Legal

Privacy Notice

Last updated: 30 July 2026

This notice explains how personal data is collected and used on this site. The site is reachable at two addresses — relocation.martaaragon.com and discovery.martaaragon.com — which are the same website, run by the same person, storing data in the same places; the second now forwards to the first. This notice covers both. It is written in good faith and describes how the site actually works today.

A relocation enquiry asks you for more than a name and an email. It asks where you live now, when you want to move, what you can spend, and — if you are moving as a family — how old your children are. That deserves a straight answer about where those details go. We only collect what we need in order to give you a useful reply, we never sell your personal data, and we do not run advertising or analytics tracking on this site.

1. Who we are (Data Controller)

This website is operated by Marta Aragón Barroso (NIF 44138671S), a relocation and real-estate advisory service ("we", "us", "our"). We are the data controller responsible for the personal data described in this notice.

eXp Realty only becomes a data controller further down the line — for example, once you sign a contract with eXp or submit a form through eXp's own website. For everything collected through this site, Marta Aragón Barroso is the controller.

If you have any questions about this notice, or about how your personal data is handled, you can contact us at privacy@martaaragon.com.

2. What personal data we collect

The discovery form

Everything the discovery form collects is something you choose to type or select. Which questions you see depends on the relocation path you pick (family, digital nomad, entrepreneur, retiree or investor), so not everything below applies to everyone:

• Contact and identity. Your full name, email address, phone or WhatsApp number (optional) and the country you currently live in.
• Your plans. Your preferred timeline for the move, the areas of the Costa del Sol you are interested in, and whether you are looking to rent, to buy, or both.
• Household. The size of your household and, on the family path, the ages of the children relocating with you — see section 3, which is about that specifically.
• Schooling (family path). The curriculum you would prefer and any school needs or preferences you describe.
• Financial indications. A rental budget band and/or a purchase budget band. Depending on your path, also a broad annual-income band and business stage (entrepreneurs), the general source of your income such as pension, savings, dividends or rental income (retirees), or your investment strategy, target yield, how many properties you already own and whether you intend to become resident (investors). These are bands and categories, not account details — we never ask for bank, card or payment information.
• Work and lifestyle. How long you intend to stay, your work setup, whether you want somewhere furnished, how important healthcare access is to your choice of area, your climate priorities and your lifestyle priorities.
• Anything else you write. The free-text boxes, including the final "anything else you'd like Marta to know" question. Please share only what you are comfortable having stored.
• Your confirmation. The fact that you ticked the box confirming you have read this notice, and the date and time your form was received.

We do not ask you for special-category data under Art. 9 GDPR (data about health, religion, political opinions, sexual orientation or similar) and we ask you not to put any into the free-text boxes. In particular, the healthcare question asks how important access to healthcare is to your choice of area — it is not a question about your health, and you should not describe medical conditions in it.

Technical data

Like every website, our hosting and security infrastructure automatically processes limited technical data — your IP address and basic browser and device information — in order to serve the pages and to protect the discovery form from automated abuse. See sections 4 and 5.

Private client pages

If you go on to work with Marta, we may prepare a personal page for you (at an address of the form relocation.martaaragon.com/clients/…) holding your relocation brief and a shortlist of properties: the name or label you are known by, the areas, budget and property criteria you gave us, and notes on the search. Your page is opened with a private link that expires: only someone holding a current link can see it, an expired or incorrect link shows a notice asking the visitor to contact Marta — never your content — and each page carries a marker asking search engines not to index it. These pages exist only so that you and Marta can work from the same list, and they are taken down when the engagement ends. You can ask us at any time to change your page, to send you a fresh link, to cut off an old one, or to remove the page entirely — write to privacy@martaaragon.com.

Enquiries that reach us from martaaragon.com

Some enquiries arrive here from the lead pipeline behind martaaragon.com rather than from this site's own form. Marta Aragón Barroso is the controller for both, and martaaragon.com's own privacy policy describes how that data was collected there. Once an enquiry reaches this system it is handled exactly as described in this notice.

