Controller and contact
- Controller
- Alejandro Gil Fernández
- Spanish tax ID
- 53940705R
- Address
- Avenida Andalucía 42, 2.º F, 29680 Estepona, Málaga, España
- Privacy and rights contact
- info@gfmortgagesolutions.com
- Data protection officer
- No data protection officer has been designated. The controller handles privacy enquiries at info@gfmortgagesolutions.com.
You can send privacy enquiries and requests to exercise your rights to info@gfmortgagesolutions.com or to the professional address above.
What data you use here
The form collects one record per applicant: name, phone number, tax residence, purchase purpose, occupation or business activity, employment status or contract, tenure where applicable, monthly net income and available savings. It also asks whether you have found a property. Email, approximate price and including a calculation from the simulator are optional. You can also add comments about your plans in the same form.
The calculator runs in your browser and can be used without identifying yourself. If you choose to include its figures in your enquiry, they may include the profile, purchase price, savings, loan amount, term and nominal interest rate of the scenario. Do not provide identity documents, payslips, deeds or health information in these fields.
What happens when you submit an enquiry
The form is completed on one screen. Selecting Request my assessment sends your details to GF’s enquiry service, which records the enquiry in a private Google Sheet and generates a notification to the professional email address. The website confirms receipt only after the enquiry has been recorded. If it cannot confirm the record, it tells you and offers alternatives for contacting us by email.
The website code does not store forms or financial figures in persistent browser storage. If you choose to carry calculator figures into the assessment, they may be passed through a URL fragment and the page’s navigation state. Your browser may remember fields or restore tabs according to its settings. The page address identifies its language, as explained in Cookies and preferences.
Purpose and legal basis
If you submit a service enquiry, we use it to respond and take the precontractual steps you request under Article 6(1)(b) GDPR. Required fields enable us to process the requested assessment; without them you cannot submit the form, but you may contact us by email. Data needed for legal obligations are processed under Article 6(1)(c). Any other purpose requires its own information and lawful basis.
The privacy acknowledgement does not authorise advertising. This website has no marketing subscription, advertising profiling or automated credit approval. Simulations are calculations, not eligibility assessments.
To protect the form against abusive submissions, the request’s IP address is temporarily used to derive a pseudonymous identifier and limit submission frequency. The associated counter is retained for up to one hour. This identifier is not included in the enquiry record or email notification. The basis is the legitimate interest in maintaining service security and availability under GDPR Article 6(1)(f).
Retention and providers
Data is used while handling the enquiry or requested engagement. Access to enquiry records and professional email is limited to people authorised to handle them. The following retention criteria and the conditions of the providers involved apply.
- Retention periods
- Enquiries that do not proceed are retained for six months after the last contact. A daily automated review removes enquiries marked as abandoned from the spreadsheet and deletes associated messages that can be unambiguously identified, provided that they are not marked for retention and the retention period has expired. Ongoing transactions and cases requiring retention or further review are excluded. Emails that cannot be reliably linked, working copies and enquiries whose status needs updating are reviewed separately, supported by a monthly reminder. Where a legal obligation or a claim justifies retention, only the necessary data are retained, with restricted access or blocking where applicable. Contracted cases are governed by the specific engagement information and applicable retention obligations. The provider’s technical backups follow its deletion processes and processing terms.
- Hosting provider
- The website is hosted on Cloudflare Pages, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, United States. Its network is international.
- Email and enquiry records
- We use Google Workspace for professional email and Google Sheets for private enquiry records. The contracted provider is Google Cloud EMEA Limited, based in Ireland. Google processes the data in these communications and records on our behalf under its data processing terms, including confidentiality and security measures.
- International transfers and safeguards
- Google and Cloudflare services may involve processing outside the European Economic Area, including in the United States. Transfers to Google LLC and Cloudflare, Inc. within the scope of their certification rely on the EU–US Data Privacy Framework. Where no adequacy decision applies, their terms provide for European Commission Standard Contractual Clauses and any necessary supplementary measures. You can consult the safeguards using the links below and request further information or a copy from our privacy contact.
Google transfer safeguards ↗ Cloudflare transfer safeguards ↗
Cloudflare processes technical request data, such as IP address, date and requested resource, to deliver and protect the website. We have not configured access-log exports through Logpush. Our own form-protection counters expire within one hour; this period does not apply to records the provider needs to operate and protect its network, which are governed by its processing terms and security purpose.
Website enquiries are received by GF. Disclosures to lenders needed for subsequent intermediation will be explained before they take place. Support providers and authorities may be involved where there is an applicable legal basis.
Your rights
You may request access, rectification, erasure, restriction, objection and portability where applicable. If processing relies on consent, you may withdraw it without affecting prior lawful processing. Send your request to our privacy contact; additional identification will only be requested if necessary. You may lodge a complaint with the Spanish Data Protection Agency if you consider that processing infringes your rights.
Rights and complaints information from the AEPD ↗