Laurence GoyaReal estate agent · Costa del Sol

Privacy policy

Spanish version prevails: this translation is provided for information only. In the event of any discrepancy, the Spanish version shall prevail.

This policy explains how personal data collected through the website laurencegoya.com are processed, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 on information society services and electronic commerce (LSSI-CE).

1. Data controller

  • Controller: Laurence Goya, self-employed real estate agent
  • Tax ID (NIF): —
  • Address: —
  • Contact and data protection email: contact@laurencegoya.com

No Data Protection Officer has been appointed, as this is not mandatory for this activity. Any privacy question may be sent to the email above.

2. What data we process, why, and on what legal basis

2.1. Contact, valuation and property enquiry forms

  • Data: name, email, phone (optional), message, type of interest (buy, sell or rent), property reference, language, and the IP address and browser user agent.
  • Purpose: to handle your request, answer your questions, arrange viewings or prepare a valuation, and follow up on your property project.
  • Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). The checkbox acknowledging this policy confirms you have been informed; it is not consent to marketing.
  • IP address and browser: recorded to prevent abuse and automated spam, based on the legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR and Recital 49).
  • Retention: if no transaction takes place, data are deleted after 24 months of inactivity (no further contact from you or from us). If a transaction takes place, see section 2.6.

2.2. New properties and news (optional consent)

  • Data: name, email, phone (if provided), language and search preferences.
  • Purpose: to send you, by email or WhatsApp, new properties and news that may interest you.
  • Legal basis: your express consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE), given by ticking a separate box that is not pre-ticked. Not ticking it does not prevent us from handling your request.
  • Withdrawal: you may withdraw consent at any time, free of charge, by replying to any message, by writing to contact@laurencegoya.com or via the unsubscribe link in every email. Withdrawal does not affect the lawfulness of prior processing.
  • Retention: until you withdraw consent or, at the latest, 24 months after our last contact without any interaction from you. Evidence of consent and of unsubscription is kept for as long as needed to demonstrate them.

2.3. Automated chat assistant

  • What it is: the website chat is answered by an automated assistant based on artificial intelligence, clearly labelled as such. It is not a person. Its answers are for guidance only and may contain errors; they are not legal or tax advice, nor a binding offer.
  • Data: the content of the messages you write, date and time, and IP address. Please do not share sensitive data in the chat (health, bank details, identity documents, etc.).
  • Purpose: to answer your questions about properties and services and to improve our response. If you write your email or phone number in the chat, a contact record is created so that Laurence Goya can reply to you personally.
  • Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR) and the legitimate interest in providing a fast and secure response (Art. 6(1)(f) GDPR). You are free not to use the chat and to contact us by other means.
  • Provider: the conversation text is sent to Anthropic PBC (United States), acting as processor solely to generate the answer (see sections 3 and 4).
  • No automated decisions: the assistant takes no decision producing legal effects concerning you or similarly significantly affecting you (Art. 22 GDPR). Any relevant matter (viewings, offers, terms, valuations) is handled personally by Laurence Goya.
  • Retention: chat logs are kept for 12 months. Any contact record created follows the rules of section 2.1.

2.4. WhatsApp button

  • The WhatsApp button is a plain link: nothing from WhatsApp or Meta is loaded until you click it. Clicking opens WhatsApp with Laurence Goya's number.
  • The conversation then takes place on WhatsApp, a service of WhatsApp Ireland Limited (Meta group), which processes your data as an independent controller under its own terms and privacy policy.
  • Messages you exchange with Laurence Goya via WhatsApp are processed to handle your request (Art. 6(1)(b) GDPR) and kept in accordance with section 2.1.

2.5. Security, technical logs and admin area

  • Data: IP address, date and time, requested pages and user agent, recorded by the server; a technical session cookie for the site owner's login to the admin area.
  • Purpose: to ensure the security, availability and integrity of the site and detect abuse.
  • Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Retention: server logs are kept for a maximum of 12 months, unless needed to investigate a specific incident.

