Privacy Policy

1. Additional Information on Data Protection

1.1. This Privacy Policy has been drafted in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights.

KEY ENTERPRISES DEVELOPMENTS S.L. provides users of the websites www.villasdeloix.com and its related domains (hereinafter, the “Website”) with the following information regarding the processing of their personal data in a clear and easily understandable question-and-answer format.

Who is the Data Controller?

Data Controller: KEY ENTERPRISES DEVELOPMENTS S.L.
Registered address: C/ Munich, 16, 03503 Benidorm (Alicante), Spain
Telephone: +34 686 572 670
Email: VILLASDELOIX@VILLASDELOIX.COM
Data Protection Officer (DPO): GRUPO ARRECIFE CONSULTORES 2007 S.L.
DPO Contact Details: +34 963 127 867 / consultoria@grupoarrecife.com

What purposes do we process your personal data for?

At KEY ENTERPRISES DEVELOPMENTS S.L., we process the personal information you provide for the following purposes:

Property enquiries. To respond to requests for information regarding properties within our development by sending an information brochure by email and subsequently contacting you by telephone (including telephone calls and WhatsApp messages) in order to answer your questions, explain the purchase conditions and arrange property viewings where appropriate.
Commercial communications. To send you, by any electronic means, commercial communications relating to offers, promotions and the marketing of products or services that we may offer, together with customer loyalty communications (such as seasonal greetings and similar communications) and other news or information that may be of interest to you.
Google Enhanced Conversions. If you complete a contact form on our Website and consent to the use of Google Ads advertising cookies, we will use Google’s Enhanced Conversions feature to securely transmit the contact details that you voluntarily provide. This feature encrypts your data automatically using the SHA-256 one-way hashing algorithm before transmitting it to Google. Google compares the encrypted data with its own user database to determine whether you have previously interacted with one of our advertisements. This process is carried out using pseudonymised information and is primarily intended to measure the effectiveness of our advertising campaigns. However, Google may also use privacy-protected conversion event data for certain additional purposes, including automated bidding (to improve the overall quality and accuracy of bidding strategies) and the detection of spam and invalid activity.
Other enquiries. To respond to any other requests, enquiries or communications submitted through any of the contact methods available on www.villasdeloix.com.

No automated decisions affecting you, including profiling for the purpose of offering products or services, are carried out, except as described in our Cookie Policy. Should such processing take place, you will be informed of the logic involved, together with the significance and the envisaged consequences of such processing for you.

How long will we retain your personal data?

Personal data provided through our contact forms for the purpose of responding to your enquiry about a property will be retained for as long as necessary to manage the relevant pre-contractual measures relating to the properties in which you have expressed an interest. In any event, your data will be retained until you request its deletion or for a maximum period of one (1) year following your last interaction with us.

Personal data submitted through any other communication channel available on the Website will be retained for the purpose of managing a potential commercial relationship. If no further interest is shown, such data will be deleted within a maximum period of one (1) year from the date on which it was collected.

Where you have consented to receive commercial communications, customer loyalty communications and news of interest, your personal data will be retained for these purposes until you exercise your right to object or request erasure.

In any event, such personal data will be deleted three (3) years after the last day of the calendar year in which you most recently demonstrated an interest in the communications received by either purchasing one of the Controller’s products or services or requesting information about them.

Furthermore, if no commercial communication has been sent to you within two (2) years of obtaining your consent, your personal data will be deleted.

The foregoing is without prejudice to the provisions of Article 15.2 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights.

What is the legal basis for processing your personal data?

Where you submit a request for information regarding one of our properties through our contact forms, the processing of your personal data is based on the implementation of pre-contractual measures, since communication with you is necessary in order to progress the potential purchase of the property.

If you contact us through any of the other communication channels available on the Website, the legal basis for processing your personal data will depend on the nature of your request, the information provided and the purpose for which it is processed. For example:

we may process your personal data on the basis of our legitimate interest in responding to your enquiries;
we may process your data as part of pre-contractual measures where the information provided is necessary to progress the purchase of one of our properties; or
where additional personal data are required for other specific purposes, we will process such information on the basis of the consent you have provided.

The sending of commercial communications, customer loyalty communications and news of interest is based exclusively on your explicit consent.

Is the information you provide through our contact forms sent to Google?

