GDPR Privacy Policy

1. Introduction

Competa Construction is committed to protecting your personal data and respecting your privacy rights. This GDPR Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the General Data Protection Regulation (GDPR) and Spanish data protection laws.

This policy applies to all personal data we process through our website, contact forms, telephone communications, WhatsApp messages, and in the course of providing our building and renovation services.

2. Data Controller Information

The data controller responsible for your personal data is:

For any questions or concerns about how we handle your personal data, please use our contact form.

3. Categories of Personal Data We Collect

We may collect and process the following categories of personal data about you:

4. Purposes for Processing Your Personal Data

We process your personal data for the following purposes:

• To provide our services: To respond to your enquiries, provide quotations, enter into contracts, schedule work, complete building and renovation projects, and communicate about ongoing projects.
• To manage customer relationships: To maintain records of our interactions, provide customer support, handle complaints, and ensure quality service delivery.
• To comply with legal obligations: To meet legal and regulatory requirements including tax obligations, building code compliance, and professional record-keeping requirements in Spain.
• To improve our services: To analyze how our website is used, understand customer needs, and improve our service offerings.
• For marketing purposes: To send you information about our services (only with your consent or where we have a legitimate interest and you have not objected).

5. Legal Basis for Processing

We will only process your personal data where we have a legal basis to do so. The legal bases we rely on include:

• Consent: You have given clear consent for us to process your personal data for specific purposes (e.g., marketing communications).
• Contract: Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract (e.g., providing quotations and performing building work).
• Legal obligation: Processing is necessary to comply with legal obligations (e.g., tax records, professional liability requirements).
• Vital interests: Processing is necessary to protect someone's life (e.g., emergency situations on work sites).
• Legitimate interests: Processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those interests (e.g., fraud prevention, network security).

6. Data Sharing and Recipients

We may share your personal data with the following categories of recipients:

• Service providers: Suppliers and subcontractors who assist in delivering our services (e.g., material suppliers, specialist tradespeople). These parties only have access to information necessary to perform their specific functions.
• Professional advisors: Lawyers, accountants, insurance providers, and other professional advisors who assist in running our business.
• Regulatory authorities: Spanish tax authorities (Agencia Tributaria), municipal authorities for building permits, and professional regulatory bodies as required by law.
• Law enforcement: Police, courts, or other authorities when required by law or to protect our legal rights.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes.

7. International Data Transfers

We primarily operate within Spain and the European Economic Area (EEA). However, some of our service providers may process data outside the EEA (for example, website hosting services).

When we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Transferring to countries deemed to provide adequate protection by the European Commission
• Using specific contracts approved by the European Commission (Standard Contractual Clauses)
• Ensuring the recipient is certified under an approved framework

8. Data Retention Period

We will only retain your personal data for as long as necessary to fulfill the purposes for which we collected it, including to satisfy legal, accounting, or reporting requirements.

Our typical retention periods are:

• Enquiries not leading to contracts: 12 months from last contact
• Completed projects and contracts: 7 years from project completion (to comply with Spanish tax and professional liability requirements)
• Marketing communications: Until you withdraw consent or 3 years of inactivity
• Website usage data: 26 months

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for processing, and applicable legal requirements.

9. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us using the information in Section 10 below. We will respond to your request within one month, though this may be extended by two further months in complex cases.

10. How to Contact Us

If you have any questions about this GDPR Privacy Policy, wish to exercise your data protection rights, or have any concerns about how we process your personal data, please contact us:

11. Changes to This Policy

We may update this GDPR Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any changes will be posted on this page with an updated revision date at the top.

We encourage you to review this policy periodically to stay informed about how we are protecting your personal data. Where changes are significant, we will endeavor to notify you by email or through a prominent notice on our website.