Data protection & Privacy

Property Boutique – a trading name of Infinitech Worldwide Ltd.
Last updated: 10th August 2026

This policy explains what personal data we collect through propertyboutique.es, why we collect it, how we protect it, and what rights you have over it.
Please read it alongside our Legal Notice, Terms of Use and Cookie Policy.

Our privacy promises
Who we are and who is responsible for your data
How we protect your data
What data we collect and why
Our legal bases
The AI Listing Assistant
Who we share your data with
Where your data is held, and why the UK
How long we keep your data
Your rights
How to raise a concern
Cookies
Embedded content from other websites
Marketing
Automated decision-making and profiling
Children
Our incident commitment
Changes to this policy
Contact us and privacy assistance

1. Our privacy promises

Most privacy policies are written to protect the company. This one is written to tell you exactly what happens to your information. In short:

We share your data with no-one. We do not sell it, rent it, trade it, give it away, or pass it to advertisers, data brokers, marketing lists or partners. Not for money, and not for free.
Your data is end-to-end encrypted. It is encrypted before it reaches our storage and stays encrypted there. Our own staff – including the person who administers the server – cannot read it.
Your data is not an asset to us. We do not mine it, profile you, or build a picture of you to monetise. We collect as little as we can, and keep it for as short a time as we can.
Nobody can reach it. After processing your request, your data is further encrypted and not accessible by anyone in a human readable format.
It is held on our own fortified infrastructure in the United Kingdom, isolated from the public website and unreachable from the open internet.
We have never had a data breach in more than 15 years, and we have a dedicated team whose job is to keep it that way.
We tell you when something works differently. Our AI Listing Assistant sits deliberately outside the encrypted store, and clause 6 explains exactly what that means for you.

2. Who we are and who is responsible for your data

We are Property Boutique, based in Málaga on the Costa del Sol, Spain. Property Boutique is a trading name of Infinitech Worldwide Ltd., a company registered in England and Wales under company number #08333710, with its registered office at High Street, Sunninghill, Ascot, Berkshire, SL5 9NE. Infinitech Worldwide Ltd. has been active in Spain for more than 30 years.

Infinitech Worldwide Ltd. is the data controller for all personal data collected through this website. Infinitech Worldwide Ltd. – not any individual, agent or representative in Spain – decides why and how your data is used, holds it, and is legally responsible for keeping it safe.

Our Spanish office handles platform administration and community support. It holds no personal data at all. Everything is stored and controlled by Infinitech Worldwide Ltd. on the infrastructure described in clause 3.

2.1 Our contact details

Controller: Infinitech Worldwide Ltd.
Registered office: High Street, Sunninghill, Ascot, Berkshire, SL5 9NE.
Company number: #08333710
Privacy contact: info@propertyboutique.es
Chief Security Officer: Infinitech Worldwide Ltd. admin@infinitechgroup.com
Representative in the European Union (Article 27 EU GDPR): Mr. D. Jones. Alameda Principal, 45, Distrito Centro, Málaga 29001. admin@propertyboutique.es

2.2 Professionals you choose to contact

If you ask us to put you in touch with a Property Boutique Representative or an Independent Service Provider, you are directing us to send your enquiry to that person. We show you exactly who will receive it before you send it, and it goes to them and nobody else.

From the moment they receive it, that professional holds your details as a separate and independent data controller, under their own privacy notice and under Spanish data protection law, including Ley Orgánica 3/2018. Ask them for their privacy notice – every professional in our network is required when asked to supply one to you.

3. How we protect your data

Security is the foundation of this platform rather than a feature bolted onto it. Infinitech Worldwide Ltd. runs a security posture far beyond what is typical for a property website, and the sections below describe how it works.

3.1 End-to-end encryption

Personal data you submit is end-to-end encrypted. It is encrypted before it leaves your session and it remains encrypted in our storage. What sits on our servers is ciphertext – unreadable without keys that the servers themselves never hold.

This means that if someone, somehow obtained our database files, our backups or our server logs would contain nothing they could read. It also means that when we are required by law to hand material to a court or a competent authority, what we are able to hand over is the encrypted data, the database files and the logs – because that is genuinely all we have.

