Privacy Policy

1. Data Controller

In compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), you are hereby informed that:

  • Controller: DRUMELIA 2.0 S.L. (en adelante, “DRUMELIA REAL ESTATE”)
  • Tax Identification Number: B93728293
  • Registered address: Centro de Negocios Puerta de Banús, Edificio B, Local 11, 29.660, Marbella (Málaga)
  • Telephone: +34 952 766 950
  • Contact email: legal@drumelia.com

DRUMELIA REAL ESTATE is the data controller of the personal data collected through the website www.drumelia.com and any other contact channels indicated.

2. Data Processed, Origin and Categories of Data Subjects

2.1. Data We Process

As a general rule, the following categories of data are processed:

  • Identifying data: first name and surname(s).
  • Contact data: telephone number, email address, postal address.
  • Basic professional data (where contact is made on behalf of a company): job title, company name, industry sector.
  • Data relating to the property of interest (type of property, location, price range, preferences).
  • Browsing and website usage data: IP addresses, device identifiers, cookies and similar technologies, pages visited, forms used, time spent on the site, etc.
  • Commercial communications data: marketing preferences, communications history, interaction with campaigns.

Special categories of data (health, ideology, etc.) and data relating to criminal convictions and offences are not processed on a systematic basis, unless strictly necessary for compliance with legal obligations, in which case they will be processed with the enhanced safeguards provided for under applicable regulations.

2.2. Origino of Data

Personal data is obtained:

  • Directly from the data subject, when they complete forms on the website, send emails, make telephone calls or hold meetings with the DRUMELIA REAL ESTATE team.
  • Automatically, through cookies and similar technologies when the user browses the website (see the Cookies Policy).
  • Where applicable, from publicly accessible sources (public registers, land registry, etc.) and from third parties acting as intermediaries, provided there is an appropriate legal basis for doing so.

3. Purposes of Processing and Legal Bases

Personal data is processed for the following purposes, on the legal bases indicated:

3.1. Management of Enquiries and Information Requests

Purpose: to handle enquiries, information requests and communications submitted by users through contact forms, email, telephone or other means.

Legal basis:

  • Performance of pre-contractual measures or a contract at the request of the data subject (Article 6(1)(b) GDPR), where the enquiry relates to real estate intermediation services or the engagement of services.
  • Legitimate interest of DRUMELIA REAL ESTATE in responding to information requests and maintaining relationships with its contacts (Article 6(1)(f) GDPR), in all other cases.

3.2. Provision of Real Estate Intermediation and Promotion Services

Purpose: to manage the contractual relationship with buyer, seller, landlord or tenant clients, including property valuation, preparation and negotiation of transactions, document management and coordination with other professionals involved (notaries, financial institutions, etc.).
Legal basis: Performance of a contract to which the data subject is party, or application of pre-contractual measures at the request of the data subject (Article 6(1)(b) GDPR).

3.3. Compliance with Legal Obligations

Purpose: to comply with the legal obligations applicable to DRUMELIA REAL ESTATE, in particular those relating to taxation, accounting, prevention of money laundering and terrorist financing, data protection, consumer protection and other sector-specific regulations.
Legal basis: Compliance with a legal obligation applicable to the controller (Article 6(1)(c) GDPR).

3.4. Commercial Communications and Marketing

Purpose: to send commercial communications by electronic or equivalent means (email, SMS, telephone calls, instant messaging) regarding properties, services and activities of DRUMELIA REAL ESTATE, as well as to carry out basic segmentation and commercial profiling in order to tailor communications to user preferences.

Legal basis: Consent of the data subject (Article 6(1)(a) GDPR), where specifically requested through the relevant forms.

Legitimate interest of DRUMELIA REAL ESTATE in carrying out direct marketing in respect of clients with a prior contractual relationship, in relation to products or services similar to those originally engaged, provided that a simple and free opt-out mechanism is offered (Article 6(1)(f) GDPR, in conjunction with the right to object under Article 21 GDPR and the commercial communications regime under the LSSI and consumer protection regulations).

Data subjects may object at any time to the processing of their personal data for direct marketing purposes, including profiling carried out in connection with such purposes.

3.5. Website Security Management and Fraud Prevention

Purpose: to ensure the security of the website, detect unauthorised access, prevent fraudulent activities and manage security incidents.
Legal basis: Legitimate interest of DRUMELIA REAL ESTATE in ensuring network and information security (Article 6(1)(f) GDPR, Recital 49).

3.6. Video Surveillance at Physical Premises

Purpose: to protect the safety of persons, property and facilities through camera or video surveillance systems at the offices or premises of DRUMELIA REAL ESTATE.

Legal basis: Legitimate interest of the controller in ensuring the safety of persons and property (Article 6(1)(f) GDPR), in accordance with the specific regime under Article 22 of Organic Law 3/2018.

In this case, images will be retained for a maximum period of one month, unless they must be preserved to evidence acts that threaten the integrity of persons, property or facilities, in which case they will be made available to the competent authority within a maximum period of 72 hours from becoming aware of the existence of the recording.

