Privacy Policy

Last updated: 3 August 2026

This Privacy Policy explains how personal data is collected and used on martaaragon.com. It is provided in good faith and reflects how the site actually works. It may be updated from time to time; please check back for the latest version.

Privacy is part of the trust we build with every client. Whether you are enquiring about a property, downloading a guide, messaging us on WhatsApp or chatting with our assistant, we want you to know exactly what we collect, why, and how it is protected. We only collect what we need, we use it responsibly, and we never sell your personal data.

1. Who we are (Data Controller)

This website, martaaragon.com, is operated by Marta Aragón Barroso (NIF 44138671S), a luxury real-estate advisory service ("we", "us", "our"). We are the data controller responsible for the personal data described in this policy.

eXp Realty only becomes a data controller further down the line — for example, once you sign a contract with eXp or submit a form through eXp's own website. For everything collected through this website and its tools, Marta Aragón Barroso is the controller.

If you have any questions about this policy or about how your personal data is handled, you can contact us at privacy@martaaragon.com.

2. What personal data we collect

We only collect personal data that you choose to give us, or that is necessary for the website to function. Specifically:

• Chat assistant messages. When you use the chat assistant on this site, we process the messages you send. If you choose to share contact details (name, email or phone) and information about the property you are looking for (such as budget, location, property type or timeline), we process those too.
• Contact and enquiry forms. If you fill in a contact or enquiry form, we collect the details you provide — typically your name, email address, phone number and information about what you are looking for (your buying intent).
• Guide downloads. If you request a downloadable guide, we collect the email address you provide so we can send it to you.
• WhatsApp messages. Several pages on this site offer a WhatsApp button. If you choose to use it, a chat opens with our business number and we receive your phone number, your WhatsApp profile name (and any profile details your own WhatsApp settings make visible) and the content of the messages you send us — including whatever you choose to tell us about what you are looking for. WhatsApp is operated by Meta and is not part of this website; see section 4.
• Basic site-usage and technical data. Like most websites, our hosting and infrastructure automatically process limited technical data (such as IP address and basic device/browser information) needed to serve the site securely and reliably.

We do not ask you for special-category data (such as data about health, religion, political opinions or similar), and the chat assistant asks you not to share sensitive personal information.

3. Why we use your data and our legal bases

Under the General Data Protection Regulation (GDPR), we must have a legal basis for processing your personal data. We rely on the following:

• To respond to your enquiry and take steps at your request — where you submit contact details through the chat, a form, a guide request or a WhatsApp message so that we can follow up with you, we process that data to take steps at your request prior to entering into a service relationship (Art. 6(1)(b) GDPR).
• To run and improve our enquiry service — we process the content of chat conversations, WhatsApp messages and enquiries on the basis of our legitimate interest in answering questions, providing our advisory service and improving it (Art. 6(1)(f) GDPR).
• To keep the site secure and prevent abuse — we process basic technical data, including your IP address, to operate a secure, reliable website and to protect our forms and chat assistant from spam and automated abuse (for example through our anti-bot check and rate-limiting). We do this on the basis of our legitimate interest in the security of our service (Art. 6(1)(f) GDPR).
• To understand and improve the site (analytics) — we use Google Analytics 4 to understand how the site is used and to improve it. Analytics runs only after you accept it in our cookie banner and stays denied by default until you opt in; rejecting is as easy as accepting. When enabled, it processes your IP address, device and browser information, and your activity on the pages. You can withdraw your consent at any time; see section 8 (Cookies).
• Marketing — we will only use your details to send you marketing (such as newsletters or property updates) if you give us separate, explicit consent (Art. 6(1)(a) GDPR). We never add you to marketing automatically, and you can withdraw your consent at any time.

4. Who processes or receives your data

We use a small number of trusted service providers ("processors") to run this site and handle enquiries. They act on our instructions under data processing agreements, and they are not permitted to use your data for their own purposes:

• Anthropic (Claude AI) — powers the chat assistant and processes the messages you send during a conversation.
• Airtable — our lead/contact management system, where contact details you submit are stored.
• Vercel — hosts the website and our Buyer's Flow dashboard.
• IONOS — hosts our messaging relay service.
• Resend — sends transactional emails, such as delivering a guide you have requested.
• Cloudflare (Turnstile) — provides the anti-abuse / anti-bot check on our contact forms and chat assistant. It receives your IP address and a verification token in order to confirm the request is genuine and to protect the site from spam and automated abuse.
• Upstash (Redis) — provides a short-lived rate-limiting store for the chat assistant. It temporarily processes your IP address to limit how many chat requests can be made in a short window, which protects the service from abuse.
• Google (Google Analytics 4) — provides website analytics so we can understand how the site is used and improve it. It runs only after you accept analytics in our cookie banner, and stays denied by default until then; once enabled it processes your IP address, device and browser information, and how you use the pages. See section 8 (Cookies) for how to control this.

