Privacy policy

The essentials, in six lines

• Who handles your data: GRAUBO REAL ESTATE, S.L.U., tax number B93839157, Plaça de la Salle 2, 43002 Tarragona, Spain. Write to ramon@graubo.com.
• What for: to answer your enquiry and, only if you ask by ticking the box, to send you the newsletter or alerts about new properties.
• For how long: 24 months from the last time you confirm your interest, after which whatever identifies you is erased.
• Who else sees it: seven suppliers, each named individually below. Nobody else, and never for sale.
• What you can do: access, rectification, erasure, restriction of processing, data portability and objection, by writing to that address. And complain to the Spanish Data Protection Agency.
• What is not done: no profiling with legal effects, no automated decisions, and no selling of data.

Below is the same thing in detail. It is long because the retention periods and the legal bases are given in figures and with the article cited, not in generalities.

1. Who the controller is

GRAUBO REAL ESTATE, S.L.U. (single-member company), tax number B93839157, registered office at Plaça de la Salle 2, 43002 Tarragona, Spain. Full registry details in the legal notice.

• Data protection contact: ramon@graubo.com
• Telephone: +34 696 373 839

There is no appointed data protection officer: this is a one-agent agency and none of the cases in article 37 of the General Data Protection Regulation or article 34 of Spanish Organic Act 3/2018 applies. Requests are answered by the sole director.

2. What data is collected, and where it comes from

What you give, and nothing else. Almost always through the form on this site, in which case it is this:

Plus three technical items generated by the submission rather than by you: the page you wrote from, any campaign parameters if you arrived through a link carrying them, and — only in the consent record — your pseudonymised IP address and your browser identifier.

The IP deserves precision, because it is a point where it is easy to fall short: your IP is not stored in the clear, what is stored is a cryptographic digest computed with a secret server key (HMAC-SHA-256). That is not anonymous data: it is pseudonymised data, it remains personal data, and it therefore falls within your rights of access and erasure like everything else. It is deleted when the retention period is reached.

No field is required by law or by contract. If you would rather not leave data on the website, call the number above: you will be attended to just the same. The only consequence of leaving the name and email blank is that there is no way to reply.

If instead of the form you send an email, telephone or write a letter, the data is whatever you choose to put in that message, and it is processed for the same purpose, on the same basis and for the same periods.

And if the relationship goes further — an instruction to sell, a viewing, an offer — the data for that work is held in the estate agency software listed in section 7, not on this website. Full and separate information is given before any of it is collected.

No special category data is collected, no third-party data is requested, and no lists are bought.

3. Why it is processed, and on what legal basis

There are six distinct processing operations with six distinct bases. They are kept apart on purpose: bundling them is what makes a policy useless.

3.1 Answering your enquiry

Basis: article 6.1.b of the Regulation — steps taken at your request prior to entering into a contract. The contract those steps relate to is the estate agency brokerage agreement for the sale and purchase of a home and the documents that precede it: the viewing sheet, the instruction to sell and, where applicable, the offer or reservation.

This purpose carries no consent tick box, and that is not an oversight. If you write in to ask something, the processing is justified by your own request; a box saying "I accept" would suggest you can withdraw something you never gave, and would in passing taint the two consents below. What there is instead is this information, before you send.

You do not need to tick any box to get a reply. The two boxes that follow are optional, and leaving them unticked changes nothing about the reply you get or how you are dealt with afterwards.

3.2 Commercial follow-up of an enquiry you started

Basis: article 6.1.f of the Regulation — legitimate interests. Once your enquiry has been answered, the pre-contractual step is spent; keeping your details so the matter can be picked up again is a separate operation and is declared as such.

The balancing test, in short: the interest is being able to serve a property transaction, which is decided over months rather than days; the impact on you is low because you started the contact, the data is contact data and not sensitive, and it is not combined with anything; and you have the right to object at any time under article 21 of the Regulation, by writing one line to the address above, with no need to give reasons and with no effect on anything else.

3.3 Newsletter

Basis: article 6.1.a of the Regulation — your consent — together with article 21 of Act 34/2002, which requires prior express consent for commercial communications by email.

With double confirmation, and it is worth understanding what that means: ticking the box creates a pending subscription and sends you an email with a link. Nothing is sent until you click that link and the subscription does not count as consented. If you do not click within 72 hours, the pending record is deleted, and if that leaves your enquiry with no consent at all, it is anonymised too.

The link works once and is consumed on use. There is no in-between state where you are half subscribed: either you confirmed, or you did not.

