Privacy Policy

Who is responsible

Cavalma Lifestyle is operated by TERRA FIRME ANDALUSI S.L. (Sociedad Limitada Unipersonal), NIF B27578509, with registered office at Urbanización Atalaya Río Verde, 20 · 29660 Marbella · Málaga · Spain. We decide why and how the personal data described here is processed, which makes us the data controller under the EU General Data Protection Regulation (Regulation 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD).

You can reach us at info@cavalma.com, or by phone and WhatsApp on +34 695 118 073. Full company identification is published in our legal notice.

What we collect and why

We only collect data that the platform genuinely needs. There are five situations in which personal data reaches us.

• Enquiries to a listed business: your name, email address, optional phone number and the content of your message, so the business can answer you and so both sides keep a record of the conversation.
• Business applications: the applicant's name, business name, work email, phone number, website, category and location, plus anything written in the application, so our editors can review it.
• Accounts: email address, password (stored only as a hash by our authentication provider), display name, saved listings, private collections and your enquiry history.
• Business accounts and invitations: the invited person's email address, role within the organisation and activation status, plus the profile content, images and service information they publish.
• Consent and security records: your cookie choices with a timestamp, and technical records such as rate-limiting counters and audit entries for sensitive administrative actions.

Lawful basis for each purpose

• Answering an enquiry and passing it to the business you addressed: performance of a contract or pre-contractual steps at your request (Art. 6(1)(b)).
• Creating and running an account, business workspace or invitation: performance of a contract (Art. 6(1)(b)).
• Reviewing business applications and deciding on editorial inclusion: legitimate interest in curating an accurate guide (Art. 6(1)(f)).
• Security, abuse prevention, rate limiting and audit logging: legitimate interest in protecting the platform and its users (Art. 6(1)(f)).
• Non-essential cookies and any measurement: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Keeping records required by Spanish tax and commercial law where a paid membership exists: legal obligation (Art. 6(1)(c)).

Transactional email

We send service emails: sign-in and password links, enquiry notifications, application updates, invitation and activation links, and replies within a lead conversation. These are necessary to operate the service and are not marketing.

Delivery is handled by our email provider on our behalf. We log delivery status (sent, delivered, bounced) so we can tell whether an important message reached you. We do not run marketing campaigns or newsletters from this platform, and we do not sell or rent email addresses.

Who receives your data

• The business you addressed an enquiry to, and only that business, receives your message. Businesses' own private contact details are likewise not published to visitors.
• Our editorial and administrative team, limited to what each role needs.
• Processors acting on our instructions: our hosting and application platform, our database, authentication and file storage provider, and our email delivery provider. All process data within the EU or under an adequacy decision or standard contractual clauses.
• Public authorities, only where the law requires it.
• We do not sell personal data and we do not share it with advertising networks.

How long we keep it

• Enquiries and lead conversations: up to 24 months after the last message, so both sides keep a record.
• Business applications: for the life of the relationship, or 12 months after a decision if declined.
• Accounts: until you delete the account, then removed or anonymised within 30 days except where law requires retention.
• Consent records: up to 24 months from the decision, as evidence that consent was validly obtained.
• Security and audit logs: up to 12 months.

Your rights

You may request access to your data, correction of it, deletion, restriction of processing, portability in a machine-readable format, and you may object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting what was lawful beforehand.

Write to info@cavalma.com and we will answer within one month. If you hold an account, saved listings, enquiry history and consent history are visible in your account area at any time. If you believe we have handled your data badly you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es).

Security

Data is held in an EU-hosted database with row-level access rules, so a business can only reach its own records and a visitor can only reach their own. Uploaded images live in a private bucket served through a controlled public read route. Passwords are hashed by our authentication provider and never visible to us. Administrative actions are recorded in an audit log, and sensitive endpoints are rate limited.

Children

This platform is intended for adults. We do not knowingly collect data from anyone under 14, the age of digital consent in Spain. If you believe a child has given us data, write to us and we will delete it.

Changes

When this policy changes materially we update the date at the top of the page, and where the change affects consent we ask for your choices again.