W&O Real Estate

Privacy Policy

  1. 1. Who is responsible for your data?
  2. 2. Who does this privacy policy apply to?
  3. 3. What personal data do we process?
  4. 4. Why do we process personal data and on what legal basis?
  5. 5. How do we receive your data?
  6. 6. Advertising and lead forms on Facebook and Instagram
  7. 7. Cookies, Google Analytics and Google Ads
  8. 8. Hosting, data storage and other service providers
  9. 9. Who do we share personal data with?
  10. 10. Processing outside the European Economic Area
  11. 11. How long do we retain data?
  12. 12. How do we protect personal data?
  13. 13. What rights do you have?
  14. 14. Are you required to provide data?
  15. 15. Automated decision-making
  16. 16. External websites and communication platforms
  17. 17. Making a complaint
  18. 18. Changes to this privacy policy

Last updated: 31 October 2026

W&O Real Estate handles your personal data with care. This privacy policy explains which data we process, how we use it, whom we share it with and what rights you have.

This privacy policy applies to our website, enquiries, communications and services. It also applies when you submit your details through a W&O Real Estate advertising form on Facebook or Instagram.

1. Who is responsible for your data?

W&O Real Estate is a trading name of W&O Estates S.L. This company is the controller responsible for the processing described in this privacy policy.

Company name: W&O Estates S.L.
CIF/NIF: B93901023
Address: Calle Santa Nunilón 2, 1º 1D, 03189 Playa Flamenca, Orihuela Costa, Alicante, Spain
Website: https://www.wo-realestate.com
Email address: info@wo-realestate.com

In this privacy policy, ‘we’, ‘us’ and ‘our’ refer to W&O Estates S.L.

2. Who does this privacy policy apply to?

This privacy policy applies, among others, to:

  • visitors to our website;

  • people who request information or contact us;

  • people interested in buying, selling, renting, letting or property management;

  • current and former clients;

  • people who complete a lead form on Facebook or Instagram;

  • business contacts, partners and suppliers.

3. What personal data do we process?

The data we process depends on your contact with us and the services you use.

Enquiries and communications

We may process the following data:

  • name, email address and telephone number;

  • town or city of residence, country of residence and preferred language;

  • property requirements, such as location, property type, budget and intended use;

  • answers you provide in our forms or advertising forms;

  • the content of messages you send us;

  • appointments and previous contact with us.

Services and property details

When you become a client, we may need additional data, such as:

  • address and billing details;

  • details of a property you wish to buy, sell, rent or let;

  • information about ownership, agreements and the parties involved;

  • correspondence and documents needed for your file;

  • identification details and information about the source of funds, where required by law.

Property details may constitute personal data where they can be linked to an owner, occupier or another person.

Website use and technical data

When you use our website, data may be processed such as:

  • IP address and technical request data;

  • browser and device details;

  • pages visited and the time of a visit;

  • the source of a visit;

  • interactions with links, videos and downloads;

  • search terms entered using our website’s search function;

  • cookie identifiers, advertising identifiers and consent choices.

The data processed by our measurement tools depends in part on your cookie preferences and how Google Consent Mode operates. You can read more about this in section 7.

Please do not include special category personal data, such as medical information, in general contact forms or messages.

4. Why do we process personal data and on what legal basis?

Responding to enquiries and arranging appointments

We use your data to answer questions, send property information, arrange viewings and contact you in response to your enquiry.

Where your enquiry is intended to lead to a contract with us, we process the data necessary to take steps at your request before entering into that contract.

For other business enquiries and correspondence, we may rely on our legitimate interest in handling communications appropriately.

Providing our services

We process the data needed to perform our contract with you, for example for property purchase assistance, sales agency services, lettings or property management.

We process data where necessary to comply with applicable tax, administrative or other legal obligations. These may include obligations relating to client identification and the prevention of money laundering.

Operating and securing our website

We process the technical data needed to operate and secure our website. Our legitimate interest is to provide a reliable website and to prevent and investigate misuse, faults and fraud.

Website analytics and advertising measurement

We use Google Analytics 4 and Google Ads to measure website use and conversions. We ask for your consent to set and access non-essential analytics and advertising cookies and to carry out the associated processing.

Newsletters and marketing communications

We ask for consent to send newsletters and marketing communications where required. For existing clients, we may rely on a statutory exception for our own similar services, provided the conditions for that exception are met.

You can unsubscribe at any time. Simply requesting information does not automatically subscribe you to a newsletter.

We may retain and use necessary data to evidence agreements, handle complaints and establish or defend legal claims. We rely on our legitimate interest for this purpose.

Where we rely on a legitimate interest, we balance that interest against your rights and privacy interests.

5. How do we receive your data?

We receive data directly from you when, for example, you:

  • complete a form on our website;

  • complete an advertising form on Facebook or Instagram;

  • contact us by email, telephone, WhatsApp or social media;

  • request information about a property;

  • request a viewing or an introductory meeting;

  • enter into a contract with us.

We may also receive data through property portals, partner estate agents or other parties involved in your enquiry or transaction.

