Privacy policy

1Who is responsible

Blue Angel Atelier, S.L., Calle de Sant Isidre 147, 43540 Sant Carles de la Ràpita (Tarragona), Spain, is responsible for your personal information (the "controller" in data protection law). For anything about it, write to privacy@caribca.com.

The Privacy Officer is accountable for how we handle personal information and can be reached at the same address.

We do not currently offer accounts, enquiries or mailing lists to people in the United Kingdom and China. People there can browse the site; we do not collect their information or track their visits.

2Which laws apply

We are established in Spain, in the European Union, so the General Data Protection Regulation (GDPR) applies to all personal information we handle, wherever you live, together with Spain's data protection law (Organic Law 3/2018, LOPDGDD). For people in Canada, PIPEDA also applies, and for people in the Dominican Republic we respect the rights under Law 172-13. Where these laws differ, you get the protection of the one that covers you. (GDPR art. 3(1))

3What we collect

• Your account: name, email, password (stored scrambled by our sign-in provider, never readable), language, and, if you add them, phone, country and what you are looking for (budget, areas, purpose).
• Enquiries, calls and reservations: what you asked about, your messages, how you prefer to be contacted, when you agreed to be contacted, and the status of any reservation or payment (card details stay with the payment provider).
• Partners and developers: professional details, licence and firm information, and the work recorded on deals.
• How you use the site: with analytics allowed or once signed in, the marketplace pages you open, how long and how far you read, the searches you run and what you save, as described on Who sees my information. Never keystrokes, what you type into forms, or screen recordings.
• Security: sign-in attempts, two-step sign-in events and a scrambled form of your internet address, to stop someone taking over your account.
• Where you came from: the campaign or partner link you used; advertising click codes only with your consent.

4Why we use it

• To provide what you asked for (your account, enquiries, reservations, partner and developer tools). Basis: our contract with you. (GDPR art. 6(1)(b))
• To keep the platform secure and prevent fraud, and to settle which partner introduced a buyer. Basis: our legitimate interests. (art. 6(1)(f))
• To decide when our team gets in touch, using the activity score described on Who sees my information. Basis: our legitimate interests; you can object at any time.
• Analytics and advertising measurement. Basis: your consent, given or refused in the cookie banner and changeable in Cookie settings. (art. 6(1)(a))
• Accounting, tax and commission records. Basis: the law requires us to keep them. (art. 6(1)(c))

5Who receives it

The agent and firm working on your enquiry see what they need for it. Developers see interest in their own projects, not your full profile. These service providers handle information for us, only on our instructions:

• Supabase

  Stores the platform's data, sign-in and files.

• Vercel

  Runs the website.

• Resend

  Sends our emails.

• Google

  Maps, Google sign-in if you use it, and Gemini, which reads the brochures and price lists developers upload to prepare their listings.

• Stripe

  Developer subscriptions and any online payments.

• Sentry

  Error reports, with personal details removed first.

• Google Analytics

  If you allow analytics: how the site is used (pages, device, rough location) and when an enquiry moves forward. Never your name, email or phone.

• Meta (Facebook, Instagram)

  If you allow advertising: whether a visit from one of our Meta ads led to an enquiry or a reservation, matched with a scrambled (hashed) email or phone only if you allowed advertising data.

We do not sell personal information.

6Information sent abroad

Some providers handle information outside your country, including in the United States. Where that happens, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

7How long we keep it

• Your account: while it is open. Closing it deletes your sign-in, favourites and saved searches.
• Pages you viewed: 13 months.
• Sign-in attempts: 30 days.
• Emails we send: the message itself for 30 days, the record that it was sent for one year, and delivery reports from our email provider for six months.
• Enquiries, deals and reservations, and the record of who did what on them: as long as needed for commission, accounting and legal claims, because they show who is owed what.
• Records the law makes us keep, such as tax records and, where they apply, anti-money-laundering checks: for the period that law sets, even after an account is closed.

8Your rights

You can ask to see your information, correct it, delete it, limit how we use it, take a copy with you, and object to uses based on our legitimate interests. You can withdraw consent at any time; it does not affect what was done before.

For anything else, write to privacy@caribca.com. We answer within one month. You may also complain to the data protection authority where you live or work (in the EU, your national authority; in Canada, the Office of the Privacy Commissioner), or to the Agencia Española de Protección de Datos (AEPD, aepd.es), which supervises us.

9Your rights where you live

• European Union and EEA

  All the rights above under the GDPR, including taking a copy of your information with you and objecting to uses based on our legitimate interests.

• United States

  In California and other states with a consumer privacy law: know what we hold and how we use it, get a copy, correct or delete it, and opt out of its sale or sharing for targeted advertising. We do not sell personal information, we share advertising measurement only with your consent, and we treat a browser's Global Privacy Control signal as an opt-out. You can use an authorised agent; we check requests before acting, and never treat you differently for using these rights.

• Canada

  Under PIPEDA: see and correct your information, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada. In Quebec, also ask for your information in a common, structured format, and be told when a decision about you is made only by a computer. The activity score only helps our team decide when to get in touch; it is never used alone for a decision with legal or similarly significant effect on you.

• Dominican Republic

  Under Law 172-13: see, correct, cancel and object to the use of your information (ARCO rights), free of charge.

To use any of these rights, write to privacy@caribca.com or use account settings.

10Security

Sign-in sessions use protected cookies, our staff sign in with a second step, access is limited to the people who need it, and every sensitive change is logged. No system is perfect; if we learn of a breach that puts you at risk, we tell you and the authority as the law requires.

11Cookies

See the Cookie policy for the few cookies we use and how to change your choices.