1. Data controller

• Geoffrey Mander trading as Mander Estates
• NIF/NIE: Z3953828H
• Los Carmenes, Manilva, Málaga 29691, Spain
• geoff@manderestates.com · +34 613 40 56 10

This policy explains how we handle personal data collected through www.manderestates.com. It reflects what this website actually does — we do not run advertising pixels or behavioural profiling.

2. What we collect

We only collect what you choose to send us, plus limited technical data:

• Enquiry and contact forms — name, email, telephone/WhatsApp number and your message, plus the property reference and page you enquired from, and any preferred viewing date or viewing type you select.
• Valuation / selling enquiries — the property address you provide together with your contact details.
• Property alerts registration — first and last name, email, telephone, and your search criteria (areas, budget, property types, bedrooms), together with your marketing consent.
• Find My Perfect Area and buyer questionnaires — your answers about budget, timescale, lifestyle priorities and property requirements, and the contact details you provide to receive your results.
• Email, telephone and WhatsApp — the contact details and content of messages you send us directly.
• Technical and campaign data — standard server/hosting log data such as IP address, browser and request information, and (only if you consent) first-touch campaign information such as UTM parameters, referring website, landing page and device type, which is stored in your browser and sent with any enquiry you submit.

We do not operate a customer login on this website, we do not use Google Analytics, Meta pixels or advertising cookies, and we do not knowingly collect data from children.

3. Why we process it and on what legal basis

• Responding to your enquiry and arranging viewings — Article 6(1)(b) GDPR, steps taken at your request prior to a contract, or Article 6(1)(f) legitimate interest in handling business enquiries.
• Providing our estate agency and advisory services — Article 6(1)(b) GDPR (performance of a contract) where you instruct us.
• Sending property alerts and market updates — Article 6(1)(a) GDPR, your consent, given by the separate tick box on the registration form. You can withdraw it at any time.
• Matching your requirements to available properties — Article 6(1)(b)/(f) GDPR, to give you the results you asked for.
• Campaign attribution — Article 6(1)(a) GDPR, your consent given through the cookie banner.
• Security, fraud prevention and keeping records of our dealings — Article 6(1)(f) legitimate interests, and Article 6(1)(c) where we must comply with a legal obligation.

Submitting a property enquiry never requires you to accept marketing. Marketing consent is always requested separately.

4. Who processes data for us

We use a small number of service providers who act as processors or independent controllers, and only to run this website and communicate with you:

• Website hosting and database — our development and hosting platform (Lovable) and its managed database and edge hosting infrastructure (Supabase, on infrastructure within the EU), which store website content, enquiries and registrations.
• Email — Google Workspace (Google Ireland Limited), used to send and receive enquiry notifications and our replies.
• Fonts — Google Fonts, used to serve the website typefaces; your browser requests those files from Google's servers and your IP address is visible to them in the process.
• Appointment booking — Calendly, if you choose to follow a booking link and schedule a call; any details you enter there are handled under Calendly's own privacy policy.
• WhatsApp and social platforms — if you contact us through WhatsApp (Meta) or social media, that conversation is also subject to the platform's own terms and privacy policy.
• Property networks and collaborating agents — where a property you enquire about is listed or owned by another agency, developer or owner, we share the details necessary to progress your enquiry or arrange a viewing, and only for that purpose.

We do not sell personal data, and we do not share it for third-party advertising.

5. International transfers

Our hosting and database are located within the European Union. Some providers (such as Google, Calendly and Meta) may process data outside the European Economic Area. Where that happens, transfers are made under the safeguards those providers rely on, principally the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

6. How long we keep it

• Enquiries that do not progress: normally up to 24 months from the last contact.
• Property alert registrations: until you unsubscribe or withdraw consent, and reviewed periodically for inactivity.
• Client records relating to a completed transaction: for as long as required by Spanish commercial, tax and anti-money-laundering legislation.
• Campaign attribution stored in your browser: until you clear it or withdraw consent.

7. Security

Data is transmitted over encrypted connections (HTTPS) and stored in access-controlled systems with row-level access restrictions. Access is limited to those who need it to deal with your enquiry. No system can be guaranteed absolutely secure, but we take appropriate technical and organisational measures to protect your information.

8. Your rights

You have the right to access your personal data and to request rectification, erasure, restriction of processing, or to object to processing based on legitimate interests. Where processing is based on consent or a contract and carried out by automated means, you also have the right to data portability, and you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email geoff@manderestates.com. You can unsubscribe from property alerts at any time by replying to any message or contacting us.

If you believe your data has been handled improperly you may lodge a complaint with the Spanish Data Protection Agency, Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.

9. Cookies

Details of the cookies and browser storage used by this website, and how to change your choices, are in our Cookie Policy.

10. Changes to this policy

We may update this policy to reflect changes in our services or in the law. The current version is always published on this page with its last-updated date.