Information on the processing of personal data

Information obligation (Articles 13/14 GDPR)

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), we inform you about how Costa Dream Home Luxury processes personal data.

1. Data controller

The data controller is Costa Dream Home Luxury (CDH Luxury). Contact: info@cdhluxury.com.

2. Data protection officer

Given the scale of our activities, no separate data protection officer has been appointed. For any matters related to the protection of personal data, you can contact the controller directly.

3. Purposes and legal bases for processing

• Handling enquiries about properties and services — basis: necessity to take steps prior to entering into a contract (Article 6(1)(b) GDPR)
• Sending the newsletter — basis: consent (Article 6(1)(a) GDPR)
• Processing job applications — basis: the controller's legitimate interest and the candidate's consent (Article 6(1)(a) and (f) GDPR)
• Valuing and handling property-sale submissions — basis: necessity to take steps prior to entering into a contract (Article 6(1)(b) GDPR)
• Fulfilling legal obligations (e.g. tax, accounting) — basis: Article 6(1)(c) GDPR

4. Data retention period

Data is stored for as long as necessary to fulfil the purpose of processing, and where processing is based on consent — until that consent is withdrawn. Data subject to tax or accounting regulations is stored for the period required by those regulations.

5. Recipients of data

Recipients of data may include providers of IT, hosting and accounting services on our behalf, as well as — only with the client's knowledge and to the extent necessary to carry out a transaction — partner law firms and developers.

6. Transfers of data outside the European Economic Area

As a rule, personal data is not transferred outside the European Economic Area. Should such a transfer become necessary in the future, it will be carried out with an adequate level of data protection in line with GDPR requirements.

7. Rights of the data subject

You have the right to:

• Access — obtaining information about what data we process and to what extent
• Rectification — correcting inaccurate or outdated data
• Erasure — the so-called "right to be forgotten", to the extent provided for by law
• Restriction of processing — temporarily suspending the processing of your data
• Data portability — receiving your data in a structured format
• Objection — to processing based on legitimate interest
• Withdrawing consent — at any time, without affecting the lawfulness of processing carried out beforehand
• Lodging a complaint — with the supervisory authority for your place of residence, stay, or the controller's registered office: in Spain the Agencia Española de Protección de Datos (AEPD), in Poland the Urząd Ochrony Danych Osobowych (UODO)

8. Automated decision-making

We do not use automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

9. Voluntary provision of data

Providing personal data is voluntary, but necessary to handle your enquiry, submission, or newsletter subscription — without your contact details, we won't be able to respond to your message.