Privacy notice

Version en-GB-2026-08-26. The version number and the date are stored against every address we hold, so we can always show you the exact notice that was on screen when you left it.

Who is responsible

BSI OÜ, Estonian registry code 14591080, Maakivi tn 8-2, 61708 Räni alevik, Kambja vald, Tartumaa, Estonia. Write to info@spanishpropertycheck.com about anything on this page. The full identity details are on the legal notice.

What we collect, and what we do not

One email address. Optionally, if you typed one into the address box, a short free-text description of a property.

We do not ask for your name, your telephone number, your budget, your purchase date or your property type, and there is no tickbox to mistake for a contract. There is no account, no login and no password.

We do not use cookies for analytics, advertising or measurement. One strictly-necessary cookie is set on the page that carries the form, to stop that form being posted from somewhere else. There is no tag manager, no heatmap, no session recorder and no third-party script anywhere on this site, which is why you have not been shown a cookie banner.

Why we hold it, and on what legal basis

Two purposes, stated separately, because they rest on different bases.

1. Storing the address and sending you one confirmation email. The basis is Article 6(1)(b) of the UK GDPR and the EU GDPR, second limb — steps taken at your own request before any agreement. We rely independently and in the alternative on Article 6(1)(f), our legitimate interest in answering a request you made, and a written assessment of that interest is on file and available on request.

2. Everything after that — telling you when a page, a figure, a fee or a procedure on this site changes. The basis is Article 6(1)(a), your consent, evidenced by the click on the confirmation email. No tickbox is required for that: Article 4(11) accepts a clear affirmative action, and clicking the button in an email that states in full what you are agreeing to is one.

Until you click that button we send you nothing else. If you never click, the address is deleted within 30 days and no further message is sent — not a reminder, not a second attempt.

What the address box is for, and what it is not

If you typed an address of a property into the box on this site, it was carried to the next page and shown back to you as what you asked about. Nothing was looked up. No register was searched, no cadastre was queried, no valuation was run and no record about that property exists anywhere in our systems. We hold no property data of any kind. The box exists so that, when a person writes back, they know which property you meant.

Who else sees it

• Neon, for the database, in the eu-central-1 (Frankfurt) region. Neon's parent company is established in the United States, and we disclose that as a third-country transfer even though the data itself sits in the European Union.
• Scaleway, in the fr-par (Paris) region, to send the confirmation email and any later message. Scaleway SAS is established in France.
• Vercel, which serves this website.

Each of these is a processor acting on our written instructions under Article 28. Nobody else sees your address.

We do not sell, share or pass your address to any third party.

We also do not reserve the right to do so later. There is no partner layer, no referral scheme and no list of "selected professionals", and a permission given to us cannot be handed to somebody else in any case. We would rather say nothing than reserve a right we cannot use.

How long we keep it

| State | What we hold | For how long | |---|---|---| | You left an address and have not confirmed | The address, the notice version, the timestamps and a truncated IP | 30 days, then deleted | | You confirmed | The same, plus the exact wording of the declaration you agreed to | Until you unsubscribe, or 18 months after the last time you engaged, when we ask you to confirm again | | You unsubscribed | An irreversible code derived from the address, and nothing else | Indefinitely, so that nobody can add you back by mistake | | You asked us to delete it | The same irreversible code, and nothing else | Indefinitely, for the same reason |

The exact text of the declaration you agreed to is stored against your record — the words themselves, not a template number. A version key is a promise that some other system still holds what you were shown. The words are the evidence.

Your rights

You can ask us to give you a copy of what we hold, correct it, delete it, restrict what we do with it, or object to it. You can ask for it in a portable form. You can withdraw your consent at any time, and withdrawing it does not make anything we did beforehand unlawful.

Two of those need no email at all: every message we send carries a one-click unsubscribe link, and a second link that deletes the address outright. They are different things and we keep them separate. Neither asks you to log in, give a reason, or answer "are you sure".

For anything else, write to info@spanishpropertycheck.com. We answer within 30 days.

Automated decisions

There are none. We do not profile you, score you, segment you or make any decision about you by automated means.

Complaints

You may complain to Andmekaitse Inspektsioon (AKI) in Estonia, which supervises us as controller. If you live in the United Kingdom you may complain instead to the Information Commissioner's Office, and if you live in Ireland to the Data Protection Commission. You do not need to raise it with us first, although we would rather you did.

A representative in the United Kingdom

Whether an Estonian controller in our position must appoint a representative under Article 27 of the UK GDPR has not been settled, and we will not assert an answer either way. If we appoint one, this page will name them. Until then this page names the controller and the authorities above.

Security

The address is held in an encrypted database in Frankfurt. Confirmation and unsubscribe links are signed, single-use and time-limited. We store a truncated IP address and a one-way session code, never a full IP address on the device and never a full IP address in any email we send you.

Changes to this notice

If we change it, we change the version number at the top and date it. The version that applied when you left your address stays attached to your record.

How we handle everything else on this site, including the correction policy and what we could not verify, is on sources and method.