Privacy policy

Last updated: October 2026

This policy explains how I collect, use and protect your personal data when you visit cometomalaga.com or contact me, in line with the General Data Protection Regulation (GDPR) and Spanish data protection law.

1. Who is responsible for your data

Controller: Miriam Boada Hernández, trading as Come to Malaga. Lawyer, member of the Málaga Bar Association (ICAMALAGA), no. 11.397.

Tax ID (NIF): 44008693X. Address: Calle Marqués de Larios 1, 3º izq., 29015 Málaga, Spain. Email: [email protected]. Website: cometomalaga.com.

2. What data I collect, why, and on what basis

Contact form: name, email, phone number and your message. I use them to reply to your enquiry. Legal basis: your consent (art. 6.1.a GDPR) and, if you ask about my services, steps prior to entering into a contract (art. 6.1.b).
Free checklist form: your email address. I use it to send you the checklist you requested. Legal basis: your consent.
Property search requirements form: your contact details and your preferences (for example budget, area and type of property). I use them to assess your needs and prepare the search. Legal basis: steps prior to entering into a contract and your consent.
Updates by email: only if you expressly agree to receive them. Legal basis: your consent, which you can withdraw at any time.
Website usage data: collected through cookies and analytics tools only if you accept them in the cookie banner. See the Cookie Policy.
If you become a client: I will also process the data I need to provide the service and to meet legal obligations that apply to my profession, such as anti-money-laundering and tax rules (art. 6.1.b and 6.1.c). I will give you further information in my engagement letter.

3. Who receives your data

I do not sell your data. I share it only with:

Service providers that process it on my behalf: website hosting and security (such as OVH and Cloudflare), forms and email delivery (such as WPForms and an email service), and analytics and advertising measurement (such as Google Analytics and Google Ads, only if you accept cookies).
Professionals I involve at your request, such as notaries, banks, tax advisers or translators.
Public authorities, when the law requires it.

4. International transfers

Some providers, such as Google, may process data outside the European Economic Area. In those cases the transfer relies on adequate safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses.

5. How long I keep your data

Enquiries that do not lead to a service: 12 months after our last contact.
Checklist and email updates: until you withdraw your consent or ask me to delete your data.
If you become a client: for the periods required by law and by my professional obligations.

6. Your rights

You can ask me to access, rectify or delete your data, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time. Write to [email protected] and include proof of your identity. If you consider that your data has not been handled correctly, you can complain to the Spanish Data Protection Agency (AEPD), www.aepd.es.

7. Cookies

I use cookies as described in the Cookie Policy (EU) on this website. You can change your choices at any time.

8. Security

I apply reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access.

9. Changes to this policy

If I change this policy, I will publish the new version on this page with its date.