Privacy Policy

Version: 31 October 2026

1. In short

This policy explains which data arises when you visit this website, what happens to it, what we base that on, and what rights you have. We only describe what this website actually does — services we do not use do not appear here.

The key point first: most data arises simply because your browser has to fetch a page from a server. We use no cookies for analytics or advertising and no advertising tracking. Our visitor statistics (section 4) work without cookies and do not recognise you again. Maps and videos only load once you click a button (section 5).

2. Controller

UNISONO LUXURY HOMES ONLY, S.L., Carrer d'Andròmeda, 37, 07609 Llucmajor, Illes Balears, Spain

  • Tax number (N.I.F.): B02925451
  • Commercial Register of Palma de Mallorca, volume 2880, sheet 191, entry 1, page PM-90125
  • Representative: Fabio Leonardo Palumbo
  • E-mail: info@unisonoluxuryhomes.com
  • Phone: (+34) 676 169 322

No data protection officer has been appointed, as there is no legal obligation to do so.

3. Visiting this website (hosting and server logs)

The website runs on Cloudflare (Cloudflare, Inc. or Cloudflare Germany GmbH). Without this processing no page can be delivered.

  • Data: IP address, requested address, date and time, amount of data transferred, browser type

and version, operating system, referring page.

  • Purpose: delivering the pages, stability, defending against attacks.
  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of

the website.

  • Retention: the logs of our server (Cloudflare Workers Logs) are deleted automatically after 7 days at

most. Otherwise, Cloudflare processes access data only for as long as needed for delivery and security.

  • Third countries: see section 17.

When a form is submitted, our server writes a log line if something goes wrong (Cloudflare Workers Logs). It contains the form identifier and the page path — not the information you entered.

4. Audience measurement (Plausible Analytics)

To understand which pages are read and whether our forms work, we use Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). The data is processed on servers in the EU (Hetzner, Germany).

  • How it works: when a page loads, your browser fetches a small script from plausible.io.

Plausible sets no cookies, uses no localStorage and does not recognise you across days or devices. Your IP address and your browser's identifier (user agent) are only used to form a daily changing, encrypted identifier and are not stored afterwards. We only see aggregated figures.

  • What is counted: page views, the page address, the referring page, the country, device type,

browser and operating system. In addition, a few events: a successfully submitted enquiry (with the name of the form), newsletter sign-up and confirmation, and a click on phone, e-mail or WhatsApp. What you type into a form is not transmitted.

  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving the website on the basis

of aggregated figures and knowing whether enquiries arrive.

  • Your device: in our assessment, no information is stored on your device and none is read from

it beyond what is needed to transmit and display the page; consent under Section 25(1) TDDDG or Art. 22(2) LSSI is therefore not required.

  • Processing agreement: we have a data processing agreement with Plausible under Art. 28 GDPR.
  • Objection: you may object to the measurement at any time (Art. 21 GDPR), for example by e-mail.

Because the data is not linked to any person, we cannot single out individual entries; you can, however, prevent the script from loading with a content blocker in your browser.

  • Where nothing is measured: in the password-protected private area (section 11).
  • More information: https://plausible.io/data-policy

5. Maps and videos (Google Maps, YouTube)

On some property pages we show a Google Maps map and a YouTube video (both Google Ireland Limited). Videos are embedded via the address youtube-nocookie.com.

Neither is loaded at first. You see a placeholder with a note and a button instead. Only when you click that button is the map or video loaded from Google (two-click solution). Your agreement applies only to that content on that page; it is not stored. On your next page view you will see the placeholder again.

  • Data from that point on: your IP address, browser and device details, the page you are on; for

YouTube also playback data. Google may set cookies and, if you are signed in to Google at the same time, link the visit to your account.

  • Legal basis: your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), given by clicking the

button.

  • No click, no data to Google. If you do not use JavaScript, the placeholder stays; the fallback

link takes you straight to the provider.

  • Third countries: see section 17.
  • More information: Google's privacy policy, https://policies.google.com/privacy

6. Form protection (Cloudflare Turnstile)

Our forms are protected against automated abuse by Cloudflare Turnstile.

  • When: the check script is only loaded once you start using a form or open a dialogue

containing a form — not when you merely open a page.

  • Data: IP address, browser and device details, behavioural signals. When you submit, our server

additionally sends the check result and your IP address to Cloudflare for verification.

  • Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: protection against spam and automated

requests. Access to your device is strictly necessary within the meaning of Section 25(2)(2) TDDDG for the form you are using to work.