3.2 Who can read your data

The Property Boutique team in Spain: no access. Representatives, Independent Service Providers, sales, marketing and support staff cannot reach the personal data store at all.
Our Chief Security Officer: infrastructure only. The CSO administers the secure environment, manages backups and responds to lawful requests. The CSO can see that encrypted records exist and can hand them over when legally compelled – but cannot read their contents.
One named administrator: contact details only. A single named person can decrypt only the specific contact fields needed to reply to you, only when replying to you, in an authorised session that is logged.

Every access is recorded in a tamper-evident audit log and reviewed. There is no general-purpose administrative view of user data, because we have not built one.

3.3 Where your data lives

Personal data is held on a separate, hardened cloud server operated by Infinitech Worldwide Ltd. in the United Kingdom. It sits in a private network with no public ingress, is unreachable from the open internet, and is not discoverable or indexable from outside. The public website and the encrypted data store are architecturally separated, so an issue affecting the website cannot reach the data behind it.

3.4 Encryption in detail

In transit: the entire website and every user interface run over TLS 1.3 with modern cipher suites, HSTS enforced, and legacy protocols disabled. Our certificates create an encrypted connection and establish trust for the safety of user information.
At rest: stored data is encrypted with AES-256-GCM, using envelope encryption so that each record is individually protected.
Key custody: encryption keys are held separately from the encrypted data, in a dedicated key management service, under the sole custody of our Chief Security Officer. Keys are rotated on a defined schedule.
Passwords: account passwords are never stored. They are hashed with Argon2id, so that even we cannot recover them.

3.5 Our wider controls

Around that core we run a layered set of technical and organisational controls, including network isolation and private networking, least-privilege access with mandatory two-factor authentication for every privileged account, hardened server builds, continuous monitoring and intrusion detection, tamper-evident audit logging, encrypted and geographically separated backups with tested restores, continuous vulnerability scanning, independent penetration testing, a rehearsed incident response plan, and staff training. Our information security management is aligned to recognised standards including ISO/IEC 27001 and Cyber Essentials Plus.

We deliberately do not publish the fine detail of our architecture, because a published security design is a map for an attacker. If you have a legitimate reason to review our controls – as a business partner or in a due diligence process – contact us and we will discuss what we can share under an appropriate confidentiality agreement.

3.6 Our record

As of the date of this privacy update shown above, Infinitech Worldwide Ltd. has never suffered a personal data breach in more than 15 years of operating these services.

We keep that record through work rather than luck. We employ dedicated technical specialists whose job is to keep this platform secure and to stay ahead of the people trying to attack it, and we keep investing in that team and their tooling.

3.7 Your part

You can help us protect you: choose a strong, unique password, turn on two-factor authentication, never share your login details, and tell us at admin@propertyboutique.com straight away if you think someone else has reached your account.

4. What data we collect and why

We collect as little as possible, and only what a specific purpose actually requires.

4.1 Visitors to the website

When you visit the site we process technical data such as your IP address, browser type and version, device type, operating system, the pages you view and the time of your visit. We use it to serve the site, keep it secure and understand which pages are useful. We do not use it to build a profile of you.

4.2 Comments

When visitors leave comments on the site, we collect the data shown in the comment form, together with the visitor’s IP address and browser user agent string, to help with spam detection.

4.3 Account holders

If you register, we store the personal information you enter in your user profile – typically your username, email address and anything else you choose to add. You can see, edit and delete this information at any time. You cannot change your username yourself, but ask us and we can in most cases change it for you.

4.4 Property submissions and media

If you submit a property, we collect the details, documents and images you provide. Images uploaded through the property submission interface have a watermark embedded into them automatically, so that others refrain from using them elsewhere.

Anything you publish in a listing is public by design. Please keep private documents, identification numbers and images of identifiable people out of the public parts of a listing.

4.5 Verification documents

If you apply for a Verified Listing, we collect the identity and ownership documents that check requires – for example proof of identity, a Nota Simple, an energy certificate or a tourist licence number. They are held encrypted in the environment described in clause 3, are never published, and are deleted once the retention period in clause 9 expires. Only the fact that a listing is verified, and the date of the check, appears publicly.

4.6 Enquiries to professionals

If you ask to contact a professional, we process your name, contact details and the content of your enquiry in order to deliver it to the person you selected. See clause 2.2.

4.7 The AI Listing Assistant

If you choose to use our AI Listing Assistant, the text you enter into it needs to be processed. This works differently from the rest of the site and is explained fully in clause 6.

