Privacy policy

1. Controller and scope

Item: Controller. Information: Rocksure Capital S.L.

Item: Spanish tax ID. Information: B88681267.

Item: Address. Information: Av. La Fontana 11, 03730 Xàbia/Jávea (Alicante), Spain.

Item: Privacy email. Information: info@rocksure.es.

Item: Scope. Information: rocksure.es, its forms and communications resulting from website enquiries.

This policy explains how personal data relating to visitors, prospects and people contacting us through the website is processed. It does not cover processing arising from a property purchase, another contractual relationship, recruitment or activities that require additional specific information.

2. Data we may process and its source

> • Data you provide: the mandatory fields are name, email address, area > of interest (one of six options) and message; the optional fields are > telephone number, country and related project. The language of the > page from which the form is submitted is collected automatically, > together with any information you voluntarily include in the message. > > • Communication data: content, date, channel, follow-up status and > documents exchanged while handling the enquiry. > > • Technical and security data: IP address and request, operational and > security metadata generated by Vercel hosting, together with technical > signals needed for the form honeypot and server-side rate limiting. > These data are not used for advertising. > > • Analytics data: online identifiers, device and browser information, > pages and interaction events and approximate geographic data, only > after Google Analytics 4 has been accepted (measurement ID > G-RL3LRR6ZY1). Google Signals is disabled and Google Tag Manager is > not used. Names, emails, telephone numbers, form content and other > direct identifiers are not sent to GA4.

We do not request special-category data, identity documents, bank details or information about children through the general contact form. Please do not include such information unless it is specifically requested through an appropriate channel with the relevant notice.

3. Purposes, legal bases and retention

Processing: Enquiries and pre-contract steps. Purpose and legal basis: Answering the enquiry, providing information, arranging contact and taking requested pre-contract steps. Basis: Article 6(1)(b) GDPR where the request concerns a potential contractual relationship; for general enquiries, Article 6(1)(f) GDPR, the legitimate interest in responding to user-initiated communications. Retention: While the enquiry is handled and, if no contract follows, up to 24 months after the last meaningful interaction, subject to periodic review and earlier deletion when no longer necessary.

Processing: Continuity, security and claims. Purpose and legal basis: Maintaining site security and continuity, operating the honeypot and rate limiting, keeping minimum technical traceability, preventing abuse and establishing, exercising or defending claims. Bases: Article 6(1)(f) GDPR and Article 6(1)(c) where a legal duty applies. Retention: Technical logs are kept for a maximum of 30 days depending on the Vercel Pro observability configuration, except for limited additional retention required for an incident. Documents needed for legal duties or claims will be restricted for the applicable statutory periods.

Processing: GA4 analytics. Purpose and legal basis: Measuring and understanding website use through Google Analytics 4 (G-RL3LRR6ZY1), only after consent. Basis: Article 6(1)(a) GDPR. Google Signals is disabled and Google Tag Manager is not used. Retention: 14 months for user-level and event-level data under the GA4 setting. Cookie duration is stated separately in the Cookie Policy.

Form data is used exclusively to answer and reasonably follow up the specific enquiry. It is not used for newsletters, general campaigns or commercial communications unrelated to the enquiry. If this purpose changes, prior information and the required legal basis will be obtained.

4. Mandatory and optional data

Name, email address, area of interest, message and the box confirming that the privacy information has been displayed are mandatory. Telephone number, country and related project are optional; page language is recorded automatically. Without the mandatory fields, the enquiry cannot be handled. The box is not consent to process the enquiry: it must read “I have read the Privacy Policy” and is used only to evidence that the information was provided.

5. Recipients, processors and transfers

We do not sell personal data or disclose it to third parties for their own marketing. Depending on the processing, data may be accessed on behalf of Rocksure Capital S.L. by Vercel for hosting, HighLevel/LeadConnector for the CRM through an exclusively server-to-server connection, Google for GA4 only after consent, and Plus Five Five, Inc. (Resend) only if enabled as a transactional email fallback. Professional advisers under confidentiality duties and public authorities may also receive data where legally required.