  • Retention: we do not store the data ourselves. Cloudflare processes it for the check and keeps it as

described in the Turnstile Privacy Addendum (cloudflare.com/turnstile-privacy-policy).

7. Protection against bulk requests

To stop anyone misusing our forms for mass sending, we count how many requests arrive from the same IP address within a short time.

  • Data: your IP address and timestamps, held only in the server's working memory.
  • Retention: 60 seconds for forms, 10 minutes for newsletter sign-ups. After that the entry has

expired; it is never stored permanently.

  • Legal basis: Art. 6(1)(f) GDPR, legitimate interest in preventing abuse.

8. Enquiries via our forms

You can reach us through these forms:

  1. Rental enquiry on the rental property pages, with a non-binding price calculation,
  2. Contact form on the contact page,
  3. Contact dialogue on the sales property pages,
  4. Owner enquiry on the page "Your villa with Unisono",
  5. Access request for the Private Collection,
  6. Partnership enquiry for agencies and partners.
  • Data: the information you enter. Every form asks for your name and e-mail address, most also for

a phone number and a message. Depending on the form, also: for rental enquiries the arrival and departure dates, the number of adults and children and any accommodation option and extras you select; for the contact form your address, postcode, town and country; for owner enquiries the location and type of the property, the number of bedrooms and whether you want to let or sell; for access requests whether you are interested in renting or buying and what you are looking for; for partnership enquiries your agency or company, country and the type of partnership. In addition, the consent tick box, the page the enquiry was sent from and the language. For rental enquiries our server recalculates the estimated price and adds it to the message.

  • Purpose: answering your enquiry and, where applicable, preparing a rental, purchase, brokerage

or partnership agreement.

  • Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request); where an enquiry is not

aimed at a contract, Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

  • Delivery: the message is sent as an e-mail to our mailbox info@unisonoluxuryhomes.com. We use

Resend (Resend, Inc., USA) to send it. All information from the form is transmitted as the e-mail text. Sending runs through Resend's EU region (Ireland); Resend may also process data in the USA. Resend is certified under the EU-US Data Privacy Framework; in addition, its data processing agreement contains standard contractual clauses.

  • Confirmation of receipt: after you submit the form, we send a short confirmation to the e-mail

address you entered, using the same service. It contains your name and, for rental enquiries, the property, dates and number of guests, but not your message. Legal basis as above.

  • Retention: we keep your enquiry for as long as it is needed to deal with it and for any

follow-up questions, and no longer than three years after the last contact. If a contract is concluded, the statutory retention periods under commercial and tax law apply.

You do not have to fill in the forms. Without the fields marked as required, however, we cannot answer your enquiry.

Marketing consent in the contact form. The contact form includes an additional, optional tick box for receiving offers and further information. The legal basis is Art. 6(1)(a) GDPR; you can withdraw this consent at any time without formality — a short e-mail is enough.

9. Price calculation for rental enquiries

The non-binding price shown in the enquiry form is calculated in your browser, using price data that is part of the website. No data is sent to us or to third parties in the process. Your details only reach us when you submit the enquiry; our server then recalculates the price.

10. Newsletter

If you subscribe to our newsletter, we use double opt-in: you enter your e-mail address, receive a confirmation e-mail and are only subscribed once you click the link in it.

  • Data: your e-mail address and the language. As proof of your consent we store the time of

sign-up and the time of confirmation.

  • Service provider: Mailchimp (The Rocket Science Group LLC, an Intuit Inc. company, USA).

Mailchimp sends the confirmation and newsletter e-mails and manages the recipient list. Mailchimp also processes your IP address for technical reasons. Mailchimp is certified under the EU-US Data Privacy Framework and has additionally committed to standard contractual clauses.

  • Legal basis: your consent, Art. 6(1)(a) GDPR and Section 7(2)(3) UWG.
  • Unsubscribing: at any time via the unsubscribe link in every newsletter e-mail or by e-mail to

us. Withdrawal takes effect for the future.

  • Retention: until you unsubscribe. Proof of your consent is kept beyond that for as long as

claims can be brought.

11. Private area (Private Collection)

We show some properties only to selected prospective clients in a password-protected area (addresses under /privat/ and /en/private/). You receive access from us at your request (section 8).

  • Access data: for each access we store at Cloudflare who or which property it was issued for,

which properties it covers and until when it is valid. Passwords are only stored in encrypted form (as a checksum).

