated to prevent spam and abusive content.

12. User Accounts & Saved Properties

Registered users may create accounts to:

Save properties
Submit inquiries
Access custom features

We store login data (securely hashed), preferences, session data, and property interests. You may request account deletion at any time.

13. Data Retention

Inquiries: retained for up to 12 months
Comments: retained permanently unless deleted
Account data: retained while account is active
Newsletter data: until unsubscribed
Analytics data: anonymized after 26 months
Legal data (e.g. invoices): retained as required by law

14. Your Rights Under GDPR

You have the right to:

Access your data (Art. 15 GDPR)
Correct or delete it (Art. 16, 17 GDPR)
Restrict processing (Art. 18 GDPR)
Object to certain processing (Art. 21 GDPR)
Withdraw consent at any time (Art. 7 GDPR)
Receive a copy in machine-readable form (Art. 20 GDPR)
Lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, please email us at: [email protected]

15. Data Security

We take appropriate technical and organizational security measures, including:

SSL encryption for all data transfers
Secure hosting on German servers (All-Inkl.com)
Regular updates of all WordPress and plugin components
Access control and role-based permissions
Daily backups
Monitoring tools and firewall protection

16. International Data Transfers

Services such as Google, Meta, or Pinterest may process data outside the EU (e.g., in the USA). We ensure legal safeguards via:

Standard Contractual Clauses (SCCs)
EU Data Transfer Frameworks
DPA contracts with service providers

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in technology, law, or our services. The latest version will always be available on this page. We encourage you to review it regularly.