Legal information
privacy, cookies, data processing — the way we handle your details.

Data controller

TrueHomeBuild — Vladimir Petrov, NIF X9876543L, registered office at Passeig de Maragall 271, 2º 1ª, 08020 Barcelona. Contact for data subjects: legal@truehomebuild.com · +34 643 11 33 89.

What data we collect

• Identification: name, surname, phone, email, language preference.
• Project details: apartment address, m², photos, scope description, layout sketches you send us.
• Communication history: emails, WhatsApp / Telegram messages, call logs.
• Technical data: IP address, user agent, page-visit log (only what's needed for security and basic analytics).
• Billing: for active clients — invoicing details, NIF / NIE, bank account (only if you pay by transfer).

Legal basis

• Consent (art. 6.1.a GDPR): when you send us your details through a form on the site or write to us, you consent to us using them to reply.
• Contract performance (art. 6.1.b): for active projects — to draft the quote, sign the contract, run the build, invoice and warranty.
• Legitimate interest (art. 6.1.f): security logs, fraud prevention, retention of project records for the 10-year LOE warranty period.

Retention

Quote-stage leads who don't sign: 24 months from last contact, then deleted. Active projects: throughout the build + 10 years after handover (LOE structural warranty). Billing data: 6 years (Spanish tax law). Communication logs: 24 months. You can request earlier deletion at any time except for data covered by legal retention obligations.

Recipients

Within the company — staff who need it for the project (project lead, foreman, designer, accountant). External processors named in the contract — accounting firm (Bufete Roca, NIF B66012345), billing platform (FacturaDirecta), email provider (Google Workspace EU). We do not sell, rent or trade your personal data.

Your rights

Under GDPR you can: access your data, rectify it, erase it, restrict processing, port it to another controller, object to processing, withdraw consent at any time, and lodge a complaint with the Spanish data protection authority (AEPD, aepd.es). To exercise any of these rights write to legal@truehomebuild.com with a copy of your ID — we reply within 30 days.

International transfers

Some of our processors (e.g. Google Workspace) may transfer data outside the EEA under Standard Contractual Clauses (SCC) approved by the European Commission. We do not transfer data to the United States outside SCC framework.

Updates

This Privacy Policy was last updated on 1 May 2026. Material changes are notified by email to active clients. Minor edits are tracked in the page footer.

What is a cookie

A cookie is a small text file stored on your device by the websites you visit. We use them to remember your language preference, count anonymous visits and prevent abuse. We do not use third-party advertising cookies.

Cookies we set

• thb_lang — your language preference (en/ru/es/ca). 12 months. Strictly necessary, no consent required.
• thb_consent — records your cookie-banner choice. 12 months. Strictly necessary.
• _ga / _ga_* — Google Analytics 4 anonymous traffic counting. 13 months. Set only if you consented to analytics.
• thb_sess — session ID for the contact form (CSRF protection). Cleared when you close the browser. Strictly necessary.

Managing cookies

You can withdraw analytics consent at any time by clicking "Cookie preferences" in the page footer or by deleting the thb_consent cookie in your browser. Strictly necessary cookies cannot be disabled — without them the site can't remember your language or protect form submissions from CSRF.

Browser controls

You can block cookies entirely through your browser settings. Disabling all cookies may break some site features. Help links: Chrome · Safari · Firefox.

Sub-processors

• Google Workspace EU — email, documents, calendar. Data centres in EU (Belgium, Netherlands, Ireland). DPA signed.
• Hostinger — site hosting (Lithuania). DPA on file.
• FacturaDirecta — invoicing platform (Spain). DPA on file.
• WhatsApp Business / Telegram — messaging. International transfers under SCC.
• Bufete Roca — accounting and tax filing (Spain). NDA + DPA on file.

Technical and organisational measures

• HTTPS / TLS 1.2+ on all client-facing pages.
• 2FA enabled on all staff Google accounts.
• Access on need-to-know basis: project lead and foreman see project files, accountant sees billing only.
• Backups daily, retained 30 days, encrypted at rest.
• Annual data-protection training for staff.
• Incident response procedure — breaches notified to AEPD within 72 hours where required.

Children's data

The site is not directed at children under 14 (Spanish digital age of consent). We don't knowingly collect data from children. If you believe a child has sent us data without parental consent, write to legal@truehomebuild.com and we'll delete it.

Contact

Data protection officer / legal contact: legal@truehomebuild.com. We're a small company so we don't have a formal DPO — Vladimir signs off personally on data-protection matters.