Privacy Policy
Last updated: 15 April 2026
Who we are
Reformas Costa Sol is the controller of the personal data collected through this website, in line with the EU General Data Protection Regulation (GDPR) 2016/679 and Spain's Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).
- Controller: Richard Tune, trading as Reformas Costa Sol
- NIF: Y3826881-V
- Registered address: Calle Arquímedes 60, Buzón 148, 29100 Coín, Málaga, Spain
- Email: info@reformascostasol.com
- Phone: +34 624 37 99 17
What data we collect
When you contact us or request a quote
- Name
- Phone number
- Email (optional)
- Postcode and project details
- Preferred start dates
When you use our online quote form
The form helps us quote a renovation without an initial site visit. When you use it, we process:
- Property address as you select it (resolved via Google Places autocomplete)
- Coordinates (latitude / longitude) of the property
- Perimeter you draw on the satellite map
- Property imagery — we capture a Google Street View image of the address and store it alongside your enquiry
- Derived information — travel time and fuel cost from our base, an AI-generated pre-assessment of the Street View image, and contextual observations
We use this data to prepare an accurate quote. The property image is kept while the enquiry is open and deleted on closure or after 24 months, whichever comes first.
When you use the support chat
The floating chat on the site is powered by a large language model routed via Cloudflare AI Gateway. The messages you send:
- Are processed by Cloudflare (our infrastructure provider)
- Are forwarded to a model provider (Google — Gemini family) to generate the reply
- Are logged alongside your visitor IP and the conversation for quality audit and abuse prevention
Don't share sensitive personal data (health, financial information, official identifiers) in the chat. If your conversation turns into an enquiry, the transcript is kept with the enquiry record.
Data collected automatically
- IP address (for security, abuse detection and rate limiting)
- Cookie consent preferences
- Pages visited and interactions — analytics consent only (see Cookie Policy)
- Referrer data (which site brought you here, UTM parameters)
How we use your data
| Purpose | Lawful basis (GDPR art. 6) |
|---|---|
| Replying to enquiries and issuing quotes | Legitimate interest (pre-contractual enquiry) |
| Performing construction contracts | Performance of a contract |
| Operational communications (planning, invoices) | Performance of a contract |
| Website analytics | Consent |
| Advertising performance measurement (Meta / Facebook) | Consent |
| Fraud / bot prevention on forms (reCAPTCHA) | Legitimate interest |
| Security logs and abuse detection | Legitimate interest |
| Internal lead notifications (WhatsApp / email) | Legitimate interest |
Who we share data with
We work with the following data processors. All are bound by GDPR-compliant data processing agreements.
| Processor | Purpose | Data involved |
|---|---|---|
| Cloudflare | Hosting, security, database (D1), AI chat routing | All request data, enquiries, chat messages |
| Resend | Transactional email delivery (confirmations, internal alerts) | Name, email, enquiry summary |
| Google Analytics 4 | Website usage analytics (with consent) | Anonymised usage events, IP (truncated), consent mode signals |
| Google reCAPTCHA Enterprise | Bot and spam protection on the contact form | IP, browser fingerprint, form interaction |
| Google Maps / Places / Street View | Address search and imagery on the quote form | Query, coordinates, downloaded Street View image |
| Google Cloud — Vertex AI (Vision) | AI pre-assessment of your Street View capture | Property Street View image |
| Google / Cloudflare AI Gateway (LLM providers) | Generating support chat responses | Messages you send to the assistant |
| Meta (Facebook / Instagram) | Ad campaign performance measurement (with consent) | Hashed event data, Meta Pixel identifiers |
| CallMeBot (WhatsApp notifications) | Internal team notifications | Client name, enquiry summary |
We do not sell your data to third parties, and we do not use it to train external AI models.
Automated decision-making
When an enquiry arrives, we use an AI model to pre-score it (quality, urgency, spam likelihood) and prioritise replies. This is decision support, not automated decision-making with effects on you — a person reviews every enquiry before any action that affects you. You can ask us to review your enquiry without reference to the AI score by emailing info@reformascostasol.com.
International transfers
Some processors (Google, Meta, Cloudflare) operate globally. When data is transferred outside the European Economic Area, it is protected by Standard Contractual Clauses approved by the European Commission or by adequacy decisions from the Commission for the processor's region. You can request copies of the safeguards in place by email.
Retention periods
- Enquiries: up to 24 months after the last contact, then deleted
- Project records (contracts, invoices): in line with Spanish tax and commercial obligations (minimum 6 years, up to 10 years for the LOE decennial warranty)
- Property images from the form: stored with the enquiry, deleted with it
- AI chat transcripts: 90 days if they don't lead to an enquiry; if they do, kept with the enquiry
- Analytics data: up to 14 months in GA4 (default retention)
- Cookie consent: 13 months from the date of consent, then asked again
- Security logs: 30 days
Your rights
Under the GDPR and LOPDGDD, you have the right to:
- Access — request a copy of the data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data (subject to legal retention obligations)
- Restriction — ask us to stop processing your data for specific purposes
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — for any processing based on consent (analytics, advertising, AI chat)
Email info@reformascostasol.com and we'll reply within 30 days at the latest.
Complaints
If you're not happy with how we handle your data, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): aepd.es · C/ Jorge Juan, 6 · 28001 Madrid · Tel. 901 100 099.
Changes
We may update this policy when our processing changes. Material changes will be announced on the site; the "Last updated" date at the top always reflects the current version.