Privacy Policy

The controller of your personal data — the business that decides how and why it is used — is the owner of this website:

For anything to do with your personal data, including the rights described below, write to info@costablancarenewablecentre.com.

We only collect what you give us, and what is needed to run the website securely:

• Contact and quote requests: your name, email address and phone number, the service you are interested in, the type of property, its town or area, and anything you write in your message.
• Refer a Friend: your name, email address and phone number, plus your friend's name, phone number and address and a PDF copy of their energy bill, which may show their consumption, supply address and account details.
• Calls, emails and WhatsApp messages: your contact details and whatever you choose to tell us.
• Technical data: like any website, our server records IP addresses, browser types and the pages requested, in logs kept for security and to fix faults.
• Cookies and similar technologies: only as described in our Cookie Policy, and only with your consent where the law requires it.

We do not ask for sensitive information, such as health data, and we ask you not to include any in your messages.

We use your data only for the purposes below, each with its legal basis under the General Data Protection Regulation (GDPR):

• To answer your enquiry and prepare a quote, at your request, before any contract (Article 6(1)(b) GDPR).
• To carry out an installation you have agreed to, and to provide the warranty and support that come with it (Article 6(1)(b) GDPR).
• To run Refer a Friend: to contact your friend about your recommendation and to pay you any reward. This rests on our legitimate interest in following up recommendations you choose to send us (Article 6(1)(f) GDPR).
• To keep the website secure and working, through server logs (Article 6(1)(f) GDPR).
• To meet our legal obligations, such as invoicing, accounting and tax records once you become a customer (Article 6(1)(c) GDPR).
• Optional cookies, analytics, Google Ads measurement and Google Maps, only with your consent, which you can withdraw at any time (Article 6(1)(a) GDPR).

We do not make automated decisions about you or build profiles, and we do not send you marketing emails unless you ask us to.

When you send us a friend's details, you confirm that they are happy for you to share them and for us to contact them about your recommendation. Please let them know before you submit the form.

We contact your friend only about your recommendation. When we first get in touch, we tell them where their details came from and point them to this policy. If they are not interested, we delete their details and their energy bill.

We never sell your data. We share it only with providers that process it for us, under contract and on our instructions, or where the law requires it:

• OVH, which hosts this website and our form server in data centres in the European Union.
• Namecheap (Private Email), which delivers the messages sent through our forms to our team.
• Telegram, which we use to alert our team as soon as a new request arrives.
• Google, for Google Ads measurement and Google Maps, only if you allow them in the cookie settings.
• Vercel, for anonymous page-view statistics, only if you allow analytics.
• WhatsApp (Meta), only if you choose to contact us there, in which case WhatsApp's own privacy policy also applies.
• Public authorities, courts and our tax advisers, where the law requires it.

Some of these providers — Namecheap, Telegram, Google, Vercel and Meta — are based outside the European Economic Area or may process data there. When that happens, the transfer is protected by a European Commission adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or by the Commission's standard contractual clauses.

We keep your data only for as long as we need it:

• Enquiries and quotes that do not lead to a contract: up to 12 months after our last contact, then deleted.
• Customers: for as long as the contract and its warranties last, and afterwards for the periods set by commercial and tax law (generally six years for accounting records).
• Referred friends: until the referral is settled. If your friend is not interested, their details and energy bill are deleted straight away.
• Server logs: for a limited period, for security only.
• Cookies: as set out in our Cookie Policy.

You can ask us at any time to:

• see the personal data we hold about you (access);
• correct anything that is inaccurate or incomplete (rectification);
• delete it when we no longer need it or you withdraw your consent (erasure);
• limit how we use it while a question is being resolved (restriction);
• object to uses based on our legitimate interest (objection);
• receive the data you gave us in a portable format (portability);
• withdraw your consent at any time, without affecting what we did with it before.

To use any of these rights, write to info@costablancarenewablecentre.com and tell us which one. We may ask you to confirm your identity, and we will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Our services are for adults. We do not knowingly collect data from anyone under 14. If you think a child has sent us their details, contact us and we will delete them.

The website is served only over an encrypted (HTTPS) connection, and access to your data is limited to the people who need it to deal with your request. We review these measures regularly.

We may update this policy when our services or the law change. The date at the top always shows the current version, and if a change is significant we will make that clear on the website.