Privacy
Privacy policy
Last updated: 2 November 2026
This privacy policy describes the actual processing of personal data on the Predator SLU website and its related access areas. It identifies the service providers currently in use and distinguishes between necessary services, information you provide voluntarily and external content that requires consent.
1. Controller
The controller is Predator SLU, Carrer Vicari Joaquín Fuster, 31, 07006 Palma de Mallorca, Spain. Tax ID (CIF): B57963829. Telephone: +34 871 180 796. Email: info@predatorsl.com.
For privacy enquiries or to exercise your rights, contact info@predatorsl.com.
2. Data we process
Depending on how you use the website, we process technical access data, account data, contact and communication data, property interests, consent records and information required for our work with clients, tenants, agents or team members.
Required fields are marked in the forms. Without them, we cannot process the relevant request or registration. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.
- Technical data: IP address at the infrastructure provider, time, requested URL, browser and device information, referrer and security events.
- Form data: first and last name, email address, telephone number, message, selected property, language and source of the request.
- Account data: email address, name, role, language, sign-in status and, when Google sign-in is used, the profile data released by Google.
- Partner and portal data: professional contact and company details, agency affiliation, tax identifiers and voluntarily uploaded profile images, logos or documents.
- Consent data: time, applicable privacy or newsletter version and selected consent categories.
3. Legal bases
We process data to take steps before entering into a contract and to perform contracts under Article 6(1)(b) GDPR, to comply with legal obligations under Article 6(1)(c) GDPR and for legitimate interests under Article 6(1)(f) GDPR. Our legitimate interests include secure and efficient website operation, handling enquiries, preventing fraud and abuse, and organising our real-estate services.
Newsletter communications and optional external media are based on consent under Article 6(1)(a) GDPR. Consent can be withdrawn at any time with future effect.
4. Website hosting and media – Vercel
The website, server functions and media are provided through Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel processes technical connection and log data needed for delivery, security, error diagnosis and abuse prevention. Images and imported website media are stored in Vercel Blob and are not fetched from Airtable or WordPress on every page view.
The legal basis is Article 6(1)(f) GDPR. Where data is processed outside the EEA, the provider’s contractual safeguards and Standard Contractual Clauses apply.
5. Database, authentication and portals – Supabase
We use Supabase for the database, user accounts, roles, sessions, property content, enquiries and internal portal processes. The provider is Supabase Pte. Ltd.; the Predator SL database project operates in the eu-west-1 region in Ireland. Supabase processes customer data on our instructions as a processor.
Necessary authentication information may be stored in secure cookies. Processing is required to provide the account and protected area and is based, depending on the relationship, on Article 6(1)(b) or (f) GDPR.
Supabase Privacy Policy ↗ · Supabase Data Processing Addendum ↗
6. Contact and property enquiries
Contact forms and viewing requests are first stored in Supabase with a unique submission identifier. We process the contact details, message, selected property, language, source and consent records entered in the form. To limit abuse, the application derives a non-reversible pseudonymous fingerprint from the IP address and browser identifier; our application does not store the raw IP address for this purpose in the enquiry database.
To handle the request, the data is transferred to Airtable as our contact and CRM system and to Brevo for team and confirmation emails. If direct delivery of a property enquiry is technically unavailable, Make may be used as a temporary automation fallback. The legal basis is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR for secure delivery, evidence and internal organisation.
Airtable Privacy Policy ↗ · Brevo Privacy Policy ↗ · Make Privacy Notice ↗ · Make Data Processing Agreement ↗
7. Airtable as editorial and CRM system
We use Airtable, provided by Formagrid Inc. doing business as Airtable, for editorial property data, locations, internal workflows and contact or prospect data. Website content is synchronised in a controlled process from Airtable to our publishing database, while media is copied to Vercel Blob.
For contact and property enquiries, Airtable may store or update names, email addresses, telephone numbers, messages, language preferences, source, property interest and newsletter status. The public website does not query Airtable directly from the visitor’s browser.
Airtable Privacy Policy ↗ · Airtable Legal Terms & Policies ↗
8. Email and newsletters – Brevo
We use Brevo, a service of Sendinblue SAS or the Brevo entity responsible for the account, for confirmations, internal notifications, contact management and newsletters. This may include email address, name, language, communication content, source and consent evidence.
Newsletters are sent only after an active opt-in. Consent may be withdrawn through the unsubscribe link in an email or by contacting info@predatorsl.com. Withdrawal does not affect prior lawful processing. Service and enquiry messages may be sent independently of newsletter consent where needed to handle a request.
