Privacy Policy
Last updated: 8 October 2026
1. Data controller
- Company name: ERJA CANARIAS, S.L.
- Tax ID (CIF): B76615996
- Registered office: Carretera General TF-657, 8, 38627 La Camella, Santa Cruz de Tenerife, Canary Islands, Spain
- Contact email for data protection matters: lopd@erjacanarias.com
2. What data we process and where it comes from
We process the data you voluntarily provide through the contact form on this website, or by email, telephone or WhatsApp:
- Identification and contact data: name, email address and telephone number.
- The content of your message, the reason for your enquiry (selling, buying or other) and any additional information you decide to include.
- Basic technical connection data (such as IP address and date and time of access), which is recorded for security and service operation purposes.
Fields marked as mandatory are necessary for us to handle your enquiry. If you do not provide them, we will not be able to reply to you. Please do not include specially protected data (health, ideology, religion, etc.) or third-party data without their knowledge in your message.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| To handle and reply to your enquiry or request for information or valuation. | Your consent (Art. 6(1)(a) GDPR) and, when you request a valuation or a specific service, the implementation of pre-contractual measures at your request (Art. 6(1)(b) GDPR). |
| To manage the business relationship if a transaction or service is formalised. | Performance of a contract (Art. 6(1)(b) GDPR). |
| To comply with applicable legal obligations (tax, accounting, anti-money-laundering, where applicable). | Legal obligation (Art. 6(1)(c) GDPR). |
| To ensure the security of the website and prevent abusive or fraudulent use. | Legitimate interest of the controller (Art. 6(1)(f) GDPR). |
We do not make automated decisions or create profiles with your data.
4. Retention period
We will keep your data for as long as necessary to handle your enquiry and, afterwards, for 12 months in case related matters arise. If a contractual relationship is formalised, we will keep your data for as long as it lasts and, afterwards, blocked for the applicable statutory limitation periods (generally 5 to 10 years, depending on tax, commercial and anti-money-laundering legislation). Once those periods have elapsed, the data will be securely deleted.
5. Recipients and data processors
We do not disclose your data to third parties, except where legally required (for example, to the tax authorities, courts and tribunals, or law enforcement agencies).
To provide the service, we use providers who act as data processors, with whom we have signed the corresponding contract in accordance with Art. 28 GDPR:
- Provider of the website hosting and platform, of the database where forms are stored, and of the sending of email notifications: Lovable.
- Provider of domain management, DNS and security: Cloudflare, Inc.
- Provider of corporate email and work tools: Google Workspace (Google Ireland Limited, with support from Google LLC), which processes the enquiries received and the messages we exchange with you.
If you contact us via WhatsApp (the WhatsApp button on this website), your data will also be processed by WhatsApp Ireland Limited, part of the Meta group, as an independent controller under its own privacy policy (available at www.whatsapp.com/privacy), and not as a processor acting on our behalf. That may involve transfers outside the EEA under its own safeguards. We recommend reviewing that policy before writing to us through that channel.
6. International transfers
Some of the providers listed above may process data outside the European Economic Area (for example, in the United States). In that case, transfers are carried out with the safeguards provided for in the GDPR: an adequacy decision of the European Commission (EU-US Data Privacy Framework, where the provider is certified) or standard contractual clauses. This is the case for Google Workspace, whose provider is certified under the EU-US Data Privacy Framework.
7. Your rights
You may exercise the following rights at any time:
- Access: find out what data of yours we process.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request that we delete your data when it is no longer necessary, among other cases.
- Objection: object to the processing of your data in certain cases.
- Restriction: request that we suspend processing in certain cases.
- Portability: receive your data in a structured, commonly used format, or have us transmit it to another controller.
- Withdraw your consent at any time, without affecting the lawfulness of the processing carried out beforehand.
To exercise them, write to lopd@erjacanarias.com, stating the right you wish to exercise and attaching a copy of your identity document (or an equivalent means of proving your identity). We will reply within a maximum of one month, extendable in complex cases in accordance with the regulations.
If you believe your rights have not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es; C/ Jorge Juan, 6, 28001 Madrid).
8. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration, including encrypted connection (HTTPS), access control and backups.
9. Minors
This website is not directed at children under 14 and we do not knowingly collect their data. If we detect that a minor's data has been provided without the authorisation of their legal representatives, we will delete it.
10. Links to other websites
This website contains links to other sites of the group (Canaryrental.com and ViVaTenerife.com) and to social networks, which have their own privacy policies.
11. Changes
We may update this policy to adapt it to legal or service changes. The current version will always be the one published on this website, with its update date.