Home/Privacy
JHELY Gibraltar (JHELY GLOBAL S.L.) Privacy Notice
Your privacy is important to us. This Privacy Notice explains how JHELY GLOBAL S.L. ("JHELY", "we", "us") collects and uses personal data when you use the JHELY real estate portal available at JHELY and its country/language versions.
Information we collect
When you visit our website, our servers may automatically log the standard data provided by your web browser. This data may constitute personal data under applicable data protection law (e.g. your IP address is considered personal data under EU/EEA rules). It may include your computer’s Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, and other details.
We may also collect data about the device you are using to access our website. This data may include the device type, operating system, unique device identifiers, device settings, and geo-location data. What we collect can depend on the individual settings of your device and software. We recommend checking the policies of your device manufacturer or software provider to learn what information they make available to us.
Personal information
We may ask for personal information, such as your:
Name
Phone/mobile number
Home/Mailing address
This is personal data that can directly identify you. We only request personal information relevant to providing you with a service, and only use it to help provide or improve this service.
Registering Your Interest
When you register your interest in a property/properties we will share the personal data you provide with the relevant estate agents or property owners so they can respond. These agents/owners act as independent data controllers for the data they receive. Their handling of your enquiry is governed by their own privacy practices.
Email Property Alerts
You can sign up for our email property alerts which will be sent to you as and when a new property is added to our database that matches your requirements, this has an unsubscribe link which you can use at any times.
How we collect information
We collect information by fair and lawful means, with your knowledge and consent. We also let you know why we’re collecting it and how it will be used. You are free to refuse our request for this information, with the understanding that we may be unable to provide you with some of your desired services without it.
Use of information
We may use a combination of personal data and aggregated/anonymised data to understand who our visitors are, how they use our services, and how we may improve their experience of our website in future. We do not disclose the specifics of this information publicly, but may share aggregated and anonymised versions of this information, for example, in website and customer usage trend reports.
We may use your personal details to contact you with updates about our website and services, along with promotional content that we believe may be of interest to you. If you wish to opt out of receiving promotional content, you can follow the “unsubscribe” instructions provided alongside any promotional correspondence from us.
Data processing and storage
The personal data we collect is primarily stored and processed in the United States, where our main hosting providers (Heroku / Salesforce, Inc. and OVHcloud) maintain facilities. Because we operate internationally, personal data may also be accessed from or transferred to other countries. We apply the following safeguards depending on destination: (a) United States — transfers to US-based providers rely on the EU–US Data Privacy Framework (for certified organisations) and/or Standard Contractual Clauses (SCCs); (b) United Kingdom — recognised as adequate by the European Commission; (c) Gibraltar — Gibraltar does not currently hold an EU adequacy decision; where we transfer personal data to or from Gibraltar we apply Standard Contractual Clauses as the appropriate safeguard; (d) Countries with EU adequacy decisions (e.g. Argentina, Brazil) — no additional safeguard required; (e) Countries without adequacy (e.g. Bolivia, Chile, Colombia, Mexico) — transfers are governed by SCCs and, where required, a transfer impact assessment. You may request information about the safeguards we apply by contacting us at [email protected].
We retain personal data only as long as needed for the purposes described in this notice and to comply with legal obligations. Indicative retention periods: account data — for the life of your account plus 3 years for legal claims; property enquiries — up to 2 years after the last interaction; marketing subscriptions — until you withdraw consent (plus a suppression record to respect your choice); security logs — up to 12 months; billing and invoices — for the period required by applicable tax/accounting law (typically 5–6 years in Spain). While we retain data, we protect it using commercially reasonable technical and organisational measures. No method of electronic transmission or storage is 100 % secure, and we cannot guarantee absolute data security.
If you request your personal information be deleted, or where your personal information becomes no longer relevant to our operations, we will erase it from our system within a reasonable timeframe.
Cookies
We use “cookies” to collect information about you and your activity across our site. A cookie is a small piece of data that our website stores on your computer, and accesses each time you visit, so we can understand how you use our site. This helps us serve you content based on preferences you have specified. Please refer to our Cookie Policy for more information.
