Privacy policy
Last updated: 8 November 2026
This policy explains how Consortium Ventures, S.L. (“Consortium Collection”, “we”) collects and uses personal data when you visit consortiumcollection.com, send us an enquiry, call us, or write to us by email, text message, WhatsApp, Instagram or Facebook. We follow the EU General Data Protection Regulation (GDPR), the Spanish data protection law (LOPDGDD) and the Spanish law on information society services (LSSI-CE).
1. Who is responsible
Consortium Ventures, S.L., Av. Ricardo Soriano 34, 2-5, 29601 Marbella, Málaga, NIF B05787635, is the controller of the personal data described here. We have not appointed a data protection officer. For anything about your data, write to info@consortiumcollection.com, which reaches our team.
2. What we collect
What you give us
When you send an enquiry, ask for a brochure, ask about a property, or contact us in any other way: your first and last name, email address and phone number, your country of residence, what you are looking for (areas, budget, timing, the kind of property), and anything else you choose to tell us or send us, such as photos and documents.
Calls, messages and emails
Calls to and from our business numbers are recorded, and we tell you so at the start of the call. Each recording is written down automatically, each side on its own, so your agent has an accurate record of what you asked for. Text messages and WhatsApp messages to our business numbers, with their photos, files and voice notes, are kept with your enquiry, and voice notes are written down too. Emails between you and our team are kept with your enquiry, with their attachments, including answers our agents send from their own mailbox.
Emails we send from our client records can record when they are opened and which of their links are pressed, and the personal links we send you for a selection of properties record when they are opened. We see that on your record.
Instagram, Facebook and WhatsApp
When you send a message to our Instagram account or our Facebook Page, or comment on our posts there, we receive what Meta passes on: your name or username as shown on that platform, the id Meta gives you for our account, what you wrote or sent, and when. When you write to us on WhatsApp, we receive your phone number, your WhatsApp profile name and your messages. We use this only to answer you and to look after your enquiry, and we keep it with your enquiry. We never use it for advertising, never sell it, and never pass it to anyone outside the providers listed below. How Meta itself handles your data on its platforms is explained in Meta’s own privacy policy.
What our systems record
When you visit, our hosting and security provider (Cloudflare) processes your IP address and technical details of each request, such as your browser, your device and the page asked for, to deliver the website and protect it from abuse. It also tells the page which country you are in, so that the phone field on our forms starts with your country’s dialling code; that is not kept. If you accept cookies, analytics and advertising tools also record how the website is used (see the cookie policy).
If you say yes to counting visits and seeing how the site is used, we also keep our own record of your visits, under a random id in your browser: the pages and properties viewed and for how long, searches and filters, what was saved or opened, that a form was started, your country and the kind of device. We never keep your IP address or what you type into a form in it. On its own it carries no name, and it joins an enquiry only where the form says so. Microsoft Clarity also makes recordings and heatmaps of how the site is used, with anything you type hidden.
What advertising platforms pass on
If you reach us through an advertisement, the link can carry a click identifier and the campaign’s details. We keep them with your enquiry, to see which advertising works. If you said yes to advertising and send us an enquiry, we tell Google which ad click led to it, and when that enquiry later becomes a viewing or a purchase: the click’s identifier, never your name, email or phone, and only for clicks from the last 90 days. With that yes, groups of visitors from Google Analytics can also be used for our ads, to show you relevant ones.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answer your enquiry and run your search: shortlists, viewings, checks and negotiation, whichever channel you contact us on | Steps you ask for before a contract, and the contract itself (GDPR article 6(1)(b)) |
| Keep you informed about your search and your appointments | The contract (article 6(1)(b)) |
| Record and write down calls, and keep messages and emails with your enquiry, so that what you asked for and what was agreed is on record | Our legitimate interest in an accurate record of our work for you (article 6(1)(f)). You can ask us not to record a call |
| Let our AI assistant help the team find what is on your record, summarise it and prepare drafts. A person reads every draft before anything is sent | Our legitimate interest in answering you well and quickly (article 6(1)(f)) |
| Alert our team when you contact us, so you get an answer quickly | Our legitimate interest in answering quickly (article 6(1)(f)) |
| See which of our channels and campaigns bring enquiries, from the campaign details in the link you followed; see when our emails and selections are opened | Our legitimate interest in knowing what works and in following up your enquiry (article 6(1)(f)) |
| Count visits to this website and see how it is used; measure our ads and show you relevant ones; tell Google which ad click led to your enquiry; join our record of your visits to your enquiry where the form says so | Your consent, given in the cookie banner (article 6(1)(a)) |
| Send you news or new properties by email, if you ask us to | Your consent (article 6(1)(a)) |
| Keep the records the law requires: tax, accounting and anti-money-laundering | Legal obligation (article 6(1)(c)) |
| Keep the website and our systems secure | Our legitimate interest in security (article 6(1)(f)) |
You can withdraw your consent at any time. It does not affect what was done before. You can also object to anything we do on the basis of our legitimate interests (see section 7).
