Privacy Policy

2.1 Data Controller

The controller responsible for processing personal data collected through this website or in connection with the services provided by BCN BPC is:

• Controller: Vila Corbera, S.L.
• Trade name: BCN BPC / BCN Bright Properties Consulting
• Tax ID: B61860169
• Registered address: Carrer de la Providència, 125, 08024 Barcelona, Spain
• Privacy contact: bcnpropertiesconsulting@gmail.com
• Data Protection Officer: Not appointed, unless legally required in the future.

Personal data is processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights ("LOPDGDD"), and other applicable legislation.

2.2 What data we collect and how

a) Contact forms and enquiries

When you contact BCN BPC through the website, email, telephone or messaging services, we may process information such as:

• name and surname;
• email address;
• telephone number;
• country of residence;
• type of enquiry;
• whether you are a buyer, owner or investor;
• property location;
• estimated property value or purchase budget;
• preferred contact method;
• any other information voluntarily included in your message.

b) Client engagements

Where you become a client, BCN BPC may additionally process information necessary to provide the contracted services, including:

• identification and contact details;
• billing details;
• property ownership documentation;
• Land Registry and cadastral information;
• plans and technical documentation;
• photographs;
• technical reports;
• valuation data;
• financial information where necessary for valuations or mortgage-related procedures;
• documentation required for renovations, property management or technical procedures.

c) Technical data

The website, hosting provider and related infrastructure may automatically process technical data such as:

• IP address;
• browser type;
• device information;
• operating system;
• pages visited;
• connection and security logs.

Such processing may be necessary for the operation, security and maintenance of the website.

d) Video call bookings, messaging and paid services

When you book a video call through our booking page (provided by Google Calendar and Google Meet) or contact us through WhatsApp, we process the information you provide, such as your name, email address, chosen time slot and the content of your messages. These providers also process data under their own terms and privacy policies.

When you request or contract a paid service such as a Property Review, we also process the data needed to confirm the request, check the property and carry out the service, including the address or listing of the property, the information and documents you provide and the data needed to issue the full invoice (name or company name, tax ID and billing address).

Online payments are processed by Stripe, which receives the data needed to process the payment under its own privacy information. Invoices are issued by hand by Vila Corbera, S.L. from the Spanish Tax Agency (AEAT) application, not by Stripe. BCN BPC does not receive or store your full card details.

e) Downloads of guides and checklists

When you request a guide or checklist through the website, we process your email address, your name if you provide it, the document and language requested, and whether you have agreed to receive occasional communications, in order to send you the document and, only where you have opted in, informative communications about our services. Receiving the document is not conditional on accepting commercial communications.

f) Testimonials

Where a client expressly authorises publication of a testimonial, BCN BPC may process and publish the information covered by that consent.

Testimonials may be anonymised or published using initials.

BCN BPC does not intentionally request special categories of personal data through its website.

Users should avoid including unnecessary sensitive information in contact forms or communications.

2.3 Purposes and legal bases

Personal data may be processed for the following purposes:

Responding to enquiries

To respond to requests for information and assess the services that may be appropriate to the prospective client.

Legal basis: consent and, where applicable, pre-contractual measures requested by the data subject.

Providing contracted services

To manage and perform Property Buyer Advisory, Property Due Diligence, Technical Property Advisory, Official Property Valuations, Luxury Renovations, Property Management and related services.

Legal basis: performance of a contract or pre-contractual measures.

Administration, invoicing and accounting

To manage invoices, payments, accounting records and tax obligations.

Legal basis: contractual necessity and compliance with legal obligations.

Website security

To protect the website, systems, users and company infrastructure from misuse, unauthorised access or security incidents.

Legal basis: legitimate interest.

Client communications

Where permitted by law, BCN BPC may communicate with existing clients concerning services related to an existing professional relationship.

Legal basis: legitimate interest and applicable electronic communications legislation.

Sending requested documents

To send you the guide or checklist you request.

