Privacy Policy

Last updated: 31 October 2026

1. Who we are

The controller of your personal data is DOMUS VENARI GROUP S.L., Centro Comercial Andasol, Urb. Andasol, Ctra. N340 km 189, 29604 Marbella (Málaga), Spain. Email: privacy@domusvenari.com.

2. What we collect, why, and on what basis

When you send an enquiry or request (any form on the site): your name, email, phone, your message, the property or page concerned, your language, and how you reached the site (for example an ad or a campaign link). We use it to answer you and help you buy, sell or rent. Legal basis: your request (GDPR art. 6.1.b) and our legitimate interest in following up a property enquiry (art. 6.1.f).
When you create a Domus Venari account with email and password: your name (optional), email, a securely hashed password, your language and the date you accepted this policy, to give you the account you asked for. Legal basis: contract (art. 6.1.b).
When you sign in with Google: your name, email address and Google account identifier, as Google shares them. We do not receive your Google password or anything else from your Google account. Legal basis: contract (art. 6.1.b).
When you create an account or sign in with a code we email you: your email address, your language and the date you accepted this policy. No password is stored. Legal basis: contract (art. 6.1.b).
When you save properties to your account: the properties you saved and when, so that you can see them on any device, and so that our advisors can see which properties interest you and contact you about them. We also email you when a property you saved drops in price, or is sold or withdrawn, at most once a day. These alerts are part of the service you ask for by saving, so they are sent even if you have not opted in to our marketing emails; you can stop them from any alert, or in My account. Legal basis: contract (art. 6.1.b), and our legitimate interest (art. 6.1.f) for our advisors’ follow-up.
When you opt in to emails (an unticked box): that choice and its date, to send you new properties and news. Legal basis: your consent (art. 6.1.a), which you can withdraw at any time.
When you add details about yourself in My account (all optional): your phone number, the country and city you live in, your nationality and occupation, how and when you prefer to be contacted, who is buying with you, whether you have bought property in Spain before, and any note you write. We use them so that an advisor can contact you the way you prefer and help with your search, and they are recorded on your client record in our customer system. You can change or clear them at any time on the My account page. Legal basis: your consent (art. 6.1.a).
When you answer the home search questions: your budget, the areas and type of home you want, bedrooms, timing, purpose, financing and similar preferences. We use them to choose homes for you and, if you opt in, to email you new listings that match. Legal basis: contract (art. 6.1.b), and your consent (art. 6.1.a) for the emails.
When you use the site: technical data such as your IP address, browser, pages visited and security logs, to run the site securely and stop abuse. Legal basis: legitimate interest (art. 6.1.f).
When you accept analytics or advertising cookies in our banner: as described in the cookie section below, to measure and improve the site and our advertising. Legal basis: your consent (art. 6.1.a).

When you create an account, it is recorded as a client in our customer system, and our team is notified so that an advisor can help you. If you have contacted us before with the same email address, the account is linked to that existing record.

3. The AI property search

Our AI search lets you describe the home you are looking for in your own words: on our homepage, above our property listings and in your account. An AI model reads your request, ranks the properties we list and writes a short reason why each one fits.

Using it is your agreement. By sending a request through the AI search, you agree to it being processed as this section describes; we do not ask separately. If you would rather not, use our property filters, which send nothing to the AI.

What we keep. If you are not signed in, we first ask for your name and email address (your phone number is optional), so that an advisor can send you matches and arrange viewings. We then keep your searches: what you typed, the filters and wishes the AI understood from it, the properties it showed you, your answers to our follow-up questions, and any viewing you ask for. If you are signed in, we keep the same with your account, and note when you first used the AI search.

Who reads it. Your name, email address and phone number (if you give it), your first request, the buyer profile drawn from your searches and answers, the properties you were shown and any viewing you ask for go to our customer database, where our advisors use them to contact you about properties and viewings. Like every enquiry on our website, your details and your first request also reach our older enquiry system. The full record of your searches stays in our website’s database, read only by Domus Venari’s administrators when needed to look into a problem or to answer a request from you about your data. We do not sell or rent any of it to anyone.