4. How long we keep it
| Data | How long |
|---|---|
| Enquiries that don’t lead to working together, with their calls, messages and emails | Two years after our last contact, then deleted |
| Clients’ files, with their calls, messages and emails | For as long as we work together. After that, as long as the law requires, then deleted: six years for the records and correspondence of our business (Commercial Code, article 30), and ten years from the end of the purchase or sale for the identity checks and records the anti-money-laundering law asks of estate agents (Law 10/2010, articles 2 and 25) |
| Call recordings and their transcripts; photos, files and voice notes you send us | With the enquiry or client file they belong to, and deleted with it. Our phone provider deletes its copy once the recording or file is in our own storage |
| Messages and comments from Instagram, Facebook and WhatsApp | In our records, with the enquiry or client file they belong to, and deleted with it. On Meta’s platforms, for as long as Meta keeps them |
| Consent to marketing emails | Until you withdraw it |
| Our own record of visits to this website | If it never joins an enquiry, it is deleted 90 days after the last visit. Once joined to an enquiry, each visit is kept for 14 months and then deleted. You can ask us to delete it at any time, and it goes at once if you take back your yes |
| Analytics and advertising data from this website | Google Analytics: 14 months. The other tools: as set by each (see the cookie policy). Google hears about an ad click only within 90 days of it |
| Anything you ask us to delete | Deleted within one month. What the law makes us keep is set apart and locked, for the courts and authorities only, until its period ends (LOPDGDD, article 32). See deleting your data |
5. Who receives it
We never sell your data. It goes only to the people and providers below.
Service providers who process it for us, under contract:
| Provider | What it does for us | Where |
|---|---|---|
| Cloudflare | Hosts this website and our client records, and protects them; counts page views without cookies; sends our emails from info@consortiumcollection.com; writes down calls and voice notes | Client records and files are stored in the EU. Its network, and the writing down, can run outside the EU |
| Our email (Google Workspace), including reading answers from you in our agents’ mailboxes into your enquiry. Only with your consent: Google Analytics and Google Ads, and which ad click led to your enquiry | EU and United States | |
| Twilio | Our phone calls, text messages and WhatsApp messages | United States and other countries |
| Meta (WhatsApp, Instagram, Facebook) | Carries WhatsApp messages, and messages and comments on our Instagram account and Facebook Page | United States and other countries |
| Anthropic | The AI assistant in our client records: it reads what it needs from your record to answer a team member’s question or prepare a draft | United States |
| Apple | Notifications on our team’s iPhones about new enquiries and messages, which can show your name and the start of your message | United States |
| CallMeBot | A WhatsApp alert to our team when a new enquiry comes in: your name and where you contacted us from, never your email address or phone number | Not stated by the provider |
| Microsoft | Only with your consent: Microsoft Clarity | United States |
| ScalaHosting | The server for our older brief form and our property listings service | EU (Bulgaria) |
Some of our designed emails load the website’s typefaces from Google Fonts, in the email apps that allow it, so Google sees that request.
- Professionals in your purchase, such as lawyers, notaries and surveyors, when you ask us to involve them.
- Authorities, when the law requires it, such as the tax agency or the anti-money-laundering authority (SEPBLAC).
Listing photos are loaded from Resales Online’s image servers, so your browser’s request, with your IP address, reaches them when you view a listing.
6. Transfers outside the European Union
Some providers process data outside the EU, mostly in the United States. Cloudflare, Google, Meta, Microsoft and Twilio are certified under the EU–US Data Privacy Framework, and transfers to them rely on it. Transfers to Anthropic and Apple rely on the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguards.
7. Your rights
You can ask us to:
- show you the personal data we hold about you;
- correct it, or delete it (see deleting your data);
- limit how we use it, or stop using it for purposes based on our legitimate interests;
- give it to you, or to someone else, in a common machine-readable format;
- stop using it for anything you consented to.
Write to info@consortiumcollection.com, or send us a message on WhatsApp, Instagram or Facebook. We may ask you to confirm your identity, and we reply within one month. If you are not satisfied, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the authority where you live.
8. Decisions and AI
We make no decisions about you by automated means alone. Our AI assistant can find, summarise and draft, and it can suggest a next step, but a person decides, and a person reads every message before it is sent.
9. Cookies
See the cookie policy.
10. Children
This website is not meant for children. We don’t knowingly collect data from anyone under 14, the age of digital consent in Spain (LOPDGDD, article 7).
11. Security
Connections to this website are encrypted. Access to personal data is limited to the people who need it, and our providers are bound by contract to protect it.
12. Changes
When this policy changes, we update this page and the date at the top.
13. Contact
info@consortiumcollection.com · Av. Ricardo Soriano 34, 2-5, 29601 Marbella, Málaga