Privacy

Your privacy matters. Here, we explain how we handle the personal information you share with us.

Last updated: 20 October 2026. This policy explains data processing through crepisan.com under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018.

1. Data controller

First, cREPISAN INMO SL, NIF B67736207. Registered and tax address: Calle Aribau, 168, floor 1, door 1, 08036 Barcelona (Barcelona), Spain. For privacy matters, use the contact form with the subject “Data protection” or write to this address.

2. Data we process

In addition, the form collects your name, email address, message and, where relevant, the property reference. The enquiry date is also recorded. Hosting services may log technical connection data, such as IP address, date, browser and errors, to operate and protect the service. The anti-repeat submission system temporarily uses an identifier derived from the IP address to limit submissions for one minute.

Also, required fields are needed to answer your enquiry. Without them, the form cannot be processed. Do not send identity documents, bank details, health data or other sensitive information in your message. Your data must be accurate and relate to you, or you must have a lawful basis for providing it.

3. Purposes and legal bases

• Answering general enquiries: your consent, expressed by submitting the form and ticking the relevant box (GDPR Article 6(1)(a)).
• Handling a viewing request, transaction enquiry or potential instruction you request: steps taken at your request before entering into a contract (Article 6(1)(b)).
• Website security and abuse prevention: the legitimate interest in protecting systems and communications (Article 6(1)(f)), with limited use of technical data.
• Meeting applicable legal duties and handling data rights: compliance with a legal obligation (Article 6(1)(c)).

For example, the form does not subscribe you to newsletters or authorise marketing campaigns. We do not use these enquiries for commercial profiling or automated decisions with legal or similarly significant effects.

4. Retention

Furthermore, enquiries are retained for the time necessary to reply and follow up on the request you initiated. Once that purpose ends, and no subsequent relationship justifies further processing, the data must be erased; only necessary data may remain restricted for applicable legal limitation periods. If a contractual relationship is established, information about its processing and retention periods will be provided separately. The anti-repeat submission identifier expires after one minute.

5. Recipients and service providers

Finally, enquiries are stored privately in WordPress and notified to the agency’s management email. Authorised staff and necessary hosting, email and maintenance providers may access data to deliver their services. Data may also be disclosed to authorities when legally required. Data is not sold and messages are not published on the website. Disclosure to owners or other transaction participants requires an appropriate legal basis and the relevant information.

6. Images and external services

In particular, illustrative photographs in this version are served by Crepisan. Viewing them does not connect your browser directly to Unsplash. External links open only when clicked and are governed by the destination website’s policy. Hosting and email providers may process technical data to deliver their services. Any change involving new international transfers requires a review of the applicable information and safeguards.

7. Your rights

However, you may request access, rectification, erasure, objection, restriction of processing and, where applicable, portability. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Address requests to CREPISAN INMO SL at the above address or through the form, using “Data protection” as the subject, describing the right you wish to exercise and providing a reply channel. Additional identification information will be requested only when necessary to verify identity.

Requests are generally answered within one month. Where GDPR conditions apply, this may be extended by two further months, with notice within the first month. You may complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

8. Security and updates

In addition, the website uses HTTPS and access controls for enquiry management. No system provides absolute security. This policy will be reviewed when processing or website services change. New purposes requiring consent must be presented separately for consent.