Privacy Policy of DPE Homes ES Design & Build, S.L.

The purpose of this policy is to provide you with information about how we use and process personal data, in compliance with the information obligations provided for in Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

Who is the data controller for your personal data?

We inform you that the data controller for your personal data is DPE Homes ES Design & Build, S.L., with registered office at Calle Diputación, No. 13, Ground Floor, C.P. 29780, Nerja (Málaga), Spain, fully registered with the Málaga Commercial Registry on 27 July 2026, Electronic Volume/Folio, Sheet MA-200158, Entry 1, with tax identification number B93816957, hereinafter the “Personal Data Controller”.

For matters relating to the protection of personal data, please contact us at the company’s registered office address or by email: info@dpehomes.es

Joint controllership of personal data

We inform you that, pursuant to Article 26 of the GDPR, DPE Homes ES Design & Build, S.L. acts as a joint controller of personal data together with the following affiliated companies:

The joint controllers have entered into a joint controllership agreement under which their respective responsibilities for compliance with GDPR obligations are transparently determined, particularly with regard to the exercise of data subject rights and information obligations. The joint controllers share common infrastructure, personnel and IT systems, as well as common business processes including request management, marketing, contracting, billing, reporting, audits, customer service, quality control, complaint management, warranty and claims management, and accounting.

Each joint controller may be involved in the processing of personal data of customers or prospective customers at different stages and to different degrees. Regardless of the content of the joint controllership agreement, the data subject may exercise their data protection rights against any of the joint controllers. The point of contact for exercising their rights is DPE Homes ES Design & Build, S.L., through the contact details indicated in this policy. You may request the essential aspects of the joint controllership agreement by contacting the controller through the same means.

What are the purposes and legal bases for processing personal data?

The specific purposes for processing personal data, together with the legal bases, are detailed below:

A. To take steps at your request prior to entering into a contract for services, in accordance with our business activities, we process the following personal data:

Full name, address, correspondence address, address of the planned works, email address, telephone number, information contained in public registers, IP address and other information included in the documentation we receive from prospective customers.

The legal basis for processing this data is:

Article 6(1)(a) of the GDPR, your consent to the processing of personal data for one or more specific purposes.
Article 6(1)(b) of the GDPR, which permits the processing of personal data where it is necessary for the performance of a contract or for taking steps prior to entering into a contract.
Article 6(1)(f) of the GDPR – legitimate interest of the data controller.

B. For the purpose of entering into and performing a contract, i.e. the provision of services, we process the following personal data:

Full name, address, correspondence address, email address, telephone number, tax identification number, information contained in public registers, bank account number, IP address and other information included in the documentation we receive from customers.

The legal basis for processing this data is Article 6(1)(b) of the GDPR, which permits the processing of personal data where it is necessary for the performance of a contract or for taking steps prior to entering into a contract with us.

C. To comply with our legal obligations, for example, issuing VAT invoices and making tax settlements, we process the following personal data:

Full name, company name, address, email address, information contained in public registers and bank account number.

The legal basis for processing this data is Article 6(1)(c) of the GDPR, which permits the processing of personal data where such processing is necessary for compliance with a legal obligation to which the controller is subject.

D. To process matters submitted directly to the Personal Data Controller, for example, handling warranty claims, we process the following personal data:

Full name, address, correspondence address, email address, telephone number, tax identification number and other information provided to us for this purpose.

The legal basis for processing this data is:

Article 6(1)(b) of the GDPR, which permits the processing of personal data where it is necessary for the performance of a contract to which the data subject is a party.

E. To provide you with information about activities related to the performance of our contract, we process the following personal data:

Full name, address, correspondence address, email address, telephone number, information contained in public registers, bank account number, IP address and other information contained in the documentation we receive from you.

The legal basis for processing this data is Article 6(1)(b) of the GDPR, which permits the processing of personal data where it is necessary for the performance of the contract.

