Privacy Policy

Controller

The controller is Dylan Sattari Colas, self-employed, trading as Dylan Sattari Real Estate.

This policy applies to enquiries sent through the website forms. Only Dylan Sattari handles those enquiries. For any privacy matter or to exercise your rights, write to dylan.sattari@colaborador.huspy.io.

What data we process

Depending on the form: name (required), surname, email (required), telephone, language, type of request, property of interest, area, budget, preferences, preferred date and any message or property details you provide voluntarily. Fields marked with an asterisk are required: without them we cannot handle your request; the rest are optional. If you provide another person's data, make sure you are entitled to do so. The website is not directed at minors.

Purposes and legal basis

• Professional valuation to sell: responding to and following up on your request. Basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Purchase search: responding to and following up on your personalised search. Basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Viewing of a property for sale or rent: arranging and following up on the viewing you request. Basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Rental search and offer of a property for rent: responding to and following up on your request. Basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Financial guidance: responding to your request, with no automatic referral to any third party. Basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• General enquiry: responding to and following up on your enquiry. Basis: legitimate interest in handling enquiries sent voluntarily (Art. 6(1)(f) GDPR).

We also temporarily use minimal technical data (an irreversible fingerprint of the IP address and, for private sign-in, the IP address itself) to limit abusive submissions and sign-in attempts, based on our legitimate interest in the security of the site (Art. 6(1)(f) GDPR). We may retain data where a legal obligation requires it (Art. 6(1)(c) GDPR). The privacy checkbox on the form confirms that you have read this information; it is not consent for other purposes. We send no newsletters or unsolicited marketing, build no profiles and take no solely automated decisions with legal effects on you. If we ever proposed a purpose that requires your consent, we would ask for it separately and freely.

Recipients and transfers

We do not automatically disclose your data to Huspy, agencies or other collaborators; we would only do so if you asked us to or specifically consented before sharing, or if the law required it. To provide the service we use providers acting as processors: Neon (database, hosted in the European Union, Frankfurt) and Railway (application hosting). Both belong to companies headquartered in the United States. Railway processes data mainly in the United States, and access from outside the European Economic Area to data hosted by Neon may occur for support tasks; these transfers rely on the safeguards the GDPR provides (standard contractual clauses or an adequacy decision). Technical logs of the hosting platform may be stored outside the European Union. To notify the data controller that a request has arrived we use Resend (email delivery), which acts as a processor: that notice only says that there is a new request and its type, and does not include your personal data or the content of your message. Resend belongs to a company headquartered in the United States and keeps the technical logs and metadata of the emails in that country, even though the email is sent from a server in the European Union; that transfer relies on the safeguards the GDPR provides (standard contractual clauses). The external automatic valuation tool (Lystos) is not one of our processors: it is explained in the next section.

Automatic valuation (Lystos tool)

The “Automatic valuation” page offers a link to a tool by Lystos, an independent third-party service. It opens in a new window, on Lystos' site: this website does not embed it and does not load anything from Lystos, Google or Cloudinary. The controller of what you enter in the tool (for example, the address of the home) is Lystos, not Dylan Sattari: we do not receive it, we do not store it and it does not go into our CRM, and to exercise your rights over that data you must contact Lystos.

On Lystos' site, your browser connects to its servers and to those of the services the tool uses: Google (Tag Manager, Analytics/Ads and Google Maps) and Cloudinary (file uploads). These services may process your IP address, usage data and the address you search for, under their own privacy policies (Google, Cloudinary), and may transfer data outside the European Economic Area. Neither Lystos, nor Google, nor Cloudinary are processors of Dylan Sattari: they process data under their own responsibility.

On 4 November 2026 we checked that, when it loads, the tool stores in your browser the _gcl_au cookie (up to 90 days; it belongs to Google Ads) and the sessionId and _gcl_ls entries in local storage. Those cookies and data are generated on Lystos' site, not on this one. You can delete them at any time from your browser settings and stop using the tool.

How long we keep it

Active enquiries are kept while they are being handled and followed up; they are considered closed when marked lost, discarded or won. Enquiries closed as lost or discarded without a transaction are kept for 24 calendar months from closure; if reopened, that period stops and a later closure starts a new one. For the record of a won transaction, five years from the formalisation of the transaction; this does not determine the retention of contractual or tax documents, which follow the applicable rules. A legal obligation may suspend deletion, with a recorded reason. The database provider keeps a short-term recovery history (currently a few hours) and we do not contract additional backups; those copies follow the provider's own retention. Technical logs of the hosting platform follow that provider's retention.

Your rights and complaints

You can request access, rectification, erasure, objection, restriction of processing or portability by writing to dylan.sattari@colaborador.huspy.io. We may ask for additional information to confirm your identity and we reply within one month, extendable as the law allows. If processing were based on your consent, you may withdraw it at any time without affecting earlier lawful processing. If you consider that your rights have not been met, you may complain to the Spanish Data Protection Agency.

Security and updates

Access to enquiries is limited to the owner, with a strong password, two-step verification and protected sessions, and communication with the database provider is encrypted. This policy may be updated; the current version and date appear at the top and each enquiry records the version shown when it was sent.