Third-party access to information
We use third-party services for:
Analytics tracking
User authentication
Advertising and promotion
Content marketing
Email marketing
Payment processing
These services process data on our instructions under appropriate contractual terms. Our key service providers include: Heroku (Salesforce, Inc., USA) — cloud hosting and application platform; OVHcloud (OVH SAS, France/Global) — cloud infrastructure and servers; Google Analytics (Google LLC, USA) — website analytics; Microsoft Clarity (Microsoft Corporation, USA) — analytics and heatmaps; Stripe (Stripe, Inc., USA) — payment processing; Emaillabs (Vercom S.A., Poland) — email delivery. We do not share personally identifying information with these providers beyond what is necessary to perform their specific service.
We may, from time to time, allow limited access to our data by external consultants and agencies for the purpose of analysis and service improvement. This access is only permitted for as long as necessary to perform a specific function. We only work with external agencies whose privacy policies align with ours.
We do not sell your personal data. We may disclose data where required by law, or to protect rights and security.
We do not otherwise share or supply personal information to third parties. We do not rent your personal information to marketers or third parties.
Limits of our policy
This privacy policy only covers JHELY GLOBAL S.L. own collecting and handling of data. We only work with partners, affiliates and third-party providers whose privacy policies align with ours, however we cannot accept responsibility or liability for their respective privacy practices.
Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.
Changes to this policy
At our discretion, we may change our privacy policy to reflect current acceptable practices. We will take reasonable steps to let users know about changes via our website. If you are a registered user on JHELY we will notify you using the contact details saved in your account. Where changes materially affect how we process your personal data or legally require your consent, we will notify you and, where required, seek your explicit consent. For non-material updates, continued use of the Portal will constitute acknowledgement of the updated notice.
Your rights under data protection law
Under the GDPR and applicable data protection law, you have the right to: access the personal data we hold about you; rectify inaccurate data; request erasure of your data ("right to be forgotten"); restrict processing of your data; data portability (receive your data in a structured, commonly used format); and object to processing based on legitimate interests or for direct marketing.
Where we rely on your consent (e.g. newsletters, property alerts, non-essential cookies), you may withdraw consent at any time — this will not affect the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with a supervisory authority. In Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD) — www.aepd.es. In Gibraltar, you may contact the Gibraltar Regulatory Authority (GRA).
To exercise any of these rights, contact us at [email protected]. We will respond within one month of receiving your request.
Data Controller
JHELY GLOBAL S.L., Paseo de la Sierra 29, 29018 Málaga, Spain
Supervisory Authority
Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es. Gibraltar: Gibraltar Regulatory Authority (GRA) — www.gra.gi.
This notice is effective as of 2 March 2026.
Children
The Portal is not intended for children. If you are under the age at which you can lawfully consent to data processing in your jurisdiction (in Spain, generally under 14), you must not use the Portal without involvement of a parent or guardian. If we become aware that we have collected personal data from a child without proper authorisation, we will take steps to delete that data promptly.
Legal bases for processing
We process your personal data only where we have a lawful basis under Article 6 GDPR:
• Contract performance — to create and maintain your account, process enquiries, and deliver the services you request (Art. 6(1)(b)).
• Consent — for optional marketing communications, non-essential cookies and analytics tools such as Google Analytics and Microsoft Clarity. You may withdraw consent at any time via cookie settings or by contacting us (Art. 6(1)(a)).
• Legitimate interests — to improve our platform, prevent fraud, and ensure network security, provided these interests are not overridden by your rights (Art. 6(1)(f)).
• Legal obligation — to comply with tax, accounting, and regulatory requirements (Art. 6(1)(c)).
Where we rely on legitimate interests we carry out a balancing test and document the outcome. You may request a copy of that assessment by contacting us at [email protected].
Automated decision-making and profiling
We do not carry out solely automated decision-making that produces legal or similarly significant effects on you (GDPR Art. 22). We may carry out limited profiling to personalise your experience — for example, recommending property alerts based on your stated preferences. You have the right to object to such profiling at any time by contacting us at [email protected].
Language
This Privacy Policy is drafted in English and may be provided in other languages as a courtesy. In the event of any conflict or discrepancy between the English version and any translated version, the English version shall prevail to the fullest extent permitted by applicable law.