WhatsApp (Meta). If you choose to contact us through WhatsApp, your message and phone number are handled through WhatsApp. When you do so, Meta acts as an independent controller under its own privacy terms, not as our processor — we have no data processing agreement with Meta and no control over what Meta does with the data it collects when you use its service. Meta receives your phone number, your WhatsApp profile name and the content of your message. Once your message reaches us, we handle it like any other enquiry, on the bases described in section 3 (Art. 6(1)(b) and Art. 6(1)(f) GDPR). If you would rather not use WhatsApp, you can always contact us by email or through the forms on this site.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

5. International transfers

Some of our service providers (including Anthropic, Airtable, Vercel, Resend, Google, Cloudflare and Upstash) are located outside the European Union, primarily in the United States. Where your personal data is transferred outside the EU, that transfer is protected by appropriate safeguards — the European Commission's Standard Contractual Clauses (SCCs) and/or the provider's certification under the EU–US Data Privacy Framework (DPF) — together with the relevant provider's data processing agreement. Our messaging relay host (IONOS) is located within the European Union.

WhatsApp (Meta) is different. Because Meta is an independent controller rather than one of our processors (see section 4), those transfers are not covered by our own contracts or safeguards. Meta processes WhatsApp data outside the European Union, including in the United States, under its own privacy terms and its own transfer mechanisms. If you would prefer your data not to be handled that way, please contact us by email or through a form on this site instead.

6. How long we keep your data

We keep your personal data only for as long as necessary for the purpose it was collected, and in line with the following criteria:

• Replying to your enquiry (Art. 6(1)(b) GDPR) — for a maximum of 12 months if no further relationship develops.
• Client management and real-estate transactions (Art. 6(1)(b) GDPR and our legal obligations) — for the duration of the contract and for the period required by applicable law.
• Newsletter and commercial communications (Art. 6(1)(a) GDPR, consent) — until you withdraw your consent or unsubscribe.
• Website analytics (Google Analytics 4) — for as long as your consent remains active, in accordance with your cookie settings.
• Site security (including Cloudflare Turnstile and rate-limiting, Art. 6(1)(f) GDPR) — only for the time strictly necessary.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify it if it is inaccurate or incomplete;
• erase it ("right to be forgotten");
• restrict how we process it;
• object to processing carried out on the basis of legitimate interest;
• request portability of the data you have provided to us; and
• withdraw consent at any time, where our processing is based on your consent (this does not affect processing already carried out).

To exercise any of these rights, contact us at privacy@martaaragon.com.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) if you believe your data has been handled improperly. You can reach the AEPD at www.aepd.es.

8. Cookies

This site uses a small number of cookies and similar storage technologies:

• Strictly-necessary / functional — the chat assistant uses storage that is strictly necessary to keep your chat session working while the widget is open, and we use a functional cookie to remember your chosen language. These are essential for the site to work as you expect and do not require your consent.
• Analytics (Google Analytics 4) — we use analytics cookies (such as _ga) to understand how the site is used and to improve it. These load only after you accept analytics in our cookie banner. You can also opt out at any time, for example by using your browser's privacy settings or Google's opt-out browser add-on.

Analytics cookies are set only after you agree to them. When you first visit, a cookie-consent banner (using Google Consent Mode v2) lets you accept, reject, or choose which cookies to allow — rejecting is as easy as accepting, and analytics stays denied by default until you opt in. Google Analytics sets no _ga cookie before you consent. You can change your choice at any time through the "Cookie preferences" link in the footer of every page, and you can still block or remove cookies through your browser settings. For the full list of the cookies we use, see our Cookie Policy. To exercise your rights over any personal data processed through these cookies, or to change your preferences, contact us at privacy@martaaragon.com.

9. Contact

If you have any questions about this Privacy Policy, or you want to exercise your data protection rights, please contact:

Marta Aragón Barroso (NIF 44138671S) — privacy@martaaragon.com

10. Changes to this policy

This policy was last updated on 3 August 2026. It may be updated from time to time. Any changes will be posted on this page with a new "last updated" date.

11. Carefully Selected Recommendations

We may recommend independent professionals — lawyers, tax advisers, mortgage brokers, surveyors, developers and other specialists — whom we believe can help you buy or sell well. These recommendations reflect our own judgement. If you choose to engage or contact them, your relationship with them is governed by their own privacy policies and terms.

12. Trusted Partners

From time to time we may work with selected partners whose services complement what we offer. Where such a relationship exists, we aim to be transparent about it, and no commercial arrangement will change our commitment to recommending what genuinely serves your interests.