4. Retention of Data

Personal data will be retained for the following periods:

  • Enquiry and information request data: for the time necessary to handle the enquiry and, where applicable, for the duration of any pre-contractual or commercial relationship, and thereafter for the limitation periods applicable to any claims arising from such relationship.
  • Client and real estate transaction data: for the duration of the contractual relationship and, thereafter, for the retention periods required under tax, accounting and anti-money laundering regulations.
  • Data used for commercial communications: until the data subject withdraws their consent or objects to the processing; in any event, distribution lists will be reviewed periodically to remove inactive contacts.
  • Browsing data: as indicated in the Cookies Policy, depending on the type of cookie and the applicable technical retention periods.
  • Video surveillance images: a maximum of one month, unless retained to evidence unlawful acts, in accordance with Article 22 of Organic Law 3/2018.

Once the above periods have elapsed, data will be deleted or anonymised, unless it must be retained in a blocked state to address any potential liabilities, in accordance with applicable regulations.

5. Recipients and Data Processors

5.1. Recipients

As a general rule, personal data will not be disclosed to third parties, except:

  • Public authorities, competent authorities and bodies, where necessary for compliance with legal obligations or to respond to official requests.
  • Notaries, land registries, financial institutions and other professionals involved in real estate transactions, where disclosure is necessary for the performance of the contract or pre-contractual measures at the request of the data subject.
  • Ancillary service providers (such as marketing firms, technology providers and security companies) acting as data processors, in accordance with Article 28 GDPR.

No international transfers of data outside the European Economic Area are envisaged, unless services provided by suppliers located in third countries are used. In such cases, it will be ensured that the transfer is carried out with appropriate safeguards (adequacy decisions, standard contractual clauses or other mechanisms provided for under the GDPR).

5.2. Data Processors

DRUMELIA REAL ESTATE may engage third parties acting as data processors with access to personal data for the provision of services (hosting, IT maintenance, CRM tools, marketing services, security, etc.). Contracts complying with the requirements of Article 28 GDPR and Article 33 LOPDGDD will be entered into with all such parties, ensuring that they process data solely in accordance with the instructions of DRUMELIA REAL ESTATE and implement appropriate security measures.

6. Rights of Data Subjects

Data subjects may exercise, at any time, the rights recognised to them under the GDPR:

  • Right of access: to obtain confirmation as to whether DRUMELIA REAL ESTATE is processing personal data concerning them and, if so, to access such data and the information provided for under Article 15 GDPR.
  • Right to rectification: to request the rectification of inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten"): to request the erasure of data where any of the circumstances set out in Article 17 GDPR apply.
  • Right to restriction of processing: to request the restriction of processing in the cases provided for under Article 18 GDPR.
  • Right to object: to object to the processing of their data on grounds relating to their particular situation, in particular where processing is based on the legitimate interest of the controller or is carried out for direct marketing purposes.
  • Right to data portability: to receive personal data concerning them in a structured, commonly used and machine-readable format, and to transmit it to another controller, where processing is based on consent or a contract and is carried out by automated means.

These rights may be exercised directly or through a legal or voluntary representative, by submitting a request to DRUMELIA REAL ESTATE through any of the following means:

  • Email: legal@drumelia.com
  • Postal address: Centro de Negocios Puerta de Banús, Edificio B, Local 11, 29.660, Marbella (Málaga)

The request must include the data subject's full name, a copy of an identity document (national identity card or passport), an indication of the right they wish to exercise and, where applicable, a description of the information to which the request relates. The exercise of these rights shall be free of charge, unless requests are manifestly unfounded or excessive, in which case DRUMELIA REAL ESTATE may refuse the request or charge a reasonable fee, in accordance with Article 12(5) GDPR and Article 12 LOPDGDD.

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that the processing of their personal data infringes applicable regulations.

7. Additional Information on Transparency and the Duty to Inform

Where personal data is obtained directly from the data subject, DRUMELIA REAL ESTATE will provide, at the time of collection, the information required under Article 13 GDPR, which may be provided through "layered information" systems, supplying basic information in forms and referring to this Privacy Policy for additional information.

Where personal data is not obtained from the data subject, DRUMELIA REAL ESTATE will provide the information required under Article 14 GDPR within the established timeframes, unless any of the exceptions provided for in that provision apply.

8. Security of Processing

DRUMELIA REAL ESTATE will implement appropriate technical and organisational measures to ensure a level of security commensurate with the risk, including, where appropriate, the pseudonymisation and encryption of personal data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, and regular processes for testing, assessing and evaluating the effectiveness of such measures.

DRUMELIA REAL ESTATE will take measures to ensure that any person acting under its authority who has access to personal data may only process it in accordance with its instructions, unless required to do so by Union or Member State law.

9. Updates to the Privacy Policy

DRUMELIA REAL ESTATE reserves the right to modify this Privacy Policy in order to adapt it to legislative developments, judicial criteria, recommendations from supervisory authorities or changes to the personal data processing activities it carries out.

Any amendments will be published on the website and, where applicable, communicated to data subjects where they materially affect their rights or interests.

Call us Contact