3. Children's information

If you choose the family relocation path, the form asks for the ages of the children relocating with you, and that answer is required. Because this is the most sensitive thing this form does, it gets its own section.

• What we collect. The children's ages, the size of your household, and whatever you choose to tell us about schooling — the curriculum you prefer and any specific school needs. That is all.
• What we do not collect. We do not ask for a child's name, date of birth, photograph, nationality, school reports, medical, dietary or special-educational information, or any other detail about them — and you should not include any of that in the free-text boxes.
• It comes from you, not from the child. This form is intended for adults. We do not knowingly collect personal data directly from a child. Where information about a child appears here, a parent or guardian has provided it while completing the form on the family's behalf, and we rely on you having the authority to share it.
• Why we need it. Ages are what determine school-year placement, which schools and curricula are realistic, whether places are likely to exist for the year you are moving, and which neighbourhoods make sense for a family. Without them, any advice we gave about schools and areas would be guesswork.
• Legal basis. Art. 6(1)(f) GDPR — the legitimate interest that we and your family share in giving you relevant, accurate relocation advice. We have weighed that against the children's own interests: the data is minimal (an age, a school preference), it is provided by their parent, it is used only to answer your enquiry, and it is never used for marketing or advertising, never shared for anyone else's marketing, and never used to build a profile of a child.
• How it is stored. The children's answers are stored alongside the rest of your enquiry, in the same systems, with the same processors, under the same retention periods and the same safeguards described in sections 5, 6 and 7. They are deleted when the rest of the enquiry is deleted, never later.
• Your rights cover it. Everything in section 8 applies to this data. A parent or guardian can ask us to show, correct or delete the information we hold about their children at any time by writing to privacy@martaaragon.com — just tell us that is what you are asking about, and we will do it.

4. Why we use your data and our legal bases

Under the General Data Protection Regulation (GDPR) we must have a legal basis for processing your personal data. We rely on the following:

• To reply to you and take steps at your request — you submit the discovery form so that Marta can come back to you personally, so we process your answers in order to take steps at your request prior to entering into a service relationship (Art. 6(1)(b) GDPR).
• To understand what you are looking for, and to improve the service — we read and keep the substance of your enquiry on the basis of our legitimate interest in answering it properly and in improving our advisory service (Art. 6(1)(f) GDPR).
• Information about other members of your household, including children — our legitimate interest, and yours, in giving advice that fits the family actually moving (Art. 6(1)(f) GDPR). See section 3.
• To keep the site secure and prevent abuse — we process basic technical data, including your IP address, to run a secure and reliable site and to protect the discovery form from spam and automated submissions (through an anti-bot check and request rate-limiting). We do this on the basis of our legitimate interest in the security of our service (Art. 6(1)(f) GDPR).
• To prioritise enquiries. When your form arrives it is tagged with an internal priority label worked out only from your stated timeline and budget band, plus whether you left a phone number and whether you picked specific areas. It helps Marta decide what to read first, and it selects which of a few pre-written acknowledgement emails is sent to you. It produces no automated decision about you within the meaning of Art. 22 GDPR — the tag has no legal or similarly significant effect on you, nothing is refused, priced or restricted by it, and the substantive reply that follows is written by Marta herself. Your free-text answers and your children's ages play no part in it.
• Marketing. We do not currently run a newsletter or marketing list from this site, and submitting the discovery form does not add you to one. If that ever changes we will ask for your separate, explicit consent first (Art. 6(1)(a) GDPR), and you would be able to withdraw it at any time.

About the tick box on the form. The box you tick before submitting records that you have read this notice and agree that your answers may be used to reply to you. For the enquiry itself we rely on Art. 6(1)(b) and Art. 6(1)(f) rather than on consent, so it is not a blanket consent to anything else — and it does not affect any of the rights in section 8, which you keep regardless.