F. To establish, defend and exercise legal claims, we process the following personal data:

Full name, address, correspondence address, work address, email address, telephone number, information contained in public registers, bank account number, IP address and other information contained in the documentation we receive from you.

The legal basis for processing this data is Article 6(1)(f) of the GDPR, which permits the processing of personal data where the controller pursues its legitimate interest in doing so (in this case, the controller’s interest is to retain personal data enabling it to establish, exercise or defend claims, including those of customers, contractors and third parties).

G. For the purpose of storing unanswered offers/requests, we process the following personal data:

Full name, company name, email address, telephone number or other data that you have provided to us.

You may decide to use our services some time after receiving an offer from us, and the legal basis for processing this data is Article 6(1)(b) of the GDPR, which permits the processing of personal data where it is necessary for the performance of a contract or for taking steps prior to entering into a contract, in conjunction with Article 6(1)(f) of the GDPR, which permits the processing of personal data where the controller pursues its legitimate interest in doing so (in this case, the controller’s interest is to allow you to use our services for a certain period without having to renew the offer).

H. For archiving and evidentiary purposes, we process the following personal data:

The legal basis for processing this data is:

Article 6(1)(f) of the GDPR, which permits the processing of personal data where the controller pursues its legitimate interest in doing so (in this case, the controller’s interest is to retain personal data to prove certain facts relating to the performance of the contract).
Article 6(1)(c) of the GDPR, which permits the processing of personal data where such processing is necessary for compliance with a legal obligation to which the controller is subject.

I. For the purpose of administering the website (automatic recording of the following data in the so-called server logs each time you use our website, we may process personal data such as:

IP address, server date and time, information about the web browser, information about the operating system.

The legal basis for processing this data is Article 6(1)(f) of the GDPR, which permits the processing of personal data where the controller pursues its legitimate interest in doing so. In this case, the controller’s interest is to be able to administer the website. You can find more information in our Cookie Policy.

J. For direct marketing purposes, we process the following data:

Full name, company name, email address, telephone number, correspondence address, data contained in public registers.

The legal basis for processing this data is:

Article 6(1)(a) of the GDPR, which permits the processing of personal data based on voluntary consent.

K. For marketing purposes, we process the following data:

Customer photographs, full name, data contained in public registers, for the purpose of publishing posts on social media platforms or sharing experiences about interacting with us.

The legal basis for processing this data is:

Article 6(1)(a) of the GDPR, which permits the processing of personal data based on voluntary consent.

L. For security and protection purposes, we process the following data:

Video images of data subjects, which are stored for a maximum period of one (1) month from the time they are recorded, unless they need to be retained to provide evidence of acts that threaten the integrity of persons, property or facilities, in which case they will be made available to the competent authority within a maximum period of seventy-two (72) hours. Areas under video surveillance are signposted by means of a visible information notice, in accordance with Article 22 of Organic Law 3/2018 (LOPDGDD).

The legal basis for processing this data is:

Article 6(1)(f) of the GDPR, which permits the processing of personal data where the controller pursues its legitimate interest in doing so (in this case, the controller’s legitimate interest is to ensure the security of persons, property and facilities).

How can you exercise your right to withdraw consent?

If the processing of personal data is based on your consent, you may withdraw your consent at any time, at your discretion.
If you wish to withdraw your consent to the processing of your personal data, send a letter directly to the Personal Data Controller or send an email to info@dpehomes.es.
If the processing of your personal data was based on consent, its withdrawal does not make the processing of your personal data up to that point unlawful. In other words, we have the right to process your personal data until you withdraw your consent, and its withdrawal does not affect the lawfulness of processing carried out up to the time of withdrawal.
Withdrawal of consent only affects personal data processed on the basis of the data subject’s consent.