9. User accounts and Google sign-in
Partners and clients may use email and password. Team members sign in with Google and, where offered, other authorised users may choose Google. Authentication is handled through Supabase Auth and Google Ireland Limited. Predator SL receives the data released for sign-in, typically a unique account identifier, email address, name, profile image and language.
Google processes sign-in data under its own privacy policy. This route is not activated unless Google sign-in is selected.
10. Translation and AI support in the protected editorial area
In the protected editorial area, we use the OpenAI API to translate property, blog and location copy. For EEA customers the provider is OpenAI Ireland Ltd. Contact or enquiry data submitted by public users is not intended to be sent to OpenAI. Team members must not place personal data in editorial text submitted for translation.
A Google Translate service can technically be used as a fallback for individual blog translations. AI output is reviewed editorially and does not make decisions about individuals. Processing supports multilingual publication and is based on Article 6(1)(f) GDPR. OpenAI states that API data is not used to train its models by default.
OpenAI Business Data Privacy ↗ · OpenAI Data Processing Addendum ↗ · Google Privacy Policy ↗
11. Maps and external media – OpenStreetMap
Interactive maps are loaded from OpenStreetMap only after you consent to “External media” or explicitly activate a map. Your browser then connects to services of the OpenStreetMap Foundation, which may process the IP address, browser and device data, time, referrer and requested map area. Consent is based on Article 6(1)(a) GDPR and can be withdrawn at any time through “Cookie settings” in the footer.
An “Open in Maps” link leads to Google Maps. Google Maps is not embedded in our page; processing by Google begins only when the external link is opened.
OpenStreetMap Foundation Privacy Policy ↗ · Google Privacy Policy ↗
12. Cookies, local storage and analytics
Necessary cookies and local storage are used for sign-in, security, language and consent management. Selected consent categories are stored locally in the browser. Optional categories remain disabled until consent is given.
After consent to the “Analytics” category, we load Google Analytics 4, Vercel Web Analytics and Vercel Speed Insights. Google Analytics 4 is provided by Google Ireland Limited and helps us analyse page views, sessions and interactions. This may include the requested URL, referrer, approximate region, browser and device information and a random client identifier. Google Analytics may set the first-party cookies `_ga` and `_ga_<measurement-ID>`. We use basic consent mode: before consent, the Google tag is not loaded and no analytics data is transmitted to Google. Google advertising storage, advertising user data, personalised advertising and Google Signals remain disabled.
Vercel Web Analytics helps us understand page views and usage patterns; Speed Insights measures real loading and rendering values such as Core Web Vitals. This may include the requested page, referrer, approximate region, browser, device and performance data. According to Vercel, these services do not use third-party cookies or cross-site identifiers.
Consent is based on Article 6(1)(a) GDPR and can be withdrawn at any time for the future through “Cookie settings” in the footer. Without consent, none of the three measurement components is loaded. We currently use no marketing scripts.
Google Privacy Policy ↗ · Google Analytics – Data safeguards ↗ · Vercel Privacy Notice ↗ · Vercel Web Analytics – Privacy and Compliance ↗ · Vercel Speed Insights ↗
13. International transfers
Some providers are established outside the European Economic Area or use subprocessors in third countries. Where personal data is transferred, we rely on an adequacy decision, the EU-U.S. Data Privacy Framework where applicable, or the European Commission’s Standard Contractual Clauses with supplementary safeguards. Current details are available in the linked provider information.
14. Retention
We retain personal data only for as long as necessary for the relevant purpose, business relationship, request handling, security evidence or statutory retention duties. Account data remains while access is enabled and is then deleted or restricted unless legal grounds require continued retention.
Newsletter data is retained until consent is withdrawn or delivery becomes permanently impossible. Evidence of consent or withdrawal may be retained longer to meet accountability obligations. Backups and logs are removed according to the technical deletion cycles of the relevant providers.
15. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability and objection. Consent may be withdrawn at any time for the future. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation; you may object to direct marketing at any time.
Send requests to info@predatorsl.com. You also have the right to complain to a data protection authority. In Spain, this is in particular the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid.
16. Security and updates
The website uses TLS encryption. Access is role-based, credentials are stored server-side and input is technically validated. Despite appropriate safeguards, absolute security of transmission and storage cannot be guaranteed.
We update this policy when features, providers or legal requirements change. The version published on this page is authoritative.