1.About us
Pálmi Fasteignasala (referred to below as "we", "us" or "Pálmi") acts as an intermediary between Icelandic buyers and Spanish property sellers in the Costa Blanca and Costa Cálida area.
Data controller:
Pálmi Fasteignasala
Ciudad Quesada, Southern Costa Blanca, Spain
Email: sala@palmifasteignir.is
Phone: 🇪🇸 +34 621 28 86 83 / 🇮🇸 +354 690 9090
2.What information do we collect?
When you contact us:
- Name
- Phone number
- Messages you send us
- Information about your interest in specific properties
When you browse the site:
- IP address (stored encrypted)
- Browser and device type
- Pages you visit and time spent on them
- Properties you view or save
- Country and city (general location)
When you accept cookies:
- Cookie settings (accept/reject)
- Timestamp of consent
When you make an offer to purchase:
- Identification (NIE number where applicable)
- Financial information related to the purchase
- Other data necessary for the purchase process
3.Why do we collect information?
We collect personal data in order to:
- Respond to your enquiries and provide our service
- Arrange viewing trips and presentations
- Assist with property purchases in Spain
- Send information about properties that may interest you (only with your consent)
- Improve our website and services
- Track the performance of advertising (with consent)
- Comply with legal obligations — e.g. anti-money-laundering law relating to property purchases
4.Legal basis
We process personal data on the following legal bases (per Article 6 of the GDPR):
- Your consent — for marketing communications and non-essential cookies
- Contractual necessity — when you enter into an agreement with us
- Legal obligation — e.g. accounting and anti-money-laundering law
- Legitimate interests — to improve our service and prevent fraud
5.Who has access to your information?
We only share your personal data with parties that are necessary to provide you with our service:
Within Pálmi:
- Pálmi staff who work with you directly
Partners:
- Spanish real estate agents when you show interest in specific properties
- Lawyers in Spain (gestores, abogados)
- Translators and interpreters when required
- Banking services in relation to transfers
Technology providers:
- Cloudflare (CDN and security) — USA/Netherlands
- Google (Analytics, Tag Manager) — only with consent
- Meta/Facebook (advertising) — only with consent
- Postmark (email service) — USA
Authorities:
- When required by law (e.g. tax authorities)
We never sell personal data to third parties.
6.Retention period
| Type of information | Retention period |
|---|---|
| Enquiries | 2 years from last contact |
| Purchase agreements | 7 years (accounting law) |
| Cookie consent | 1 year |
| Marketing sign-up | Until you unsubscribe |
| Web traffic analytics | 14 months (Google Analytics) |
| NIE and financial data | 10 years (anti-money-laundering law) |
After the retention period, we delete or anonymise the information.
7.Your rights
As a data subject, you have the following rights under the GDPR:
Right of access
You can request a copy of the information we hold about you.
Right to rectification
If information is incorrect, you can ask us to correct it.
Right to erasure ("right to be forgotten")
You can request that we delete information about you, unless we are legally required to keep it.
Right to restriction
You can ask us to temporarily stop using the information.
Right to object
You can object to processing based on our legitimate interests.
Right to data portability
You can receive your data in a format that can be transferred to another provider.
Right to withdraw consent
Where we process data based on consent, you can withdraw it at any time.
Right to complain
If you believe we are not respecting your privacy, you can lodge a complaint with:
- The Icelandic Data Protection Authority: personuvernd.is
- The Spanish Data Protection Authority: aepd.es
How to exercise your rights:
Send an email to sala@palmifasteignir.is and we will respond within 30 days.
8.Cookies
We use cookies to make the site better. Essential cookies are used for the basic functioning of the site; analytics and marketing cookies are not loaded until you accept them.
Essential (do not require consent):
- Login and session management for administrators
- Cloudflare Turnstile — protects forms against spam
- Browser storage (localStorage/IndexedDB) for faster rendering and cookie consent
- Crisp chat service — stores conversation ID so chat persists between visits
- Our own cookieless visit counter — counts page views without cookies; no IP address or personal data is stored, only a daily, salted and irreversible hash used to avoid double counting
Analytics (only with consent):
- Google Analytics (GA4) — visit statistics, IP address anonymised
Marketing (only with consent):
- Meta/Facebook Pixel — measures the performance of advertising
Services that receive your IP address when the page loads:
- Google Fonts — typography
- OpenStreetMap — map tiles
- YouTube and Vimeo — embedded videos set cookies when played
- Cloudflare — network security and content delivery
Form submissions are sent using the Postmark email service.
You can change your cookie settings at any time by clicking "Cookie settings" in the footer.
9.Security
We take data security seriously and use the following measures:
- Encryption of data in transit (HTTPS/TLS)
- Access control — only staff who need it have access
- Encryption of sensitive information in the database
- Regular security updates to our systems
- Two-factor authentication for admin systems
Despite these measures, no online storage is 100% secure. If a security breach occurs, we will notify you and the data protection authorities within 72 hours.
10.Changes to this policy
We review this policy regularly and may update it. When material changes are made, we will notify you by email (if you are registered) or with a message on the site.
The date of the last update is shown at the top of this page.
11.Contact us
Do you have questions about privacy or want to exercise your rights?
Pálmi Fasteignasala
Ciudad Quesada, Southern Costa Blanca
Spain