4.8 Security and anti-abuse

We operate our own anti-abuse and spam protection on our forms, so that protecting the site requires minimal sending of your information anywhere else. This processing looks at submission patterns and technical signals to distinguish genuine users from automated abuse. Certain parts of the site use third-party security and anti-spam services, including Google and Cloudflare, which process technical data to protect our website and users from malicious activity.

4.9 If you choose not to provide data

You can browse the entire site without giving us anything. If you leave out information marked as required on a form, we may not be able to create your account, publish your listing, complete a verification or deliver your enquiry.

5. Our legal bases

Under the UK GDPR and the EU GDPR we need a legal basis for each use of your data. Ours are:

Performance of a contract – running your account, publishing your listing, carrying out a verification, delivering an enquiry you asked us to send, providing the AI Listing Assistant, and taking payment.
Legitimate interests – keeping the platform and its users secure, preventing fraud and abuse, watermarking images to protect your intellectual property, answering your questions, and establishing or defending legal claims. We assess these interests against your rights, and you can object at any time.
Consent – non-essential cookies, saving your comment details in a cookie, and marketing email where you have opted in. You can withdraw consent whenever you like.
Legal obligation – records we are required by law to keep, and responses to lawful requests from courts or authorities.

6. The AI Listing Assistant

We provide an AI Listing Assistant that helps you write and improve property listings – drafting a description, tidying up wording, or suggesting improvements. It is genuinely useful, and it is the one part of the platform that works differently. We would rather tell you plainly than let you assume.

6.1 You are working with an AI system

The Assistant is an artificial intelligence system, not a person. Its suggestions are generated automatically and can be inaccurate or incomplete. Always read and correct what it produces before you publish. You remain responsible for the accuracy and legality of your listing, including compliance with property marketing rules such as Decreto 218/2005.

6.2 The Assistant sits outside the encrypted store – by design

The end-to-end encryption described in clause 3 works precisely because nothing can read your stored data. An AI model cannot help you rewrite text if it is unable to read. So the Assistant is kept deliberately separate: the text you type into it is processed by the AI system at Infinitech Worldwide Ltd. to generate your suggestion, and then returned to you.

We have made that channel as strong as it can be:

encrypted in transit with TLS 1.3;
governed by a written data processing agreement with zero data retention, so your input is not stored by the provider after your suggestion is generated;
configured so that your input is never used to train or improve any AI model;

Even so, this is one place where your text is handled outside of the local regular environment, and you should know that when you decide what to type. The public listing description is available to anyone on the internet, so all data saved upon completion will be public.

6.3 What to type, and what not to

Type the things you want to appear in your listing. Please do not type:

identification numbers of any kind – passport, NIE, NIF, DNI or national insurance numbers;
bank details, card numbers or financial information;
another person’s personal details – owners, tenants, guests or buyers – without their knowledge and consent;
the contents of contracts, deeds, Nota Simple extracts or other private documents;
anything confidential or sensitive, such as health information.

A simple test: if you would be comfortable seeing it in the published listing, it is fine to type.

6.4 What we do with it

We use your input only to generate the suggestion you asked for and to detect misuse of the tool. We do not keep prompts and suggestions for any period of time after you submit receive a response, it is removed immediately.

6.5 It is always optional

You never have to use the Assistant. You can simply write your listing yourself if you are concerned in any way about the data being precessed.

No-one.

We do not sell your personal data. We do not rent, trade or give it away. We do not pass it to advertisers, data brokers, marketing companies, analytics companies, affiliates or partners. We do not hand it to our own network of professionals. There is no commercial arrangement anywhere in our business that involves your personal data leaving us.

There are exactly three situations in which your information goes anywhere, and you control or can see all three:

7.1 When you tell us to

If you ask to be put in touch with a professional, we deliver your enquiry to the person you chose. You select them, we name them before you send, and it goes to them alone. See clause 2.2.

7.2 The AI Listing Assistant

If you choose to use it, the text you type is processed as described in clause 6. This is the only third-party processing of anything you type into our platform, it happens only when you use that specific tool, and it is under zero-retention, no-training terms.

7.3 When the law requires it

If we receive a valid order from a court or a competent authority, we comply. Because of clause 3.1, what we can produce is encrypted data, database files and logs. We will tell you about any such request unless we are legally prohibited from doing so.