3.4 Alerts about new properties

Basis: article 6.1.a of the Regulation and article 21 of Act 34/2002. With the same double confirmation as the newsletter, in its own box and with its own link, separate from the other one: confirming the newsletter does not confirm the alerts, and unsubscribing from one does not unsubscribe you from the other.

An alert telling you a home is for sale is a commercial communication, however useful, and it is treated as one. The form does not ask for area, type or budget, so alerts are not segmented by declared preferences: everyone subscribed receives the same ones. There are no automated decisions with legal effects and no profiling that evaluates you. Were they ever segmented, the data would be requested explicitly and this policy updated first.

3.5 Anti-money-laundering obligations

Basis: article 6.1.c of the Regulation — compliance with a legal obligation, expressly cross-referenced by articles 32 and 32 bis of Spanish Act 10/2010, on the prevention of money laundering and terrorist financing.

An estate agency is an obliged entity under article 2.1.l of that Act. This processing is not triggered by writing through this website: it begins when a business relationship is established, that is, when an instruction to sell is signed or an offer is accepted. If that happens, full and separate information will be given to you then, before anything is collected.

Where it applies, it has two features worth knowing:

• Ten-year retention, imposed by article 25 of Act 10/2010, with restricted access from the fifth year. This period stands alone and prevails over the 24 months in the next section.
• The rights in articles 15 to 22 of the Regulation are excluded for the processing covered by Chapter III of that Act — the special examination, the reports to the Spanish financial intelligence unit (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales, SEPBLAC) and their retention — under article 32.2 of Act 10/2010. For customer identification under Chapter II, by contrast, access and rectification can be exercised normally; what does not apply is erasure while the statutory period is running.

3.6 Accounting, tax and invoicing obligations

Basis: article 6.1.c of the Regulation, with the periods set by article 30 of the Commercial Code, article 66 of the General Tax Act and the invoicing rules. This reaches only those who become clients or suppliers, not those who send an enquiry.

4. How long it is kept: four periods, not one

A single period for everything would be untrue. There are four clocks and they run at different speeds.

The detail of the first one matters: you move the clock, not me. It runs from your last confirmation of interest — a new form, a reply to an email of mine, an express confirmation — and nothing I send restarts it. Not a newsletter, not an alert, not a follow-up email. If you say nothing for 24 months, the period is reached and whatever identifies you is erased.

5. How your consent is proved, and what is kept of it

When you tick a box, the following is stored alongside the tick:

• The exact sentence you accepted, not a code. The server supplies it, never the browser: if it travelled from your device, a tampered request could record as accepted a sentence you never saw.
• The version of this policy in force at that moment.
• The language it was shown to you in, because this site has four and the sentence differs in each.
• The date and time, in coordinated universal time.
• The pseudonymised IP and your browser identifier, which are deleted when the period is reached.

This is the proof article 7.1 of the Regulation requires, and it is why this page carries a version number.

6. What happens when the period is reached, and when you ask for erasure

When the period is reached, the record is not deleted: it is anonymised. The name, email, telephone, message, pseudonymised IP and browser identifier are removed. The row stays, with nobody inside it, so it can be shown that the retention policy is actually applied, and every pass of the sweep leaves a record of having run, including on days when there is nothing to anonymise.

The whole row is not deleted. What is kept is the proof of consent — the literal sentence you accepted and the version of this policy, which are the text of a clause and a number rather than data about you — and the context data that no longer identifies anyone: the language, which form you used and the page you wrote from, the campaign parameters, the handling status of the enquiry and the dates of the record.

If you ask for erasure before the period ends, the sequence is this: the request is handled and answered; the data is withdrawn from ordinary use; a minimum record is kept blocked — identifier, date of the request and of the reply, and the sentence and version accepted — under article 32 of Organic Act 3/2018, accessible only to deal with a possible complaint; and that record is destroyed after three years. Blocking is not continued processing: it is being able to evidence that the right was honoured, a duty the law places on me.

If you unsubscribe from commercial communications, your address goes into an internal advertising suppression list that survives the erasure of everything else, on the basis of article 23 of Organic Act 3/2018. What is stored is a cryptographic digest of the address, not the address, because the only thing the list is for — checking a candidate before sending — needs no more than that. It exists so as not to write to you again by mistake, and for nothing else: it does not block a new sign-up that you ask for.

7. Who else processes your data

Nobody buys or receives your data for their own purposes. The suppliers below act on behalf of this company and on its instructions, each under its own processing agreement meeting article 28 of the Regulation. With one exception, Mobilia, whose agreement is committed but not yet signed: until it is, it receives no data from this website, and this is explained in the notes below. Of the seven, four process data about users of this website today; Mobilia will once it is connected, and the other two appear with their scope delimited in those notes, so it is clear why they are listed.