  • Sign-in cookie: after you sign in, the server sets the cookie `__Host-privat`. It contains the

identifier of your access and its expiry time, is signed against tampering, is only sent over HTTPS and only to this website, and cannot be read by scripts. It is valid until your access expires, for at most 31 days, and is deleted when you sign out.

  • Protection against guessing: after an incorrect password we count failed attempts per internet

connection. For this we store a checksum of your IP address, not the address itself, for one hour after the last failed attempt.

  • What does not happen: we keep no record of which pages you view in the private area. No

audience measurement runs there, and the pages are blocked for search engines.

  • Legal basis: Art. 6(1)(b) GDPR (providing the access you requested) and Art. 6(1)(f) GDPR

(preventing abuse). The cookie is strictly necessary for the access you asked for (Section 25(2)(2) TDDDG, Art. 22(2) LSSI).

12. Watchlist

When you save a property, your browser stores its identifier locally on your device (localStorage, entry `unisono-merkliste`). Only the list of saved properties is stored. This information is not sent to us; we cannot see what you have saved. The entry is only created when you click the star yourself and remains until you remove the properties again or delete it in your browser settings. Legal basis for the storage: Section 25(2)(2) TDDDG or Art. 22(2) LSSI (the function you requested is not possible without it).

13. Reviews on our website

We show reviews from our Google Business Profile. We have copied these texts; they are a fixed part of our pages. Opening the page creates no connection to Google — no Google script is loaded and no cookie is set.

14. Distances and location data

The driving times in the "Location" section were calculated in advance and are part of our pages. Opening a page creates no connection to openrouteservice or OpenStreetMap; the attribution in the footer is a plain link you can follow but do not have to. Data source: © openrouteservice by HeiGIT, data from OpenStreetMap.

15. Fonts

All fonts on this website (Cormorant Garamond, Lato) are served from our own server. No connection is made to Google Fonts or any other font provider.

16. Linked services without embedding

Our pages contain links to WhatsApp (`wa.me`, our phone number), our YouTube channel, our two Instagram accounts (rentals and sales) and our LinkedIn company page, as well as `tel:` and `mailto:` links. These are not embedded: no third-party script is loaded and no cookie is set. Only when you click do you go to the provider, whose privacy terms then apply. We are not responsible for the content or data processing of third-party sites.

17. Recipients of your data and transfers to third countries

We only pass personal data to the service providers named in this policy, who act for us as processors, and to bodies we are legally obliged to inform:

  • Cloudflare — hosting, private area, Turnstile (sections 3, 6, 11),
  • Plausible Insights OÜ — audience measurement, processed in the EU (section 4),
  • Resend, Inc. — sending form messages (section 8),
  • The Rocket Science Group LLC (Mailchimp) — newsletter (section 10),
  • Google Ireland Limited — map and video, only after your click (section 5).

Cloudflare, Resend, Mailchimp and Google belong to companies or groups based in the USA, so data may be transferred to a third country. The USA does not offer a level of data protection fully equivalent to the EU; in particular, US authorities may under certain conditions access data without you having an equivalent legal remedy.

A data processing agreement under Art. 28 GDPR is in place with each of Cloudflare, Plausible, Resend and Mailchimp. Cloudflare, Resend, Mailchimp and Google are certified under the EU-US Data Privacy Framework; transfers are therefore based on the European Commission's adequacy decision (Art. 45 GDPR), with standard contractual clauses (Art. 46 GDPR) in addition. Plausible processes data in the EU only.

18. Your rights

You have the right to:

  • access the data we hold about you (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • object to processing we base on a legitimate interest (Art. 21 GDPR) — here: hosting logs,

audience measurement, spam protection and abuse prevention,

  • withdraw consent with effect for the future (Art. 7(3) GDPR); processing carried out before the

withdrawal remains lawful.

An e-mail to info@unisonoluxuryhomes.com is enough.

19. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority at any time. The authority for our place of establishment is:

Agencia Española de Protección de Datos (AEPD) Calle Jorge Juan 6, 28001 Madrid, Spain Phone: +34 901 100 099 / +34 912 663 517 · www.aepd.es

You may instead contact the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR). In Germany that is the data protection authority of the relevant federal state.

20. No automated decision-making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

21. Changes to this policy

We update this policy when the website or the legal situation changes. The version published here applies. Our Cookie Policy summarises how we use cookies and similar storage.

---

Work with us