Privacy policy

1. Data controller

• Company name: Alpama Desarrollos SL (trading name AREA RESIDENCE)
• Tax ID (CIF): B64679038
• Registered address: Avenida Rius i Taulet, 2, p. 1 pta. 3, 08172 Sant Cugat del Vallès, Barcelona, Spain
• Privacy and data protection contact: legal@arearesidence.es · +34 936 742 401

2. Data we process

Contact form (when available on the site): name; email and/or phone (at least one); reason for the enquiry (buying, renting, selling or valuation, new build or other); the message you write; the property you are asking about, if the enquiry starts from its page; the site language; the page you write to us from and, if you arrived from a campaign or another website, the referring domain and campaign parameters (utm), without personal identifiers; and the record that you were informed of this policy (server date and time and policy version).

Direct contact: if you email or call us at the addresses published on the Contact page, we process the data you give us in that communication.

Security and abuse prevention: when the form is submitted your IP address is used to limit the number of submissions and, when enabled, for the Cloudflare Turnstile anti-abuse check, which analyses technical signals from your browser and connection. The IP is not stored in clear: only a non-reversible encrypted fingerprint is kept, together with technical security records that contain no name, email, phone or message.

Browsing: the technical data strictly needed to serve the site, your cookie choice, the favourites you save (only in your browser) and, only if you accept analytics and it is active, statistical usage data (see the Cookie policy).

3. Purposes and legal bases

We do not send marketing communications or newsletters, we do not build profiles and we do not make automated decisions about you. If we ever offer marketing communications, we will ask for separate, specific consent, never pre-ticked.

• Answering enquiries about buying, renting, selling or valuing a property, or about new builds, at your request: steps prior to entering into a contract (Art. 6(1)(b) GDPR).
• Answering general enquiries about our activity: the legitimate interest of Alpama Desarrollos SL in replying to people who contact it (Art. 6(1)(f) GDPR).
• Notifying the AREA RESIDENCE team internally, by email, that an enquiry has arrived: the same basis as the enquiry being handled. The valid record is the customer management system (CRM); the email is only a notice.
• Knowing which page or channel originated the enquiry (landing page, referring domain and campaign parameters, without identifiers): legitimate interest in understanding, in aggregate, how our clients find us (Art. 6(1)(f) GDPR).
• Protecting the form and the platform against automated submissions, abuse and attacks (submission limits, Cloudflare Turnstile, technical security records): legitimate interest in network and information security (Art. 6(1)(f) and Recital 49 GDPR).
• Statistical analytics of the site: your consent (Art. 6(1)(a) GDPR and Art. 22(2) of Spanish Law 34/2002, LSSI-CE), which you can withdraw at any time from “Cookie settings”.
• Remembering your cookie choice: the first-party technical cookie that stores it is necessary and does not require consent (Art. 22(2) LSSI-CE). It is stored only in your browser, with its date and format version; we do not send it to our servers or to any third party.
• Complying with the legal obligations arising from a property transaction (tax, commercial or anti-money-laundering): legal obligation (Art. 6(1)(c) GDPR).

4. Retention

• Enquiries with no contractual relationship: 12 months from the last meaningful interaction. After that period they are automatically anonymised in the CRM (name, email, phone, message, notes and origin data are erased).
• If the enquiry leads to a transaction or contractual relationship, the necessary data move to the commercial file and are kept for the periods required by contractual, tax, commercial and anti-money-laundering obligations, and the limitation periods for possible claims.
• Technical security data (IP fingerprint, form security records): 90 days, unless needed to investigate a specific, documented security incident.
• Internal email notices and email or phone communications: managed with the same 12-month criterion from the last interaction.
• Your cookie choice: up to 180 days or until you change it; it is stored only in your browser, in a first-party technical cookie, with no external provider. Favourites: in your browser, until you remove them. Session origin data: until you close the browser.

5. Recipients and processors

We do not sell or disclose your data to third parties, except where required by law. Enquiries are recorded in Alpama Desarrollos SL's own management platform, which also serves other brands of the same company, with separation by brand and access restricted to authorised AREA RESIDENCE staff.

To provide the service, we use the following technology providers, with the roles described for each:

• Microsoft Ireland Operations Limited (Microsoft 365): corporate email and sending the internal notice of each enquiry.
• Cloudflare, Inc.: security and network delivery of the site and the Turnstile anti-abuse check. To improve bot detection, Cloudflare also processes certain Turnstile technical signals as an independent controller, under its own privacy policy.
• OVHcloud: hosting of the website and management platform servers, in European Union data centres.
• Google Ireland Limited (Google Analytics 4 via Google Tag Manager): only if you accept analytics and once it is enabled; no advertising or profiling. While analytics is not active, no connection to Google is made.

6. International transfers

Cloudflare, Inc. is based in the United States, and Microsoft and Google may process data outside the European Economic Area in certain cases. In those cases transfers rely on GDPR safeguards: the EU-US Data Privacy Framework for certified entities, the European Commission's standard contractual clauses or other appropriate safeguards.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given at any time, by writing to legal@arearesidence.es. We will reply within one month. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply appropriate technical and organisational measures: encrypted connection (HTTPS); the browser never talks to the CRM directly, only through the website server with signed requests; anti-abuse verification and submission limits; IP stored only as an encrypted fingerprint; access to enquiries restricted by brand, with strong authentication and individual permissions; and security records without contact data.

9. Storage in your browser

We use this site's own technical cookie (area-residence-consent-v1) to remember your cookie choice; the browser's local storage (localStorage) only for the favourites you mark, which never leave your device; and, only if you accept analytics, session storage (sessionStorage) to remember during the visit the landing page and origin, which is sent only if you submit the form yourself. Details are in the Cookie policy.

10. Minors

This site is not aimed at children under 14. If you are under that age, do not send us personal data without the involvement of your parents or guardians.

11. Changes to this policy

Current version: 2026-10-30. We will update this policy, before launching them, if we add features that process personal data differently. The form records the version of the policy you were informed of when you sent it.

What changes in version 2026-10-30: managing your cookie choice is now handled by AREA RESIDENCE itself, with no external consent-management provider; the choice is kept for up to 180 days.