Skip to content
Rusch & Partner
Legal

Privacy policy

Last revised:

How we process your data when you visit our website, enquire about a property or contact us.

Contents

The controller is Rusch & Partner S.L., Carretera del Puerto 118, Local 5, 07157 Puerto de Andratx, Illes Balears, Spain. Contact us at info@rusch-partner.com or +34 626 81 55 40. These contact details also apply to privacy requests.

This notice covers our property website and its language versions, and related enquiries. The applicable framework is the EU General Data Protection Regulation (GDPR), Spain’s Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) and, for electronic services and storage on devices, Ley 34/2002 (LSSI).

When you request pages or images, technical connection data are processed, including your IP address, request time, requested resources, browser information and technical status messages. Hosting, image delivery, data storage and error diagnosis use the configured cloud infrastructure and its providers. The purposes are content delivery, reliable operation and preventing abuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, functioning website.

To repair broken links, the website aggregates error-page paths, language, counts and timestamps, and where available the referring domain and path. Our own redirect overview does not store URL query parameters or IP addresses. Hosting providers’ technical logs are separate from this overview.

When you contact us by form, email or telephone, we process your name, email address, optional telephone number, message and, where relevant, the property reference, location and link. Forms also transmit your selected language, the originating page and the time of your confirmation of the privacy notice.

We first save form enquiries in our enquiry management system, then pass them to our property CRM, onOffice. If transmission fails, the enquiry remains available for later processing. Communications include an acknowledgement to your email address and an internal office notification. Recipient addresses and message contents are passed to the email delivery service for this purpose.

Enquiries about our property services are processed for steps prior to a contract or contractual performance under Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f), based on our legitimate interest in responding. Confirming the privacy notice in a form is not consent to advertising. Where processing actually relies on your consent, Article 6(1)(a) applies.

Your name, email address and message are required to submit a form; without them the form cannot be sent. Your telephone number is optional. Please do not send health information, identity documents, banking details or other particularly sensitive information through the general form. An enquiry does not subscribe you to a newsletter.

We use technically necessary storage and, only with your consent, services for functionality, analytics and advertising. You make your choice in the cookie banner on your first visit. You can change or withdraw it at any time via “Cookie settings” in the footer of every page; withdrawal takes effect for the future.

Consent management: To request and document your consent we use CookieYes (CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom). Your choice, the time, the banner version and a random consent ID are stored in the cookie “cookieyes-consent” (duration 12 months). As proof of consent under Art. 7(1) GDPR, CookieYes logs this information together with a truncated IP address. The legal basis is Art. 6(1)(c) GDPR; the storage is technically necessary under Art. 22.2 LSSI. An EU adequacy decision exists for the United Kingdom.

Google Tag Manager: To manage the services we use, we use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The Tag Manager itself does not set cookies or analyse usage data; for technical reasons your IP address is transmitted to Google when it loads. It only loads analytics and advertising services after you have given consent. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a clear and data-minimising management of the services.

Google Consent Mode: We use Google’s consent mode in its strict (basic) variant. Without your consent, Google Analytics and Google Ads tags are not loaded and no cookieless measurement data is sent to Google.

Categories: Necessary (always active), Functional, Analytics, Advertising. We only use non-necessary categories with your consent (Art. 6(1)(a) GDPR, Art. 22.2 LSSI). An up-to-date list of all cookies with provider, purpose and duration is shown below and in our cookie policy.

Other necessary storage:

  • Administration session data: Only when using the protected administration area, the sign-in service stores data to maintain and renew your session. There is no public customer account.

With your consent (category “Analytics”) we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This tells us how visitors use our website: pages viewed and language version, time spent, approximate location (country/region), device and browser, property views (reference number, property type, location, price), clicks on phone, email and WhatsApp, and successfully submitted enquiries (without your name, email address or message). Google Analytics does not store IP addresses for users in the EU. The cookies “_ga” and “ga” are used with a duration of up to 2 years. Data is deleted in Google Analytics after 14 months. Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent under Art. 6(1)(a) GDPR and Art. 22.2 LSSI, which you can withdraw at any time via “Cookie settings”.

With your consent (category “Advertising”) we use Google Ads provided by Google Ireland Limited. Conversion tracking: if you reach our website via one of our ads, we record whether you then send an enquiry or contact us by phone, email or WhatsApp. This lets us assess how well our ads perform. Remarketing: visitors to our website may be added to audiences so that we can later show them ads for our properties in Google services and on partner websites. Enhanced conversions: when you submit an enquiry form, your email address and, if provided, your phone number are irreversibly encrypted (hashed) in your browser using SHA-256 and transmitted to Google. Google matches these values with signed-in Google accounts to attribute the enquiry to an ad click and does not use them for any other purpose. In particular, the cookies “_gcl_au” and “_gcl_aw” (up to 90 days) and cookies on Google domains such as “IDE” (up to 13 months) are used. Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent under Art. 6(1)(a) GDPR and Art. 22.2 LSSI, which you can withdraw at any time via “Cookie settings”. Information on data processing by Google: policies.google.com/privacy and business.safety.google/privacy

Cormorant Garamond and Montserrat fonts are hosted locally on our own web server. No connection to Google or any other font provider is made when a page loads, and no data is transmitted to third parties for this purpose.

