Privacy Policy

Thank you for visiting our website. The protection of your personal data is important to us. This Privacy Policy explains how we process personal data in accordance with the General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and other applicable Spanish data protection regulations.

Last updated: 21 July 2026

1. Controller

The controller responsible for processing personal data is:

Patrick Wagner
Business name: Mercavion – Costa Blanca Service
Avenida Alicante 15
03193 San Miguel de Salinas
Spain

Correspondence address in Germany:
Patrick Wagner Mercavion – Costa Blanca Service c/o Regus Hammfelddamm 4a 41460 Neuss Germany

This address is used solely for correspondence and service of documents. It is not a German branch, permanent establishment or tax residence. The business and tax residence is in Spain.

Email: info@mercavion.com

Tax information:
Spanish tax number (NIF/NIE): Z2730275L
VAT identification number: ESZ2730275L

Legal Notice: https://costablanca.mercavion.com/en/legal-notice/

Data protection enquiries may be sent by email or by post to one of the addresses shown above.

No data protection officer has been appointed because the legal requirements for a mandatory appointment are currently not met.

2. General information and legal bases

Personal data means any information relating to an identified or identifiable natural person. This may include a name, email address, telephone number, postal address, location, information about a property, photographs, documents and an IP address.

We process personal data only where it is required for a specified purpose and where a valid legal basis exists. Depending on the processing activity, the following legal bases may apply:

Article 6(1)(a) GDPR – Consent: where you have expressly agreed to the processing or disclosure of your data.
Article 6(1)(b) GDPR – Contract and pre-contractual measures: to process your enquiry, obtain prices, prepare a quotation, arrange appointments and perform an order.
Article 6(1)(c) GDPR – Legal obligation: where we are required by law to process or retain data.
Article 6(1)(f) GDPR – Legitimate interests: to provide a secure website, process business communications, prevent misuse and organise our business operations.

We do not use solely automated decision-making within the meaning of Article 22 GDPR. We also do not use profiling to automatically assess personal characteristics.

3. Technical security measures

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and unauthorised disclosure.

These measures include encrypted transmission using HTTPS/TLS, access restrictions, password-protected systems, regular updates, data backups and the careful selection of service providers.

Please note that data transmission over the internet can never be completely protected against every possible form of access.

4. Hosting and email

Our website is hosted by:

ALL-INKL.COM – Neue Medien Münnich
Owner: René Münnich
Hauptstraße 68
02742 Friedersdorf
Germany

The hosting provider supplies storage space, databases, technical infrastructure, security functions, email services and other services required to operate the website.

If you send us an email, your message and the information contained in it are processed through the mail servers used by us. No external newsletter or email marketing service is currently integrated.

The hosting provider processes data generated through operation of the website on our behalf. Where required, a data processing agreement pursuant to Article 28 GDPR is in place.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and technically functional provision of the website and our business email communication.

5. Cloudflare

We may use services provided by the following company to protect, accelerate and reliably deliver this website:

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

Cloudflare provides security, network and content delivery services. These services may be used to defend against attacks and abusive access, prevent overload and deliver website content more quickly.

The following information may be processed when you access the website:

IP address of the accessing device
date and time of access
page or file requested
referrer URL
browser, operating system and device information
HTTP request and response data
information concerning failed, suspicious or security-relevant access attempts

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in protecting the website against attacks and providing a secure and stable online service.

Data may also be processed outside the European Union or the European Economic Area. According to Cloudflare, relevant data transfers are based in particular on the EU-US Data Privacy Framework and, where necessary, the European Commission’s Standard Contractual Clauses.

Cloudflare may use technically necessary cookies or similar identifiers where this is required for security checks or protection against abusive access.

Further information is available at:
https://www.cloudflare.com/privacypolicy/

6. Server log files

When this website is accessed, technical information is automatically processed in server and security logs. This information may include:

IP address
date and time of access
page or file requested
amount of data transferred
referrer URL
browser, operating system and device settings
access status and error messages
information regarding possible attacks or abusive access

The data is processed to deliver the website, maintain security, analyse errors and prevent unlawful access. The legal basis is Article 6(1)(f) GDPR.

Log data is deleted or anonymised once it is no longer required for these purposes. Longer retention may be necessary where a security incident is being investigated or a statutory retention obligation applies.

7. Contact and processing of enquiries

If you contact us by email or through another communication channel, we process the information you provide in order to deal with your enquiry.

Depending on your enquiry, the following data may be processed:

name and contact details
email address and telephone number
location, address or position of a property
information about a house, apartment, plot of land or holiday property
information about the requested cleaning, repair or other service
photographs of properties, rooms, damage, gardens, pools or proposed work
requested date or period for carrying out the work
information concerning relocation to Spain, NIE applications, official procedures or company formation
the content of your message and other information voluntarily provided

We use this information to assess your enquiry, ask follow-up questions, obtain prices, prepare an offer, arrange an appointment and prepare or carry out a possible order.