Requirement to provide personal data

Providing any personal data is voluntary and depends on your decision. However, if you enter into a contract with us for the provision of our services, it is necessary to provide certain personal data. Refusal to provide data marked as mandatory may prevent the contract from being entered into or performed.
To receive a commercial offer, you must provide your email address and telephone number. Without this data, it will not be possible to send you the requested offer or contact you regarding the provision of our services.

Do we use automated decision-making and profiling?

We inform you that we do not make decisions based solely on automated processing of your personal data that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 of the GDPR.

To whom may we transfer your personal data?

In order to provide the requested services, your data may be disclosed to:
a) our employees and collaborators who need access to the data to fulfil our obligations or carry out activities on our behalf.
Like most companies, we also use the assistance of other entities in our operations, which often requires the transfer of personal data. Therefore, where necessary, your personal data may be disclosed to the following recipients:
a) entities providing marketing services.
b) entities operating our IT and ICT systems.
c) entities carrying out payment activities (banks, payment institutions).
d) entities carrying out credit activities (banks), leasing and factoring.
e) entities carrying out postal and courier activities.
f) entities providing us with consulting, audit, legal, tax, accounting, human resources and training services.
g) entities that are our subcontractors.

In justified cases, data may be shared with other data controllers where there is a legal basis for doing so (consent, contract or legitimate interest), for example, trusted partners providing services complementary to ours.
In addition, it may happen that, for example, on the basis of applicable law or a decision by a competent authority, we are required to share your personal data with other public or private entities, such as the Tax Administration or other state institutions. Therefore, it is extremely difficult for us to predict who might request personal data. However, we assure you that we carefully and thoroughly review each request for personal data in order to prevent the accidental disclosure of information to an unauthorized person.
If data recipients process your personal data independently and on their own behalf, for example, to offer their products and services, they will become independent data controllers and, in this respect, will assume their own responsibility for processing such data and will not be subject to the terms of our Policy.

Do we transfer your personal data to third countries?

We inform you that, as a general rule, your personal data are processed within the European Economic Area (EEA). However, because we use tools and services provided by third parties such as Alphabet (Google), Microsoft and Meta (Facebook), whose servers may be located outside the EEA, international transfers of personal data may occur. In such cases, these transfers are carried out under the appropriate safeguards provided for in Articles 44 to 49 of the GDPR, in particular:
a) European Commission adequacy decisions concerning certain countries or organizations (for example, the EU-U.S. Data Privacy Framework).
b) Standard contractual clauses approved by the European Commission, which guarantee a level of protection equivalent to that of the EEA.
You may request additional information about the safeguards applicable to international transfers of your personal data by contacting the controller through the contact details indicated in this policy.

How long may we store your personal data?

In accordance with applicable law, we process your personal data for the period necessary to achieve the stated purpose. After this period, your personal data will be deleted or irreversibly destroyed.
Regarding the individual periods for processing personal data, we inform you that we process personal data for the following periods:
a) Up to 5 years: with regard to personal data processed for the purpose of establishing, exercising or defending claims, in accordance with the general limitation period for personal actions provided for in Article 1964 of the Civil Code.
b) For the duration of the contract and, after its termination, up to 4 years: with regard to personal data relating to compliance with tax obligations, in accordance with Article 66 of the General Tax Law. With regard to data relating to warranties granted for building works, they will be retained for the periods provided for in the Spanish Building Regulations Act (1 year for finishing defects, 3 years for habitability defects and 10 years for structural defects).
c) 2 years: with regard to personal data collected in connection with sending an offer, where the contract was not immediately entered into.
d) Until consent is withdrawn, an effective objection is raised or the purpose of the processing is achieved: with regard to personal data processed on the basis of consent.
We calculate periods in years from the end of the year in which we began processing personal data in order to simplify the process of deleting or destroying personal data. Calculating the period separately for each event would involve significant organizational and technical difficulties, as well as considerable financial costs. Therefore, establishing a single date for deleting or destroying personal data enables us to manage this process more efficiently.
Right to be forgotten: Of course, if you exercise your right to be forgotten, these situations are assessed individually.

