GDPR Information

Controller and contact

Cavalma Lifestyle is operated by TERRA FIRME ANDALUSI S.L. (Sociedad Limitada Unipersonal), NIF B27578509, with registered office at Urbanización Atalaya Río Verde, 20 · 29660 Marbella · Málaga · Spain. This company is the controller for the processing described in our privacy policy. Requests under the GDPR go to info@cavalma.com, or by phone and WhatsApp on +34 695 118 073.

We are not required to appoint a Data Protection Officer, as we do not carry out large-scale monitoring or process special categories of data. Requests are handled by our team at the address above.

Your rights in practice

• Access: ask for a copy of the personal data we hold about you and the purposes it serves. Account holders can already see saved listings, enquiry history and consent history in their account.
• Rectification: correct anything inaccurate. Profile and business details can be edited directly in the relevant workspace.
• Erasure: delete your account and associated data. We remove or anonymise within 30 days, keeping only what law requires.
• Portability: receive the data you provided in a structured, machine-readable format, or have it sent to another controller where technically feasible.
• Restriction: ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
• Objection: object to processing based on legitimate interest, including editorial review and security analytics.
• Withdraw consent: change cookie choices at any time from the footer link or your account privacy page, with effect from that moment.
• Automated decisions: we do not carry out automated decision-making or profiling with legal or similarly significant effects.

How to make a request

Write from the email address associated with the data, describing what you want. We answer within one month, extendable by two further months for complex requests, and we will tell you if that happens. There is no fee unless a request is manifestly unfounded or repetitive. If we cannot identify you from the request we may ask for proof, and we will not ask for more than is needed to confirm who you are.

Processing we actually carry out

• Enquiries sent to listed businesses and the resulting message threads.
• Business applications, editorial review and invitation-based account activation.
• User accounts, saved listings and private collections.
• Transactional email delivery and delivery status logging.
• Cookie consent records and administrative audit logs.
• Rate limiting and abuse prevention.

International transfers

Our hosting, database, storage and email providers process data within the European Union. Where a provider processes data outside the EEA, it does so under an adequacy decision or the European Commission's standard contractual clauses, with additional technical measures such as encryption in transit and at rest.

Data breaches

If a breach is likely to result in a risk to your rights, we notify the Agencia Española de Protección de Datos within 72 hours of becoming aware of it, and we tell affected people directly where the risk is high.

Complaints

If you are not satisfied with our answer, you may complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid (www.aepd.es), or to the authority in your country of residence.