Where we receive personal data from another party, we inform you, where required, of its source, the data received and how it is used.

6. Advertising and lead forms on Facebook and Instagram

We use Facebook and Instagram to promote our services and property listings.

When you complete and submit a lead form associated with one of our advertisements, we receive the data you provide through that form. This may include your name, email address, telephone number and answers to questions about your property interests.

We use this data to handle your enquiry and contact you using the contact details provided for that purpose. The processing is consistent with the purpose of the form and the legal bases set out in section 4.

An enquiry through Facebook or Instagram does not automatically give us consent to use your data for other, separate marketing purposes.

Meta also processes data about the use of Facebook and Instagram under its own terms and privacy policy. Further information is available at:

https://www.facebook.com/privacy/policy/

No Meta Pixel is active on our website.

7. Cookies, Google Analytics and Google Ads

Our website uses the basic version of Google Consent Mode. Google Analytics and Google Ads measurement tags are blocked until you have given consent for the relevant purpose.

Without that consent, these tags do not send measurement data to Google. Analytics and advertising cookies are only set and accessed after you have given consent.

Interactive maps and location searches

We ask for consent through our consent settings to load Mapbox maps and the associated location search function. We do not load these features without that consent. Further information about Mapbox’s processing of data is provided in section 8.

Changing your choice

Our cookie banner allows you to accept or reject non-essential cookies or set your preferences for each purpose. Consent to analytics does not automatically mean consent to advertising cookies.

You can change or withdraw your choice at any time through the cookie settings on our website. Once consent is withdrawn, the measurement tags for which you have withdrawn consent are blocked again.

Withdrawal does not affect the lawfulness of processing carried out on the basis of valid consent before its withdrawal. You can also delete existing cookies through your browser settings.

Further information about cookies

Our cookie policy provides further information about the cookies and similar technologies we use, their purposes and their lifetimes.

8. Hosting, data storage and other service providers

We use the following service providers for our website, communications and the management of enquiries and client relationships.

Supabase — database and storage

We use Supabase to store and manage enquiries and property details. Enquiries may contain your name, email address, telephone number, property requirements and the content of your enquiry.

Vercel — website hosting

We use Vercel to host our website and ensure its technical availability. This may involve processing technical data needed to handle website requests, investigate errors and secure the website. Vercel Analytics is disabled.

Microsoft 365 / Office 365 — email

We use Microsoft 365 for our email communications. This involves processing, among other things, email addresses, message content and any attachments.

Zoho — client relationship management

We use Zoho as our CRM system to manage contact details, enquiries, property requirements and contact history. This helps us follow up your enquiry and organise our services.

Resend — sending form messages

We use Resend to send messages generated by our website forms. This may involve processing your contact details and the content of your enquiry. Enquiries are stored in Supabase.

Cloudflare — DNS and protection against unwanted traffic

We use Cloudflare to manage DNS, which directs our domain name to the correct servers, and to counter unwanted or automated traffic.

For these services, Cloudflare may process technical data, such as IP addresses and information about network requests. The data processed depends on the security feature used. We use these services on the basis of our legitimate interest in keeping our website available and secure and preventing misuse.

Mapbox — interactive property maps and location searches

We use Mapbox to display properties on interactive maps and allow visitors to search for locations. Our location search function is not intended for searches for exact addresses.

When these features are loaded and used, data may be sent to Mapbox, such as the IP address, browser details, map requests and location search terms entered. Even without an exact address, this technical data may constitute personal data.

Further information about Mapbox’s processing is available in Mapbox’s privacy policy.

We only share data with these service providers where it is necessary for their work. Where they process personal data on our behalf, we put agreements in place covering its processing, security and confidentiality.

9. Who do we share personal data with?

We share data to the extent necessary for your enquiry, our services, a legal obligation or another purpose described in this policy for which there is a valid legal basis.

Depending on your circumstances, this may include:

  • staff and authorised persons handling your enquiry or file;

  • hosting, database, communications and other IT service providers;

  • Google for website analytics and advertising measurement;

  • partner estate agents and property portals;

  • sellers, landlords and property developers;

  • lawyers, notaries and gestorías;

  • banks, mortgage advisers and valuers;

  • administrative and accountancy service providers;

  • competent authorities where we are legally required to disclose data.

We limit the data shared to what is necessary for the relevant purpose.

Some parties act as processors on our behalf. Others, such as notaries, lawyers or banks, may act as independent controllers for their own activities. Their privacy policies may also apply.

10. Processing outside the European Economic Area

When we use international service providers, personal data may be processed outside the European Economic Area (EEA) or accessed from countries outside it.

We use European storage and processing regions where these have been configured for our services. Our Supabase database is located in the Frankfurt region, Germany (eu-central-1). We use a European project region for Vercel and the European environment for Zoho.

A European storage location does not mean that all processing takes place exclusively within the EEA. International providers may, for example, provide support from other countries or engage additional service providers there.

