Privacy &
Cookies Policy
Protecting your personal information is our priority. We are committed to handling your data with the highest standards of discretion and care.
Introduction
CVAZ Ibiza ("we," "us," or "our") is a boutique luxury real estate and villa rental agency operating in Ibiza, Spain. We are deeply committed to protecting the privacy and personal data of our clients, partners, and website visitors.
This Privacy and Cookies Policy explains how we collect, use, store, and protect your personal information when you visit our websites — cvazibiza.com — or engage with our services, whether in the context of luxury villa rentals, property sales, or general enquiries.
This Policy is governed by Regulation (EU) 2016/679 of the European Parliament (GDPR) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). By using our website or services, you acknowledge that you have read and understood this Policy.
We never sell, trade, or transfer your personal data to third parties for commercial purposes. Your information is used solely to deliver and improve our services to you.
Data Controller
The entity responsible for the processing of your personal data is:
If you have any questions, concerns, or wish to exercise your data rights, please contact us directly using the details provided in the Contact section of this Policy.
Personal Information Collected
We collect personal information that you provide directly to us, as well as data gathered automatically when you interact with our digital platforms. This may include:
Identity Data
Full name, nationality, date of birth, passport or ID number when required for rental contracts.
Contact Data
Email address, phone number, postal address, and preferred communication channel.
Financial Data
Bank transfer details or payment references used in the context of rental or purchase transactions.
Behavioural Data
Pages visited, time on site, property preferences, search filters, and browsing patterns.
Technical Data
IP address, browser type, operating system, device identifiers, and referring URLs.
Communication Data
Messages, enquiries, requests, and correspondence sent via our contact forms, email, or phone.
We do not intentionally collect sensitive categories of personal data (such as health information, ethnic origin, or political opinions) and ask that you refrain from sharing such information with us.
Purpose of Data Processing
We process your personal data exclusively for the following purposes:
- To respond to your enquiries and provide information about our luxury villa rental and real estate services.
- To manage bookings, prepare and execute rental agreements, and coordinate property viewings.
- To process payments and maintain accurate financial records as required by Spanish law.
- To send communications relevant to your enquiry or existing relationship with us, including booking confirmations, reminders, and contract documentation.
- To send marketing communications and property updates, only where you have given explicit consent or where a legitimate interest applies.
- To improve the performance, functionality, and user experience of our websites.
- To comply with legal, regulatory, and contractual obligations under Spanish and European law.
- To maintain internal records and manage our client relationships in a professional and secure manner.
Legal Basis for Processing
All processing of personal data by CVAZ Ibiza is carried out on one or more of the following lawful bases, in accordance with Article 6 of the GDPR:
- Contractual necessity: Processing required to fulfil a rental or sales agreement to which you are a party, or to take steps at your request before entering into such an agreement.
- Legal obligation: Processing required to comply with applicable laws, including Spanish tax, anti-money laundering, and tourist accommodation regulations.
- Legitimate interests: Processing carried out for the purposes of our legitimate business interests — such as fraud prevention, security, business analytics, and improving our services — provided these interests are not overridden by your rights and freedoms.
- Consent: Where you have freely given clear and unambiguous consent, such as subscribing to our newsletter, accepting non-essential cookies, or receiving promotional communications.
Where we rely on consent as a legal basis, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
Data Retention Period
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. Our general retention framework is as follows:
- Client and contractual records: Retained for a minimum of 5 years following the completion of a transaction, in accordance with Spanish civil and tax law.
- Accounting and financial data: Retained for 6 years as required under the Spanish Commercial Code (Código de Comercio).
- Marketing and communication preferences: Retained until consent is withdrawn or for a maximum of 3 years of inactivity.
- Website analytics data: Aggregated and anonymised data may be retained indefinitely; identifiable logs are deleted after 13 months.
- Enquiries and correspondence: Retained for 2 years from last contact, unless a contractual relationship has been established.
Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised.
Your Rights
Under the GDPR and LOPDGDD, you hold the following rights in relation to your personal data. You may exercise any of these rights at any time by contacting us at cvaz@ibiza-index.com.
Access
Request a copy of the personal data we hold about you and confirmation of how it is processed.
Rectification
Request correction of inaccurate or incomplete personal data without undue delay.
Erasure
Request deletion of your personal data where there is no compelling reason for its continued processing.
Restriction
Request that we temporarily halt the processing of your data while a dispute is being resolved.
Objection
Object to processing based on legitimate interests or carried out for direct marketing purposes.
Portability
Receive your personal data in a structured, machine-readable format and transfer it to another controller.
We will respond to all requests within one calendar month of receipt. This period may be extended by a further two months for complex or numerous requests, with appropriate notification. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — aepd.es).
Third-Party Services
In the operation of our business and websites, we may engage certain trusted third-party service providers who process personal data on our behalf. These include, but are not limited to:
- Hosting and infrastructure providers for the secure operation of our websites (e.g. Render, Hostinger).
- Email and communication platforms for managing correspondence and marketing communications.
- Analytics tools such as Google Analytics, used to understand how visitors interact with our websites.
- Booking and calendar systems that process iCal-based availability data for our villa portfolio.
- Payment processors and banking institutions involved in the execution of transactions.
- Legal and professional advisors who may require access to contractual documentation.
All third-party processors are contractually required to implement appropriate technical and organisational measures to protect personal data and may not use it for any purpose other than those explicitly agreed. Where data is transferred outside the European Economic Area, we ensure adequate safeguards are in place in accordance with GDPR Chapter V.
We do not sell or share your personal data with third parties for their own marketing purposes.
Cookies Policy
Our websites use cookies and similar tracking technologies to enhance your browsing experience, analyse site performance, and deliver relevant content. A cookie is a small text file placed on your device when you visit a website, which allows the site to remember your preferences and actions over time.
In accordance with the Spanish Law on Information Society Services (LSSI-CE) and the GDPR, we request your consent before placing any non-essential cookies on your device. You may withdraw or modify your cookie preferences at any time through the mechanisms described below.
Essential cookies are strictly necessary for the functioning of our website and cannot be disabled without affecting core features. All other cookie categories require your prior, freely given consent.
Types of Cookies Used
The following categories of cookies may be used on our platforms, depending on your preferences and consent settings:
Managing Cookies
You have full control over the cookies placed on your device. You may manage your preferences through any of the following methods:
- Cookie consent banner: Upon your first visit to our websites, a consent banner will appear allowing you to accept or decline non-essential cookies by category. You may revisit and modify these preferences at any time by clicking the Cookie Settings link in the website footer.
- Browser settings: Most modern browsers allow you to control cookies through their settings. You can configure your browser to block all cookies, accept only certain types, or delete existing cookies. Note that disabling cookies may impair the functionality of our websites.
- Third-party opt-outs: For analytics cookies placed by Google Analytics, you may install the Google Analytics Opt-out Browser Add-on. For advertising cookies, you may opt out via the Your Online Choices platform (youronlinechoices.eu).
- Device settings: On mobile devices, you may limit ad tracking through your device's privacy settings (iOS: Settings → Privacy → Advertising; Android: Settings → Google → Ads).
Changes to your cookie preferences take effect immediately for new cookies. Cookies already placed on your device prior to your preference change will remain until they expire naturally or are deleted via your browser.
Contact Information
If you have any questions about this Privacy and Cookies Policy, wish to exercise your data rights, or have concerns about how your personal information is handled, please contact us through any of the following channels. We are committed to responding to all data-related enquiries promptly and professionally.
Spain
Should you remain unsatisfied with our response or handling of your personal data, you have the right to lodge a complaint with the competent supervisory authority:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6 — 28001 Madrid, Spain
www.aepd.es | Tel: +34 901 100 099