What rights do you have?

We inform you that you have the right to:
Right of access to your personal data: i.e. the right to obtain information about the purpose and method of processing your personal data and a copy of the data.
Right to rectification: i.e. the right to correct your data if it is incorrect, has changed or has become outdated.
Right to partial or total erasure of data (“right to be forgotten”): the data subject’s right to request that their personal data be erased without undue delay if one of the following reasons applies:
1. ○ they are no longer necessary for the purposes for which they were collected or processed.
1. ○ consent has been withdrawn and there is no other legal basis for the processing.
1. ○ the right to object has been exercised and there are no overriding legitimate grounds.
1. ○ the personal data have been processed unlawfully.
1. ○ the personal data must be erased to comply with a legal obligation.
1. ○ the personal data have been collected in connection with the offer of information society services.
Right to restriction of processing: The data subject may request restriction of processing in the following cases:
1. ○ the data subject disputes the accuracy of the data, for a period enabling the Company to verify its accuracy.
1. ○ the processing is unlawful and the person objects to the erasure of the personal data and requests restriction of their use instead.
1. ○ the Company no longer needs the personal data for the purposes of processing, but the data subject needs them for the establishment, exercise or defence of claims.
1. ○ the person has objected to the processing, pending verification of whether the Company’s legitimate grounds override those of the data subject.
Right to data portability: i.e. the right to obtain the personal data you have provided to us or to designate another controller to whom we must transfer them, where technically possible.
Right to object: the data subject’s right to object to the processing of personal data based on the controller’s legitimate interest (Article 6(1)(f) of the GDPR) on grounds relating to their particular situation. Where personal data are processed for direct marketing purposes, you have the right to object to the processing at any time, without having to provide any justification.
We respect your rights in accordance with data protection law and strive to facilitate their exercise to the greatest extent possible.
We emphasize that the above rights are not absolute and, therefore, in certain situations, we may legally refuse to grant them. However, if we refuse to comply with your request, we will do so only after careful consideration and only where it is necessary to refuse your request.
With regard to the right to object, we point out that you have the right to object at any time to the processing of your personal data based on the legitimate interest of the Personal Data Controller in relation to your particular situation. However, please note that, in accordance with the regulations, we may refuse to accept your objection if we demonstrate that:
a) there are compelling legitimate grounds for the processing that override your interests, rights and freedoms, or.
b) there are grounds for the establishment, exercise or defence of a right in legal proceedings.
In addition, you may object at any time to the processing of your personal data for marketing purposes, without having to provide any reason.
The controller has not appointed a Data Protection Officer, as it is not required to do so under Article 37 of the GDPR and Articles 34 to 37 of the LOPDGDD. However, for any matter relating to the protection of your personal data, you may contact the controller using the contact details indicated in this policy. When you exercise your right to object to processing for marketing purposes, we will cease processing your data for that purpose without delay.
You may exercise your rights by sending a letter directly to the Personal Data Controller at its registered office address or by sending an email to info@dpehomes.es with the subject line “Data Protection”.

You have the right to lodge a complaint with the data protection authority

If you consider that your personal data are processed in breach of applicable law, you may lodge a complaint with:

The Spanish Data Protection Agency (AEPD), regarding unlawful processing of personal data, by sending a notification to: C/ Jorge Juan, 6, 28001 Madrid, or through its electronic office: https://sedeagpd.gob.es.

Final provisions

To the extent not covered by this Privacy Policy, the provisions on the protection of personal data shall apply, including:
a) The General Data Protection Regulation (Regulation (EU) 2016/679) of the European Parliament and of the Council of 27 April 2016.
b) Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
You will be notified of any changes to this Privacy Policy by email or by means of a notice on our website: https://dpehomes.es/
This Privacy Policy is effective as of September 1^st 2026.