Privacy policy

This policy informs you, in accordance with Art. 13 of the General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (Ley Orgánica 3/2018, LOPDGDD), about the personal data we process when you visit this website.

1. Controller

Wölfle & Partner S.L.
Calle Belgica 43
07180 Santa Ponsa (Mallorca), Spain
CIF: B57377319
Phone: +34 646 012 501
E-mail: info@woelfle-partner.com

If you have any questions about data protection, please contact us using the details above.

2. Summary

• No tracking, no analytics tools, no advertising or social media plugins.
• Fonts, images and scripts are hosted on our own server. No content is loaded from third parties.
• We only use technically necessary cookies (section 5).
• Google Maps is only loaded with your consent (section 7). You can change your choice at any time via “Cookie settings”.

3. Hosting and server log files

This website is operated by an external hosting provider, which processes data on our behalf and according to our instructions (Art. 28 GDPR).

Each time the site is accessed, the server automatically stores access data: IP address, date and time, page requested, amount of data transferred, status code, the previously visited page, browser and operating system. We need this data to deliver the website securely and reliably and to detect attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Log files are deleted after 14 days unless they are needed to investigate a specific security incident.

4. Encryption

The website is transmitted exclusively via encrypted HTTPS, so third parties cannot read the information you enter in forms.

5. Cookies and local storage

We use two technically necessary cookies:

• Session cookie (wolfle-partner-session): links your requests to a session, for example so that a form keeps your entries after an input error.
• Security cookie (XSRF-TOKEN): protects forms against forged requests from other sites.

Both cookies expire after 120 minutes of inactivity. As they are strictly necessary for the use you have requested, no consent is required (Art. 22(2) LSSI-CE). The legal basis is Art. 6(1)(f) GDPR.

Your privacy settings are stored in your browser’s local storage (localStorage, entry woelfle-consent): whether you have consented to Google Maps and when. The entry is not transmitted to us. We ask again after 12 months.

6. Contact and property enquiries

When you write to us using a form, we process the details you provide: name, e-mail address, phone number if given and your message; for property enquiries also the property concerned (reference number). Required fields are marked.

We store the enquiry in our database and also receive it by e-mail, so no enquiry is lost even if e-mail delivery fails. To protect against spam, we automatically check how quickly the form was completed and limit the number of enquiries per IP address. The IP address is only held briefly in a cache for this purpose and is not stored with the enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract (e.g. the brokerage of a property), otherwise our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).

Confirmation and withdrawal: After submitting, you will receive a confirmation at the e-mail address you provided. For security reasons it does not contain any of your free text. Using the link it contains, you can withdraw your enquiry for 30 days; we will then immediately delete your name, contact details and message. We send no more than 3 confirmations per address per day.

We delete your enquiry once it has been dealt with and does not lead to an order. If an order results, we keep the records for the periods required by commercial and tax law. The same applies to enquiries by e-mail or phone.

Spam and block list: Enquiries that we classify as spam are deleted automatically 30 days later. We may block e-mail addresses or domains that are used to misuse our forms. For this we store the address or domain, the reason for the block and the number of rejected enquiries. Enquiries from blocked addresses are neither stored nor forwarded. The legal basis is our legitimate interest in protection against spam and misuse (Art. 6(1)(f) GDPR). We lift a block as soon as misuse is no longer to be expected, or at your request if there is no misuse.

7. Google Maps (only with consent)

On the contact page you can display a map from Google Maps. It is only loaded if you consent: once by clicking “Load Google Maps”, or permanently via “Accept all” or the “External media” switch in the cookie settings. Only then does your browser connect to servers of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), transmitting, among other things, your IP address and the page visited. Google may set cookies and transfer data to the USA. Google is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision by the European Commission (Art. 45 GDPR).

The legal basis is your consent (Art. 6(1)(a) GDPR, Art. 22(2) LSSI-CE). You can withdraw it at any time with effect for the future: “Cookie settings”, switch off “External media”. More in Google’s privacy policy.

8. Recipients

Your data is only accessible to people in our company who need it for their work and to service providers acting on our behalf (hosting, e-mail delivery, technical support for the website), who are contractually bound by our instructions (Art. 28 GDPR). Beyond that, we only pass on data where we are legally obliged to do so. We do not sell data. There is no automated decision-making or profiling.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation.

An informal message to info@woelfle-partner.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

10. Changes

We update this policy when the website or the legal situation changes. The version published here applies.