We contract directly with Supabase Pte. Ltd., based in Singapore, for Supabase. Resend is provided by Plus Five Five, Inc. Our contracting parties for Microsoft 365, Google Ads and Meta are Microsoft Ireland Operations Limited, Google Ireland Limited and Meta Platforms Ireland Limited respectively, based in Ireland.

Transfers outside the EEA require a valid transfer mechanism. This may be an applicable adequacy decision by the European Commission or the European Commission’s approved standard contractual clauses, supplemented by additional safeguards where necessary.

The safeguards for international transfers are set out in the applicable supplier terms and data processing agreements.

Where a transfer relies on the EU–U.S. Data Privacy Framework, the US recipient concerned must hold an active certification covering the processing. For transfers based on standard contractual clauses, supplementary safeguards are applied where necessary.

You can request information about the safeguards applicable to your data and, where applicable, obtain a copy by emailing info@wo-realestate.com.

11. How long do we retain data?

We retain personal data for no longer than necessary for the purpose for which we process it. The period depends on the type of data, our relationship with you and any legal obligations.

Enquiries and leads

As a general rule, we retain enquiries and lead data for a maximum of 24 months after the last substantive contact. This also applies to enquiries through Facebook and Instagram.

We delete data sooner where further retention is no longer necessary. A longer period may apply where a client relationship develops or retention is necessary because of a legal obligation or a specific legal dispute.

Client and transaction files

We retain necessary file information while providing our services and subsequently for the applicable statutory retention periods or for as long as needed to deal with obligations, complaints or legal claims.

Identification, administration and statutory checks

For data subject to tax, administrative or anti-money laundering obligations, we apply the relevant statutory retention periods. We delete the data once these periods have expired, unless there is another valid reason to retain it.

Google Analytics 4

The retention period for user and event data covered by GA4’s data retention setting is set to 14 months. The option to restart the retention period for the user identifier on new activity is disabled.

Expired data is deleted during the following monthly deletion cycle. This setting does not apply to standard aggregated reports, which may remain available for longer.

We do not export Analytics data to a separate database or BigQuery.

Technical logs, sending records and backups

Technical records and backups are maintained to operate, secure and restore our systems.

  • Vercel Pro: runtime logs are retained for one day by default.

  • Supabase Pro: daily database backups are retained for seven days. Data deleted from the active database may therefore remain temporarily in an earlier backup.

  • Resend Free: Resend retains the content of sent emails and the associated log data for 30 days.

These periods are separate from the retention periods for enquiries and client files. Messages and contact details stored in Microsoft 365, Supabase or Zoho are subject to the retention periods described for those purposes. For enquiries, we generally apply a maximum of 24 months after the last substantive contact.

12. How do we protect personal data?

We take technical and organisational measures appropriate to the nature of the data and the risks of processing.

These include restricting access to authorised persons, secure connections, careful management of systems and agreements with service providers.

If a personal data breach occurs, we assess its consequences and take appropriate measures. Where legally required, we notify the supervisory authority and the individuals concerned.

13. What rights do you have?

Depending on the processing and the legal conditions, you can ask us to:

  • provide access to your personal data;

  • rectify inaccurate data;

  • erase data;

  • restrict the use of data;

  • transfer data to which the right to data portability applies.

You may object to processing based on a legitimate interest. You may always object to the use of your personal data for direct marketing.

Where processing is based on consent, you may withdraw that consent at any time.

Send your request to info@wo-realestate.com.

We may request additional information to verify your identity. We will not ask for more than is necessary.

We normally respond within one month. If a request is complex or we receive a large number of requests, this period may be extended by up to two further months subject to the statutory conditions. We will inform you of this within the first month.

We may need to retain certain data because of a legal obligation or another applicable exception. If so, we will explain this.

14. Are you required to provide data?

You are not obliged to make an enquiry or give consent to non-essential cookies.

Certain data is necessary to respond to your enquiry or perform a contract. For example, we cannot respond to your enquiry without contact details.

Where identification or other data is legally required, we may be unable to provide the relevant service if you do not supply it. We will explain this if such a situation arises.

15. Automated decision-making

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

We may use technical tools to manage enquiries, analyse website use and measure conversions.

16. External websites and communication platforms

Our website may link to external websites and platforms. When you visit them, the provider concerned may process personal data itself.

This also applies when you contact us through WhatsApp, Facebook, Instagram or a property portal. Those providers’ privacy policies apply to their own processing. This privacy policy applies to the data we receive and use.

17. Making a complaint

If you have any questions or disagree with how we process your data, please contact us at info@wo-realestate.com.

You also have the right to lodge a complaint with a competent data protection authority. As we are based in Spain, you may contact, among others:

Agencia Española de Protección de Datos — AEPD
https://www.aepd.es

You may also lodge a complaint with the supervisory authority in the EU country where you habitually reside or work, or where the alleged infringement took place.

18. Changes to this privacy policy

We may amend this privacy policy when our services, systems or legal obligations change.

The current version is available on our website. The date at the top shows when the text was last updated. Where necessary, we will inform you separately of significant changes.