Editorial images are predominantly bundled locally. Property images are delivered from our own image storage. Where a secured original is not yet available, the property provider’s original image address may be used. The image service receives technical request data, including your IP address. The purpose and legal basis are delivery of requested content under Article 6(1)(f) GDPR.

WhatsApp, Instagram, Facebook and LinkedIn are external links, not automatically loaded social media plugins. A WhatsApp link may contain a prepared message with the property name, location, reference and link. Data reach the platform when you open the service; opening the link does not automatically send a message. Processing on those platforms is governed by their own privacy notices.

When you message us through WhatsApp or a social platform, we process your message and visible contact details to respond under Article 6(1)(b) or (f) GDPR, depending on your request. We do not recommend the general messenger channel for confidential documents. The linked ethics channel also leads to an external service with its own privacy notice.

The administration area is available only to invited staff or appointed administrators. It processes email addresses, account identifiers, sign-in and security data, and administrative notification preferences. Password sign-in, two-factor authentication and server-side role checks protect access. The purposes are website administration and securing authorised access, under Article 6(1)(f) GDPR. This is not a customer login.

For the stated purposes, authorised staff and technical providers for hosting, databases, image storage, authentication and email delivery receive the necessary data. The website uses Lovable Cloud and connected infrastructure for these services; property enquiries are passed to onOffice. For consent management, tag management, web analytics and advertising, CookieYes Limited (United Kingdom) and Google Ireland Limited (Ireland), with Google LLC (USA) as sub-processor or independent controller, are involved. Where legally required or necessary for a transaction you request, recipients may also include authorities and relevant professional participants. Processors must be engaged under Article 28 GDPR.

Technical providers and external platforms may process data outside the European Economic Area. Articles 44 to 49 GDPR additionally apply to these transfers. Applicable mechanisms include a relevant adequacy decision or suitable safeguards, such as EU standard contractual clauses with the necessary assessment and supplementary protections. The EU-US Data Privacy Framework is relevant only for currently participating US recipients within the scope of the applicable decision, not for every US provider. You can request information from us about recipients and transfer safeguards used for your data.

General enquiries are retained according to the time needed to handle them. After completion, further retention is permissible only where needed for an ongoing business relationship, a legal duty or establishing, exercising or defending legal claims. The website currently has no automatic enquiry-deletion routine; deletion or restriction must be carried out by the responsible administration. Technical-log retention depends on fault investigation, security needs and provider storage rules; we do not promise universal deletion after seven days.

  • Commercial records: Article 30 Código de Comercio generally requires the covered books, correspondence and supporting documents to be kept for six years from the last accounting entry.
  • Tax records: Article 66 Ley 58/2003, General Tributaria, generally sets four-year limitation periods for the tax rights it lists. Starting dates, interruptions and specific evidence requirements may affect the necessary retention.
  • Anti-money laundering: Where our activity and the particular transaction fall under Ley 10/2010, due-diligence documents generally fall within the ten-year retention regime in Article 25. After five years, the specific access restrictions in that article apply.

These statutory periods apply to the relevant documents, not indiscriminately to every website enquiry. Where required, data are blocked under Article 32 LOPDGDD rather than used further; they must be deleted when the grounds for retention cease. Local browser-storage duration is described in the cookies section.

Your rights and the Spanish supervisory authority

Subject to the legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection (Article 21). You may object to processing based on legitimate interests for reasons relating to your particular situation, and to direct marketing at any time. You may withdraw consent prospectively without affecting the lawfulness of processing before withdrawal.

Send your request to info@rusch-partner.com or the postal address above. Where we have reasonable doubts, we may request information necessary to verify your identity. Under Article 12 GDPR, requests are generally answered within one month. Any legally permitted extension of up to two further months will be explained within the first month.

Under Article 77 GDPR, you may complain to the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid: AEPD and electronic office. You may also contact the supervisory authority of your habitual residence, workplace or the location of the alleged infringement.

The website uses encrypted connections. Administrative access is role-based and protected by two-factor authentication. Simple form checks help prevent automated spam. We do not make solely automated decisions producing legal or similarly significant effects within Article 22 GDPR; property filters and suggestions are not such decisions.

This notice was revised on 29 October 2026. We update it when services or processing change; any required new consent must be obtained separately. Visiting the website is not blanket consent to data processing.

Official sources: GDPR, LOPDGDD, LSSI, AEPD cookie guide, Ley General Tributaria and Ley 10/2010.

WhatsApp