They are named one by one, with corporate name and country, rather than by category: it is the only approach consistent with explaining real international transfers.

Processor list, unchanged since version 1.0 of 27 August 2026.

Three clarifications an attentive reader would look for:

• Mobilia (Soluciones IP Hispanas, S.L.) is the only one of the seven whose article 28 agreement remains committed but unsigned. Until it is signed, the integration is not connected and no data from your enquiry goes there. On the day it is signed and connected, this policy is updated first.
• Cloudflare only resolves the domain name. The proxy is deliberately switched off, so it does not receive this website's traffic or the contents of your form: it processes name-query metadata, not your data. If the proxy were ever switched on, this policy would be rewritten before deployment.
• Anthropic is used to write the software behind this website, not to process your data. There is a written internal instruction prohibiting the entry of real personal data of this website's users into AI development tools; debugging is done with synthetic data. It is declared here for transparency, not because it processes your data.

Beyond these seven, your data may be disclosed to courts and public authorities where a legal rule so requires, and to the Spanish financial intelligence unit named in section 3.5, in the case described there.

8. International transfers

There are transfers, and saying otherwise would be false. It is worth understanding why, because the Supabase case is the one that least resembles what you would expect.

The database holding your enquiry is physically in Frankfurt, in the European Union. But the contracting entity, Supabase Pte. Ltd, is established in Singapore, and its staff can access the data remotely for support. What determines whether there is an international transfer is not where the data sits but where the person able to reach it sits: so this is an international transfer, and it is declared as such, even though the data never leaves Frankfurt.

Singapore has no adequacy decision from the European Commission. The transfer relies on the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, module 2, incorporated into the supplier's data processing agreement.

Vercel, Resend and Cloudflare process data in the United States, and that transfer relies on the same standard contractual clauses.

The suppliers in turn use sub-processors, some outside the European Economic Area. Each supplier publishes its own list and keeps it up to date. If you want to know who was on it at a given moment, write and it will be provided.

You can obtain a copy of the safeguards — the standard clauses and each supplier's annexes — by writing to ramon@graubo.com. It is a right under article 13.1.f of the Regulation and it is honoured at no cost.

9. Your rights

You can exercise the following by writing to ramon@graubo.com or by post to Plaça de la Salle 2, 43002 Tarragona, Spain:

• Access — to know what data about you is held and get a copy.
• Rectification — to correct anything wrong or incomplete.
• Erasure — to have it deleted, with the qualification in section 6.
• Restriction — to have it kept but not used, while something is being resolved.
• Portability — to receive it in machine-readable form, or have it sent to another controller.
• Objection — to the commercial follow-up in section 3.2, without giving reasons.
• Not to be subject to automated decisions — none are taken here, so there is nothing to contest.
• Withdrawal of consent to the newsletter or the alerts, at any time, without affecting what was lawfully sent before.

Withdrawing is as easy as giving: a link in every email, with no sign-up, no password, no reasons form and no questions. There is one link per purpose and one to unsubscribe from everything, and they work in old messages too: the link identifier is stable and does not expire.

Requests are answered within one month, extendable by two more if the request is complex, in which case you are told. The reply is free of charge.

If you are not satisfied with how a request was handled, you can complain to the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, which is this company's supervisory authority. The Catalan Data Protection Authority supervises the Catalan public sector, not a private company, so there is no point in approaching it.

And if you live or work in another European Union Member State, article 77.1 of the Regulation also lets you complain to that State's supervisory authority.

10. Minimum age

This form is not aimed at anyone under fourteen. Two of the three purposes rest on consent, and article 7 of Organic Act 3/2018 allows a person to consent on their own behalf only from that age. By sending the form you state that you are fourteen or older. If a submission is found to come from someone younger, it is deleted without being processed and without a copy being kept.

11. Security

The measures required by article 32 of the Regulation, specifically:

• The form is written from the server, never from the browser. Nothing can be written to the database from your device.
• The enquiry and consent tables have row-level security enabled and no policy granting anonymous access: neither read nor write.
• Your IP is never stored in the clear.
• Traffic is encrypted in transit, and the database is encrypted at rest.
• A per-address submission limit and a honeypot field stop automated abuse before anything is touched.

12. Version of this policy

Version 1.3 · 28 August 2026.

Every consent is stored with the version in force when it was given, so the number above is not decoration: it is half of the proof. Any substantive change — a new purpose, a new supplier, a different period — raises the number, is dated, and is published in all four languages at the same time. Earlier versions are kept so that it is always possible to know what the text you accepted said.