Who processes it for us. OpenAI’s AI models rank the properties, write the reasons and turn your request into a numerical form (an “embedding”), so that we can find properties that match its meaning. We send OpenAI the text of your request and the details of the properties being ranked, never your name, phone number or email address. OpenAI processes it only to give us those answers and does not use it to train its models. Our website’s database, which holds your searches, is hosted in the European Union (Frankfurt).

Checks at the start. To keep automated programs out of the search, the form is checked by Cloudflare Turnstile, which looks at your browser when the page loads; Cloudflare tells us only whether the check passed. To limit how many enquiries one connection can send, we keep a scrambled code made from your internet address (a keyed hash) for an hour at most, never the address itself. Our hosting provider also tells us the country your connection comes from, which goes to our older enquiry system with your enquiry.

Why. We use your searches only to match you with properties for sale and to arrange viewings, and for the follow-up an advisor gives you about them.

How long. We keep your searches for as long as we keep your enquiry or your account, and delete them together with it.

Your rights. You can ask to see your searches and the profile we hold, to have them corrected or deleted, to limit or object to their use, or to receive a copy. To do so, write to privacy@domusvenari.com, or to DOMUS VENARI GROUP S.L., Centro Comercial Andasol, Urb. Andasol – Ctra. N340 KM189, 29604 Marbella. You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Please do not share sensitive details in the search, such as your health, finances beyond your budget, or identity documents. An advisor will ask for what is needed when the time comes.

4. Who receives your data

We do not sell your data. We use these providers, each bound by a data-processing agreement:

Supabase (hosting of the database and the accounts system), servers in Frankfurt, Germany.
Vercel (hosting of the website).
Kantos (our customer relationship system, where enquiries and accounts are recorded) and Twilio SendGrid (sending our emails, including account confirmation and password reset emails). Some of these process data in the United States.
Google (Sign in with Google, if you choose it; and, only with your consent, Google Analytics and Google Ads).
Microsoft (Clarity, on our advertising landing pages only: how visitors scroll and tap there, with anything typed into a form masked; its cookies only with your consent).
Cloudflare (Turnstile, which protects our forms from automated abuse).
The DVG CRM, our earlier customer system, which also receives website enquiries.

Transfers outside the European Economic Area rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified, or on the Commission’s standard contractual clauses.

5. How long we keep it

Account: until you delete it. An email sign-up that is never confirmed is deleted after 7 days.
Saved properties: until you remove them or delete your account.
Your client record and enquiries: for as long as we have a commercial relationship, and then for as long as the law requires us to keep records (for example, for anti-money-laundering obligations, up to 10 years after a transaction), or until you ask us to erase it where no such obligation applies.
Marketing consent: until you withdraw it.
Security logs: up to 90 days.

6. Deleting your account

You can delete your account at any time on the My account page. This deletes the account and your saved properties at once. Your client record in our customer system is kept, marked as no longer having an account and without marketing consent, so that we can keep records of past enquiries. To have that record erased too, write to privacy@domusvenari.com.

7. Your rights

You can ask us for access to, rectification or erasure of your data, restriction of or objection to its processing, and a copy in a portable format; and you can withdraw any consent at any time, without affecting what was done before. Write to privacy@domusvenari.com. You may also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es).

8. Cookies and similar technologies

Strictly necessary (no consent needed):

sb-…-auth-token: keeps you signed in to your account (30 days).
dv_account: tells the page that you may be signed in (30 days).
dv_gnonce: protects Google sign-in from replay (10 minutes).
koble-favorites: properties saved before signing in, moved to your account when you sign in (1 year).
cc_cookie: remembers your cookie choices (6 months).
Cloudflare Turnstile: protects forms from automated abuse (session).
g_state (Google): remembers whether you closed the Google sign-in prompt, only if you sign in with Google or the prompt is shown (up to 6 months).

The Google sign-in prompt is shown only after you have made a choice in our cookie banner, and only on domusvenari.com.

Analytics and advertising (only with your consent, through the banner): Google Analytics and Google Ads cookies, as listed in the banner’s preferences. You can change your choice at any time on the Privacy Settings page, linked at the foot of every page.

9. Security

Passwords are stored only as a secure hash. Sessions are kept in cookies that page scripts cannot read. Access to our systems is restricted to the staff who need it.

10. Changes

We will post any change to this policy here with its date. If a change significantly affects how we use the data of account holders, we will tell them by email.