1. Controller
Sunny Side of Life, S.L. (Sunny Homes), Ronda de Ponent, 13, E-07620 Llucmajor, Baleares, Mallorca, Spanien, email: [email protected], phone: +34 971 660 731, is responsible for the processing of personal data on this website.
This privacy policy explains what data we process via www.sunny-homes.com, why we process it and what rights you have.
2. Data processed when you use the website
2.1 Server and access logs
When the website is accessed, technically necessary connection data is processed. This may include IP address, date and time of access, requested URL, referrer, browser type, operating system and similar technical details. We process this information to deliver the website, analyse faults and keep the systems secure.
2.2 Contact and property enquiries
If you contact us through the contact form or a property enquiry, we process the information you submit. This usually includes your name, email address, phone number, type of interest, message, language and, where applicable, details of the requested property.
2.3 Technical preferences
If you manually change the website language, we store that preference locally in your browser so that the site can load in your preferred language on future visits.
2.4 WhatsApp communication via “Maria”
This policy also covers incoming business communication through our WhatsApp number “Maria”. We process the message text provided, phone numbers or WhatsApp identifiers, message IDs, timestamps, delivery status and accompanying technical metadata. Individual message and status events are stored in our receiving system on Microsoft Azure in the West Europe region. For non-text messages, media identifiers and metadata may be stored; this receiving integration does not automatically download or analyse media. Receiving a message does not activate automated replies, AI analysis or automatic forwarding to Propstack.
3. Purposes and legal bases
- Website delivery, stability and security based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
- Handling contact and property enquiries based on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR, depending on whether the enquiry is already linked to a potential contract or is part of general communication.
- Internal notifications and CRM processing based on Art. 6(1)(f) GDPR. Our legitimate interest is the orderly processing of incoming enquiries and prospect data.
- Saving your language preference based on Art. 6(1)(f) GDPR to make the site easier to use.
- WhatsApp communication concerning contract preparation specifically requested by you or performance of a contract based on Art. 6(1)(b) GDPR.
- General business communication via WhatsApp, organisation and technical security based on Art. 6(1)(f) GDPR. Our legitimate interests are the orderly handling of incoming contacts, continuity of communication and reliable operation protected against misuse. Contacting us via WhatsApp is not treated as consent to marketing.
4. Recipients and service providers
We use service providers to operate the website and process enquiries. These currently include:
- Cloudflare for DNS, security and edge delivery functions
- Microsoft Azure for hosting and server-side functions
- Propstack as CRM system for processing prospect and enquiry data
- email/SMTP providers for internal notifications about new website leads
If data is transferred outside the EEA, such transfers are based on the safeguards stated by the relevant provider, such as standard contractual clauses or other legally recognised mechanisms.
WhatsApp Ireland Limited is the WhatsApp Business Platform service provider in the European Economic Area. Under the Cloud API Terms, Meta Platforms Ireland Limited provides Cloud API processing on our behalf. Providers may also process data for certain purposes of their own, particularly security and integrity, under their own terms. We use Microsoft Azure for our receiving system under the Microsoft Data Protection Addendum (DPA).
Despite the Azure storage location in West Europe, the providers used may transfer data internationally or permit access from other countries, including the United States. Depending on the provider and processing, applicable adequacy decisions, including the EU-US Data Privacy Framework where applicable, or standard contractual clauses and any necessary supplementary measures apply. Details are set out in the Meta European processor terms, the WhatsApp Data Transfer Addendum and the Microsoft DPA. This does not constitute a guarantee that processing takes place exclusively within the EU.
5. Retention periods
- Access and security logs are stored only as long as necessary for operation, troubleshooting and misuse prevention.
- Contact and prospect data is stored as long as required to process your enquiry, document the request and, where relevant, prepare or perform a contract.
- Your language preference remains stored in your browser until you delete or overwrite it.
- WhatsApp communication: We retain data while needed for an active contact, handling the matter or necessary records. Specific statutory retention obligations and justified requirements for establishing, exercising or defending legal claims are taken into account; they do not automatically justify retaining the entire chat history. An authorised person reviews continued necessity quarterly and when a matter is closed or a privacy request is received. If the reason for retention ceases to apply, deletion or anonymisation is arranged on a case-by-case basis. Blanket indefinite retention is not intended.
6. Requirement to provide data
The information requested in mandatory form fields is required so that we can process your enquiry. Without it, we may be unable to respond or may only be able to respond in a limited way.
7. Automated decision-making
No automated decision-making within the meaning of Art. 22 GDPR takes place through this website.
8. Your rights
Subject to the statutory requirements, you have the right to access, rectify, erase, restrict processing, data portability and object to certain processing. Where processing is based on your consent, you may withdraw that consent with effect for the future.
To exercise your rights, simply contact us at [email protected]. You also have the right to lodge a complaint with a supervisory authority. In Spain this is in particular the Agencia Española de Protección de Datos (AEPD) (https://www.aepd.es).
9. Updates to this policy
We update this privacy policy whenever legal requirements, technical processes or the content of this website change materially.