The information you provide through our contact forms, which is transmitted to Google for the purpose of measuring the effectiveness of our advertising campaigns, is transferred immediately and on a one-off basis only if you have given your consent. No information will be transmitted to Google if you do not provide such consent.

Who will receive your personal data?

The personal data you provide through our contact forms will only be disclosed to Google Ireland Limited where you have expressly authorised us to do so, and to other third parties only where we are legally required to disclose such information.

In addition, KEY ENTERPRISES DEVELOPMENTS S.L. works with a number of service providers that do not receive personal data as recipients but may process such data on our behalf in the course of providing their services. These companies act as data processors, and we have entered into the corresponding data processing agreements required under applicable data protection legislation to ensure the security and confidentiality of your personal data. These service providers include:

IT service providers: Various companies provide us with services including the hosting of our corporate email accounts, website hosting, software hosting and maintenance, cloud storage and other IT-related services.

International data transfers

International transfers of personal data take place when we use WhatsApp Business, provided by WhatsApp Ireland Limited. The service involves the participation of WhatsApp LLC, Meta Platforms Inc., and their authorised sub-processors, whose principal data centres are located in the United States and other countries. These transfers are carried out by WhatsApp Ireland Limited under the appropriate safeguards, including the execution of the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) governing transfers to processors established outside the European Economic Area, in accordance with Article 46(2)(c) GDPR. You may obtain a copy of these Standard Contractual Clauses by contacting us at VILLASDELOIX@VILLASDELOIX.COM.

Furthermore, WhatsApp LLC and Meta Platforms Inc. are certified under the EU–U.S. Data Privacy Framework, adopted by the European Commission on 10 July 2023. Pursuant to Article 45(1) GDPR, this adequacy decision recognises that certified organisations provide an adequate level of protection for personal data transferred from the European Union. Further information is available at: https://www.dataprivacyframework.gov/s/

International data transfers also occur when we use Google Drive cloud storage services and when contact form data are transmitted to Google in connection with the optimisation of our Google Ads campaigns. Within Europe, these services are provided respectively by Google Cloud EMEA Limited and Google Ireland Limited, although they are owned by Google LLC, whose principal data processing facilities are located in the United States, while operating globally. These international transfers are carried out under the safeguards provided by the European Commission’s adequacy decisions, adopted pursuant to Article 45(1) GDPR, under which certain countries outside the European Economic Area have been recognised as providing an adequate level of protection for personal data. The current list of adequacy decisions may be consulted at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

Where an international transfer is not covered by an adequacy decision, Google Cloud EMEA Limited and Google Ireland Limited have entered into the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with other Google entities and their processors and sub-processors, thereby ensuring an appropriate level of protection in accordance with Article 46(2)(c) GDPR. A copy of these Standard Contractual Clauses may be requested by emailing VILLASDELOIX@VILLASDELOIX.COM.

In addition, Google LLC is certified under the EU–U.S. Data Privacy Framework, adopted on 10 July 2023, which constitutes an adequacy decision under Article 45(1) GDPR. Further information is available at: https://www.dataprivacyframework.gov/s/

International transfers of personal data also occur when we use the HubSpot customer relationship management platform. HubSpot Inc. is likewise certified under the EU–U.S. Data Privacy Framework, ensuring an adequate level of protection for personal data transferred from the European Union in accordance with Article 45(1) GDPR. Further information is available at: https://www.dataprivacyframework.gov/s/

What are your rights regarding your personal data?

Under applicable data protection legislation, you have the following rights:

Right of confirmation: to obtain confirmation as to whether KEY ENTERPRISES DEVELOPMENTS S.L. processes personal data relating to you.
Right of access: to obtain access to your personal data and receive information regarding how they are processed.
Right to rectification: to request the correction of inaccurate or incomplete personal data.
Right to erasure (“right to be forgotten”): to request the deletion of your personal data where, among other reasons, the data are no longer necessary for the purposes for which they were collected.
Right to restriction of processing: to request that the processing of your personal data be restricted, in which case we will only retain the data for the establishment, exercise or defence of legal claims.
Right to object: under certain circumstances, and on grounds relating to your particular situation, you may object to the processing of your personal data or withdraw any consent previously given. In such cases, KEY ENTERPRISES DEVELOPMENTS S.L. will cease processing your personal data unless compelling legitimate grounds exist or the processing is necessary for the establishment, exercise or defence of legal claims.
Right to data portability: to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance.
Right not to be subject to automated individual decision-making: including profiling, where such processing produces legal effects concerning you or similarly significantly affects you. Profiling refers to any form of automated processing of personal data used to evaluate personal aspects relating to an individual, including analysing or predicting matters such as professional performance, economic situation, health, personal preferences, interests, reliability or behaviour.