5. Who processes or receives your data

We use a small number of trusted service providers ("processors") to run this site and handle enquiries. They act on our instructions under data processing agreements, and they are not permitted to use your data for their own purposes:

• Vercel — hosts this website and runs the code behind the discovery form. It processes the technical data that comes with every request, including your IP address, in order to serve the site.
• Airtable — the system where your discovery form submission is stored and where Marta works from. Your answers, including the family answers described in section 3, are held there.
• Resend — sends the two emails each submission generates: the notification to Marta that your enquiry has arrived, and the acknowledgement sent to the email address you gave us.
• Cloudflare (Turnstile) — provides the anti-bot check on the discovery form. It receives your IP address, basic browser and device signals and an interaction token, in order to confirm that the submission comes from a person rather than a script and to protect the form from spam and automated abuse. It does not receive your answers to the form.
• Sanity — the content management system behind this site. It stores the site's editorial content and, for clients who have one, the content of the unlisted client pages described in section 2.

Beyond these, your enquiry is read by Marta. If your enquiry goes on to become a viewing or a transaction, other people necessarily become involved — a selling agent, a lawyer, a notary, a bank. We will tell you before passing your details to any of them.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

6. International transfers

Some of our service providers — Vercel, Airtable, Resend, Cloudflare and Sanity — are established outside the European Union, primarily in the United States. Where your personal data is transferred outside the EU/EEA, that transfer is protected by appropriate safeguards: the European Commission's Standard Contractual Clauses (SCCs) and/or the provider's certification under the EU–US Data Privacy Framework (DPF), together with that provider's data processing agreement. You can ask us for details of the safeguards that apply to a particular provider by writing to privacy@martaaragon.com.

7. How long we keep your data

We keep your personal data only for as long as it is needed for the purpose it was collected for, and in line with the following criteria:

• Replying to your enquiry (Art. 6(1)(b) GDPR) — for a maximum of 12 months if no further relationship develops.
• Client relationships and property transactions (Art. 6(1)(b) GDPR and our legal obligations) — for the duration of the relationship and then for the period required by applicable law.
• Information about children (Art. 6(1)(f) GDPR) — deleted at the same time as the enquiry it forms part of. It is never retained separately or for longer.
• Unlisted client pages — kept for as long as they are useful to the client, and removed on request.
• Site security (the anti-bot check and request rate-limiting, Art. 6(1)(f) GDPR) — only for as long as strictly necessary. The counters used for rate-limiting are short-lived and expire within minutes.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify it if it is inaccurate or incomplete;
• erase it ("right to be forgotten");
• restrict how we process it;
• object to processing carried out on the basis of legitimate interest — including the processing described in section 3;
• request portability of the data you have provided to us; and
• withdraw consent at any time where our processing is based on your consent (this does not affect processing already carried out).

To exercise any of these rights, contact us at privacy@martaaragon.com. If you are writing about a child, please say so — a parent or guardian can exercise these rights on their child's behalf.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) if you believe your data has been handled improperly. You can reach the AEPD at www.aepd.es.

9. Cookies and similar technologies

This site runs no analytics and no tracking. There is no Google Analytics, no advertising pixel, no social-media tracker and no third-party measurement script of any kind on relocation.martaaragon.com or discovery.martaaragon.com. We set no analytics cookies and no advertising cookies. That is also why you are not shown a cookie-consent banner here: there is nothing to consent to.

The one exception is strictly necessary: Cloudflare's Turnstile anti-bot check may store a short-lived value in your browser in order to carry out the security check on the discovery form and to remember its result while you complete the form. Storage that is strictly necessary to provide a service you have asked for does not require consent (Art. 22.2 of Spanish Law 34/2002, LSSI-CE). It is not used to track you across websites and it is not used for advertising.

If we ever add analytics to this site, we will publish a consent banner in the same release, analytics will stay denied by default until you opt in, rejecting will be as easy as accepting, and this section will be updated at the same time. We will not run analytics first and describe it afterwards.

10. Contact

If you have any questions about this notice, or you want to exercise your data-protection rights, please contact:

Marta Aragón Barroso (NIF 44138671S) — privacy@martaaragon.com

11. Changes to this notice

This notice was last updated on 30 July 2026. It may be updated from time to time. Any change will be published on this page with a new "last updated" date, and we will not describe a way of working that the site does not actually follow.

Back to the discovery form