Transparency & privacy

Privacy policy

Last updated: May 1, 2026

1. Data controller

Comunidad de Propietarios de la Urbanización Entrepinos (residents' association)
Hinojos (Huelva) · 21740 · Spain
Contact: via the contact form on this website.

No Data Protection Officer (DPO) has been appointed, as it is not required by regulation for a residents' association of this size.

2. Purposes and legal basis for processing

We process personal data only for the following purposes:

Data
Name, email, phone (optional), message and voluntary attachments.
Legal basis
Consent of the data subject (Art. 6.1.a GDPR).
Data
Photograph and, if provided, name of the author.
Legal basis
Explicit consent of the data subject (Art. 6.1.a GDPR).
Data
Name, email, hashed password (bcrypt) and access level.
Legal basis
Performance of the resident relationship and consent (Art. 6.1.a and 6.1.b GDPR).
Data
Seller's contact details, plot description and photos, asking price.
Legal basis
Consent of the data subject (Art. 6.1.a GDPR).
Data
Anonymised IP, pages visited, session duration and approximate city.
Legal basis
Consent (Art. 6.1.a GDPR).
Data
Strictly required by the applicable regulations.
Legal basis
Legal obligation (Art. 6.1.c GDPR).

3. Data retention period

We keep personal data only for as long as necessary for the purpose for which it was collected:

  • Contact messages: while useful for handling the enquiry, then archived for a maximum of 3 years.
  • Registered users: as long as the account is active. Users may request deletion at any time.
  • Gallery photos: until the author requests their removal.
  • Plot listings: while the listing is active or until the owner removes it.
  • Audit and security logs: maximum 12 months.
  • Analytics data: per Google Analytics settings (maximum 26 months at Google).

4. Recipients and data processors

We do not sell or transfer personal data to third parties for commercial purposes. We only share data with the following technical service providers, acting as data processors:

Service
Web hosting and database.
Location
Spain (European Union).
Safeguards
Data processing agreement under Art. 28 GDPR.
Service
Google Analytics 4 (consent only), Google reCAPTCHA (contact form), Google Maps (location map, consent only).
Location
United States.
Safeguards
EU–U.S. Data Privacy Framework · Google's privacy policy.

International data transfers

Google LLC is certified under the EU–U.S. Data Privacy Framework, an adequacy decision adopted by the European Commission (10 July 2023), which guarantees a level of protection equivalent to that of the EU for personal data transfers to the United States. More information at dataprivacyframework.gov.

5. Your rights

As a data subject, you may exercise the following rights granted by the GDPR at any time:

  • Access: find out what data of yours we are processing.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): request the deletion of your data when no longer needed.
  • Restriction: request that we suspend processing in certain circumstances.
  • Objection: object to the processing of your data.
  • Portability: receive your data in a structured, commonly used format.
  • Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out beforehand.

You may exercise your rights by writing through the contact form or by post to Comunidad de Propietarios de la Urbanización Entrepinos (Hinojos, Huelva, Spain). We will respond within one month of receiving your request.

If you believe your rights have not been properly addressed, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD).

6. Security measures

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or alteration:

  • Encrypted connection via HTTPS/TLS across the entire website.
  • Passwords stored with bcrypt hashing, never in plain text.
  • Failed login attempt tracking and temporary account lockout.
  • Restricted permissions on uploaded files.
  • CSRF protection on all forms.
  • Audit logging of relevant actions in the admin panel.

7. Cookies and tracking technologies

For detailed information about the cookies we use, their purpose and how to manage them, see our cookie policy.

8. Changes to this policy

We may update this privacy policy to adapt it to legal or technical changes. When we do, we will update the date shown at the beginning of this document. We recommend reviewing it periodically.