2.6. Clients who complete a property transaction

  • If you enter into a transaction (sale or letting mandate, reservation, deposit agreement, sale, lease), your data are processed to perform the contract (Art. 6(1)(b) GDPR) and to comply with legal obligations (Art. 6(1)(c) GDPR), in particular those of Spanish Law 10/2010 on the prevention of money laundering and terrorist financing, to which real estate agents are subject (identification, due diligence, record keeping).
  • Retention: documents required by Law 10/2010 are kept for ten years from the end of the business relationship or the execution of the transaction (Art. 25 of that Law), with restricted access from the fifth year. Other contractual and accounting records are kept for the applicable limitation periods (in particular four years for tax purposes and five years for personal civil claims), and then deleted.

3. Recipients and processors

We do not sell or share your data. Only the following have access:

  • OVH SAS (OVHcloud), server hosting provider (in the European Union) and email provider, as processor. Daily backups are stored on the same infrastructure.
  • Anthropic PBC (United States), as processor, solely to generate the chat assistant's answers. Under its commercial terms, it does not use these data to train its models and keeps them only for a limited period.
  • Associated real estate office: Laurence Goya may operate as an agent associated with an office of a real estate network or franchise. In that case, and only if you decide to proceed with a specific transaction (for example a sale mandate, a reservation or a purchase), your data may be disclosed to that office, which will process them as a separate controller for the management and legal compliance of the transaction. You will be informed of its identity before any such disclosure.
  • Third parties involved in the transaction, where necessary and at your request: the other party, notaries, land registries, financial institutions, administrative agents (gestorías) or lawyers.
  • Authorities, where required by law (for example SEPBLAC, the Spanish Tax Agency or the courts).

4. International transfers

  • Anthropic PBC (United States): the transfer of chat messages relies, where applicable, on Anthropic's certification under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, in any event, on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR) included in its data processing agreement. You may request information about these safeguards by writing to contact@laurencegoya.com.
  • WhatsApp / Meta: if you use WhatsApp, Meta processes and may transfer your data as an independent controller, under its own privacy policy.
  • Hosting and email are provided within the European Union.

5. Your rights

You may exercise at any time, free of charge, your rights of:

  • access to your data;
  • rectification of inaccurate data;
  • erasure ("right to be forgotten");
  • objection to processing based on legitimate interest and, in all cases, to direct marketing;
  • restriction of processing;
  • portability of the data you provided;
  • withdrawal of consent, without affecting the lawfulness of prior processing.

To exercise them, write to contact@laurencegoya.com stating the right concerned. If we have reasonable doubts about your identity, we may ask for the additional information necessary to confirm it. We will reply within one month, extendable by two further months for complex requests (Art. 12 GDPR). Some rights may be limited where the law requires the data to be kept (for example Law 10/2010); in that case the data will be blocked and used only for that purpose.

If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es). We would appreciate it if you contacted us first so that we can try to resolve the matter.

6. Minors

This website is not aimed at children under 14, the minimum age to consent to data processing in Spain (Art. 7 LOPDGDD). We do not knowingly collect their data; if we find that such data have been provided, they will be deleted. Property transactions require full legal capacity in any event.

7. Data you provide

Mandatory form fields are needed to handle your request. You confirm that the data are accurate and, if you provide third-party data (for example a co-owner), that you have informed them and have their permission.

8. Security

We apply technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), restricted and authenticated access to the admin area, server hosted in the European Union, regular backups, protection against automated submissions and data minimisation. No system is infallible; in the event of a breach posing a risk, we will act in accordance with Articles 33 and 34 GDPR.

9. Changes to this policy

We may update this policy to reflect legal changes or changes in how the site works. The applicable version is always the one published on this page. Substantial changes affecting processing based on your consent will be notified to you.

Last updated: 29/09/2026