Provider: HighLevel Inc. and, where applicable, LeadConnector LLC. Function / location: CRM and enquiry management, exclusively through a server-to-server transfer after form submission. United States. No website scripts, pixels or widgets are loaded. Flow, safeguards and transfers: Processing is subject to the applicable DPA. Transfers rely on the EU-US Data Privacy Framework while the relevant certification remains active and, as an alternative contractual safeguard, on the SCCs included in the DPA.

Provider: Vercel Inc. Function / location: Pro-plan hosting, site delivery and technical logs that may include IP address and request metadata. Global infrastructure, including the United States. Flow, safeguards and transfers: The DPA applies to the Pro plan. Runtime logs visible to Rocksure are retained for up to 1 day on standard Pro and up to 30 days if Observability Plus is active. Transfers use the valid mechanism set out in the DPA.

Provider: Google Ireland Limited / Google LLC. Function / location: Google Analytics 4, ID G-RL3LRR6ZY1, only after consent. Google Signals disabled; no Google Tag Manager. EU and United States. Flow, safeguards and transfers: Processing is governed by Google’s applicable terms and valid transfer mechanism. The property is set to 14-month retention; blocking prevents pre-opt-in data and direct form identifiers are not sent.

Provider: Plus Five Five, Inc. (Resend), only if enabled. Function / location: Transactional fallback email for the form, only if enabled at production launch. United States. Flow, safeguards and transfers: If enabled, only data needed to generate and deliver the transactional email will be processed under the DPA and applicable transfer safeguards. If it is not enabled, no data will be sent to Resend.

Sanity is used as the content-management system. Content is fetched server-side and images are served to visitors from the website’s own domain through /_next/image, so the visitor’s browser does not connect directly to Sanity. The /studio area is restricted to editors, and processing of professional editor accounts is outside the scope of this visitor policy.

International transfers are made only under a valid mechanism. Where the adequacy decision for the EU-US Data Privacy Framework is used, we verify that the importing entity has an active certification covering the relevant data and service. Otherwise, European Commission Standard Contractual Clauses and, where required, supplementary safeguards are used. Information about the safeguards may be requested at the email above.

6. Your rights

You may request access, rectification, erasure, restriction, objection and portability where applicable, and withdraw analytics consent at any time without affecting prior lawful processing. Write to info@rocksure.es, stating the right requested. We will ask for additional information to confirm identity only where we have reasonable doubts.

You may also lodge a complaint with the Spanish Data Protection Agency or the supervisory authority competent in your place of residence or work. You may contact us first so that we can try to resolve the issue.

7. Automated decisions and profiling

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. Any internal classification of an enquiry by project or area of interest is used only to organise follow-up and does not produce such effects.

8. Security and confidentiality

We apply reasonable organisational and technical measures appropriate to the risk, including access limitation, authentication, permission management and service providers subject to contractual duties. No system is completely invulnerable; incidents will be handled in accordance with applicable law.

9. Children

The site is not specifically directed at children, and the general form is not intended to collect their data. If we become aware that a child’s data has been submitted without a valid basis, we will take reasonable steps to delete it or obtain the required authorisation.

10. Changes to this policy

This policy will be updated when processing activities, providers or legal requirements change. The current version date will be displayed on this page. Last reviewed: 21 August 2026.

Appendix A. First-layer form notice

Controller: Rocksure Capital S.L. Purpose: to answer your enquiry and take the pre-contract steps you request. Legal bases: Article 6(1)(b) GDPR and, for general enquiries and security, Article 6(1)(f) GDPR. Recipients: hosting and CRM providers and, if enabled, Resend; international transfers may occur under the safeguards described in the Privacy Policy. Rights: info@rocksure.es. Further information: Privacy Policy. Mandatory checkbox: “I have read the Privacy Policy.”