The legal basis is Article 6(1)(b) GDPR where your enquiry relates to the preparation or performance of a contract. General business enquiries are processed on the basis of Article 6(1)(f) GDPR.

Where you have expressly consented, the legal basis is Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

Please send copies of identity documents, tax documents, bank details or other particularly confidential documents only where we have expressly requested them for a specific matter and have provided a suitable transmission method.

Disclosure to contractors and professional partners

To process and perform an enquiry, we may engage independent contractors, service providers and professional partners or put you in contact with them.

Depending on your enquiry, these may include:

cleaning and laundry services
tradespeople and repair companies
garden, palm tree and pool service providers
keyholding, property care and rental services
taxi, transfer and transport providers
estate agents and property management companies
lawyers, tax advisers and gestorías
translators and other specialists

Data is disclosed only where this is required to assess your enquiry, obtain a price, prepare an offer or carry out the requested service, or where you have consented to the disclosure.

The legal basis is Article 6(1)(b) GDPR where disclosure is required for pre-contractual measures or contract performance. Where express consent is required, disclosure is based on Article 6(1)(a) GDPR.

Independent contractors and professional partners may process the information provided to them under their own responsibility under data protection law.

We do not sell personal data or disclose it to address brokers or third parties for unrelated advertising purposes.

Retention of enquiries

We retain enquiries for as long as required to process them, prepare quotations, perform an order and answer possible follow-up questions.

Enquiries that do not result in a contractual relationship are generally deleted no later than 24 months after processing has been completed, unless statutory retention obligations or the assertion or defence of legal claims require longer storage.

Business and tax documents are retained in accordance with the applicable statutory retention periods.

8. Cookies and consent management

This website may use technically necessary cookies and similar technologies. These are required to provide the website securely, store privacy settings and prevent abusive access.

Cookies or similar technologies that are not technically necessary are used only after you have given your consent. Their use is governed in particular by Article 22(2) of the Spanish Law 34/2002 on Information Society Services and Electronic Commerce and Article 6(1)(a) GDPR.

We use Real Cookie Banner to manage and document privacy and cookie settings. The provider is:

devowl.io GmbH
Tannet 12
94539 Grafling
Germany

Real Cookie Banner stores and documents which settings and consents have been granted, refused or withdrawn. A pseudonymous identifier may be created and linked to the settings applicable at the time of your decision.

Real Cookie Banner is integrated into our WordPress installation. Consent records and settings are generally stored in the database of our website.

The processing is carried out to fulfil legal documentation obligations pursuant to Article 6(1)(c) GDPR and on the basis of our legitimate interest in proper consent management pursuant to Article 6(1)(f) GDPR.

Details of the cookies, services, retention periods and legal bases used can be accessed through the cookie banner or the privacy settings link.

Consent may be withdrawn at any time with effect for the future.

9. Analytics, advertising and social media services

We currently do not use external analytics or advertising tracking services such as Google Analytics, Google Ads Conversion Tracking or Meta Pixel on this website.

Rank Math SEO is currently not connected to Google Analytics and does not add an analytics tracking code to the website.

We also do not currently use social media plugins that automatically transfer personal data to social networks when the website is accessed.

If analytics, advertising or social media services are used in the future, this Privacy Policy and the consent management settings will be updated accordingly. Where required, such services will only be activated after consent has been given.

10. Recipients and international data transfers

Where necessary for the relevant purpose, personal data may be disclosed to the following recipients or categories of recipients:

hosting, email and IT service providers
security and network service providers
contractors and service providers carrying out the requested work
property, management and rental partners
lawyers, tax advisers, gestorías and translators
public authorities where a legal obligation exists or where you have requested a service involving the relevant authority

When Cloudflare is used, personal data may be processed outside the European Union or European Economic Area, in particular in the United States.

International data transfers take place only in accordance with Articles 44 et seq. GDPR and on the basis of an adequacy decision, valid certification under the EU-US Data Privacy Framework, suitable Standard Contractual Clauses or another legally recognised safeguard.

11. Your data protection rights

Subject to the applicable legal requirements, you have the following rights:

right of access under Article 15 GDPR
right to rectification under Article 16 GDPR
right to erasure under Article 17 GDPR
right to restriction of processing under Article 18 GDPR
right to data portability under Article 20 GDPR
right to object under Article 21 GDPR
right to withdraw consent under Article 7(3) GDPR

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Right to object: Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.

To exercise your rights, please contact:

info@mercavion.com

Right to complain to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. As the controller’s business and tax residence is in Spain, you may in particular contact:

Agencia Española de Protección de Datos (AEPD)
Calle Jorge Juan 6
28001 Madrid
Spain
https://www.aepd.es/

You may also contact a supervisory authority in the country of your habitual residence, your workplace or the location of an alleged data protection infringement.

12. Changes to this Privacy Policy

We may update this Privacy Policy if legal requirements, services used or our data processing activities change. The current version is available on this website.