Legal basis: your request for the document and, where applicable, legitimate interest in answering it.

Optional communications

To send you occasional informative communications about our services and about property in Barcelona, only if you tick the optional box. You can withdraw your consent at any time at no cost.

Legal basis: consent.

Testimonials

To publish testimonials, including names, initials, photographs or case information where expressly authorised.

Legal basis: consent.

Legal claims

To establish, exercise or defend legal claims.

Legal basis: legitimate interest and applicable legal provisions.

BCN BPC does not carry out automated decision-making or profiling producing legal or similarly significant effects.

2.4 Data retention

Personal data will only be retained for as long as necessary for the purposes for which it was collected and for the periods required by applicable legislation.

As a general rule:

• enquiries that do not result in a client relationship may be retained for up to 12 months following the last contact;
• client information may be retained for the duration of the contractual relationship and afterwards for the legally required limitation and retention periods;
• contacts who request a document may be retained until they withdraw their consent or the purpose ceases;
• accounting and commercial records may be retained for the periods required under applicable commercial, accounting and tax legislation;
• testimonials may remain published until consent is withdrawn, unless another lawful basis applies.

Once the corresponding retention period expires, personal data will be deleted, anonymised or blocked where required by law.

2.5 Recipients and disclosure of personal data

BCN BPC does not sell, rent or otherwise disclose personal data to third parties for its own commercial benefit.

Personal data will only be communicated or made accessible to third parties where this is reasonably necessary to provide the service requested by the client, properly manage the professional relationship or comply with a legal obligation.

Depending on the relevant service, recipients may include:

• architects, engineers, surveyors, valuers and other technical professionals collaborating on the client's project;
• contractors, builders, installers, repair technicians, maintenance personnel and other trades or service providers involved in inspections, repairs, maintenance, renovation or property management;
• lawyers, notaries, administrative advisers, gestores and other professional advisers, where their participation is required;
• banks and financial institutions, where necessary in connection with an official valuation, mortgage application or other service expressly requested by the client;
• public administrations, courts, registries, the Cadastre and other public bodies, where legally required or necessary to carry out a procedure requested by the client;
• hosting, technology, communication, accounting and administrative service providers acting on behalf of BCN BPC;
• booking and messaging providers, such as Google (Calendar and Meet) and WhatsApp, when you use these channels;
• e-mail delivery providers, such as Resend, which send the messages generated by the website (confirmations, receipts and downloads);
• payment service providers and banks, such as Stripe, where you pay for a service.

Only the personal data reasonably necessary for the relevant service or purpose will be disclosed.

Where an external provider processes personal data on behalf of BCN BPC, the relationship will be governed by the confidentiality, security and data-processing obligations required by applicable data protection legislation.

BCN BPC does not provide client personal data to unrelated third parties for advertising, data brokerage, resale or independent commercial exploitation.

2.6 Your rights

Data subjects may exercise the following rights, where applicable:

• access;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• objection;
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests may be sent to:

bcnpropertiesconsulting@gmail.com

BCN BPC may request appropriate proof of identity where necessary to protect the rights and personal data of the data subject.

Requests will be handled within the periods established by applicable data protection legislation.

If you consider that your data protection rights have been infringed, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD).

2.7 Security

BCN BPC applies technical and organisational measures appropriate to the risks associated with the processing of personal data.

Such measures may include:

• access restrictions;
• secure authentication;
• HTTPS encrypted communications;
• confidentiality obligations;
• controlled access to client documentation;
• security and backup measures;
• procedures for managing security incidents.

No information system can guarantee absolute security, but BCN BPC takes reasonable measures appropriate to the nature of the information processed.

2.8 Accuracy of data

Users and clients are responsible for providing accurate, complete and up-to-date information.

They should notify BCN BPC of any relevant changes to their personal data.

2.9 Changes to this policy

BCN BPC may update this Privacy Policy to reflect legislative, technological or operational changes.

The version in force will always be the version published on the website.