To exercise any of these rights, you may submit a written request to KEY ENTERPRISES DEVELOPMENTS S.L., C/ Munich, 16, 03503 Benidorm (Alicante), Spain, or by email to VILLASDELOIX@VILLASDELOIX.COM. Upon receipt of your request, we will contact you to explain the procedure for exercising your rights.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD), particularly if you believe that your rights have not been adequately addressed.

Spanish Data Protection Agency (AEPD)

Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
Telephone: +34 901 100 099 / +34 912 663 517
Website: https://www.aepd.es

1.2. Accessing and browsing this Website implies acceptance of its Terms and Conditions of Use. However, the collection and processing of personal data (for example, through contact forms, property reservation procedures or similar services) will require the user’s express consent where applicable or will otherwise be based on the appropriate legal basis for processing under applicable data protection legislation, after the user has been duly informed through this Privacy Policy.

1.3. The processing of personal data by KEY ENTERPRISES DEVELOPMENTS S.L. will always be based on one of the legal bases set out in Article 6 of the General Data Protection Regulation (GDPR), as applicable in each case. KEY ENTERPRISES DEVELOPMENTS S.L. reserves the right to amend this Privacy Policy in order to reflect legislative or judicial developments. We may modify this Privacy Policy at any time and will publish any such changes within this Privacy Policy and, where appropriate, in any other location that we consider suitable, so that you remain informed about the information we collect, how we process it and under what circumstances, if any, we disclose it.

1.4. In accordance with our Terms and Conditions of Use, the websites operated by KEY ENTERPRISES DEVELOPMENTS S.L. are intended exclusively for persons over the age of 18 or emancipated minors who have full legal capacity to enter into legally binding agreements. Accordingly, KEY ENTERPRISES DEVELOPMENTS S.L. does not knowingly collect or process personal data relating to users who do not meet these age requirements. Should we become aware, or reasonably suspect, that an unemancipated minor has provided personal data through the Website, such information will be deleted from our systems without undue delay. The user warrants that they satisfy the above age requirements and that all information provided is true, accurate, complete and kept up to date.

2. Processing of Client and Purchaser Data

Should you decide to proceed with the commercial process and formally enter into a property reservation, deposit agreement or purchase agreement with KEY ENTERPRISES DEVELOPMENTS S.L., you will be provided with a specific and detailed privacy notice concerning the processing of your personal data within the relevant contractual documentation (reservation form, deposit agreement, purchase agreement or equivalent), in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR) and Article 11 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights.

At all times, you will be informed of the purposes for which your personal data are collected. KEY ENTERPRISES DEVELOPMENTS S.L. applies the principle of data minimisation, collecting only those personal data that are strictly necessary for the intended purpose and processing them under the strictest duty of confidentiality.

3. Limitation of Liability

KEY ENTERPRISES DEVELOPMENTS S.L. shall be responsible solely for the personal data that it specifically requests from users and processes through this Website. Under no circumstances shall KEY ENTERPRISES DEVELOPMENTS S.L. be liable for any personal information that users voluntarily disclose, transmit or otherwise make available through any means other than those expressly provided by the Website.

4. Data Quality

You warrant that all personal data provided are true, accurate, complete and up to date. You shall be solely responsible for any direct or indirect damage or loss that may arise as a consequence of providing inaccurate, incomplete or outdated information, whether affecting KEY ENTERPRISES DEVELOPMENTS S.L. or any third party.

5. Consent in accordance with the Spanish Information Society Services Act (LSSI-CE)

5.1. In accordance with Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE), KEY ENTERPRISES DEVELOPMENTS S.L. will request your consent so that, if you so choose, we may use your personal data to send you commercial communications relating to this Website, together with information regarding offers, special promotions and products or services offered by KEY ENTERPRISES DEVELOPMENTS S.L. or by third-party service providers.

5.2. In order to guarantee the security and confidentiality of your personal data, KEY ENTERPRISES DEVELOPMENTS S.L. has implemented the appropriate technical and organisational security measures reasonably available to prevent the loss, misuse, alteration, unauthorised access to, or theft of, the personal data provided to us.

Alicante, 22 June 2026