7.4 A note on cookies and embedded content

If you consent to a non-essential cookie, or interact with content embedded from another website, that third party may collect information directly from your browser. That is a connection between you and them, made with your consent, and you can withdraw it at any time in your cookie preferences. It is not us passing on your data – we have nothing to do with what they collect, and we receive nothing from them in return. Clauses 12 and 13 explain this in full.

7.5 If this ever changes

If we ever needed to involve a supplier who would have access to personal data, we would name them in this policy before it happened, bind them by a written data processing agreement, and give you the choice where the law requires it.

8. Where your data is held, and why the UK

Your personal data is held on Infinitech Worldwide Ltd.’s own infrastructure in the United Kingdom. That was a deliberate choice, not an accident of where the company happens to be registered.

The UK has its own comprehensive data protection framework – the UK GDPR and the Data Protection Act 2018 – enforced by the Information Commissioner’s Office, one of the most active data protection regulators anywhere. The UK GDPR and the EU GDPR provide an essentially equivalent level of protection, and the European Commission has formally confirmed this: the renewed EU adequacy decisions for the UK were adopted on 19 December 2025 and run until 27 December 2031. Personal data therefore flows freely from the European Economic Area to the UK with no additional paperwork, safeguards or contractual mechanisms required.

Holding data under a single national framework also means one regulator, one set of rules and one clear line of accountability – which is exactly what we want when the answer to “who is responsible for this data?” needs to be unambiguous.

Your data does not leave that environment, except in the two situations you control: an enquiry you ask us to deliver, and the AI Listing Assistant if you choose to use it.

9. How long we keep your data

We delete what we no longer need.

Comments – kept with their metadata so we can recognise and approve follow-up comments automatically instead of holding them in a moderation queue. Deleted on request.
Account and profile data – kept while your account is open and for 1 year after you close it, then deleted.
Listings – kept while published and for 1 year afterwards.
Verification documents – kept for 1 year after the check, then securely deleted.
Enquiries – kept for 1 year in case a dispute arises.
AI Assistant prompts – see clause 6.4.
Payment and accounting records – 6 years, as UK tax law requires.
Security and access logs – 1 year.

Where the law requires us to keep a record for administrative, legal, tax or security reasons, we keep it for that period even if you ask us to delete it, and we will tell you when that applies.

10. Your rights

You have the right to:

Be informed about how we use your data – that is what this policy is for.
Access your data and receive an exported copy of everything we hold about you.
Rectification – have inaccurate data corrected and incomplete data completed.
Erasure – ask us to delete what we hold. This does not extend to data we are obliged to keep for administrative, legal or security purposes.
Restrict processing in certain circumstances, for example while we check the accuracy of something you have challenged.
Data portability – receive what you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where that is technically feasible.
Object to processing based on our legitimate interests, and to object to direct marketing at any time.
Withdraw consent at any time where we rely on it. This does not affect anything done before you withdrew it.
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. See clause 15.

If you have an account or have left comments, you can exercise many of these rights yourself from your profile. Otherwise email admin@propertyboutique.es. We respond within one month and usually much sooner. We may ask you to confirm your identity first, so that we never disclose your data to someone pretending to be you. Exercising your rights is free.

11. How to raise a concern

Come to us first. We would far rather hear about a problem and fix it than have you take it elsewhere, and clause 19 explains the priority service we give to privacy concerns.

You also have the right to complain to a data protection authority at any time:

United Kingdom: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF – ico.org.uk
Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid – aepd.es
Elsewhere in the EU: the supervisory authority where you live or work.

12. Cookies

If you leave a comment on our site you may opt in to saving your name, email address and website in cookies. These are for your convenience, so that you do not have to fill in your details again when you leave another comment. They last for one year.

If you have an account and you log in, our system sets a temporary cookie to determine whether your browser accepts cookies. It contains no personal data and is discarded when you close your browser.

When you log in, we also set several cookies to save your login information and your screen display choices. Login cookies last for two days and screen options cookies last for a year. If you log out, the login cookies are removed.

If you edit or publish an article, an additional cookie is saved in your browser. It includes no personal data and simply indicates the post ID of the article you just edited. It expires after one day.

We use Klaro to manage your cookie and tracking preferences. Review or change your choices at any time through ‘preferences’ in the cookie consent bar, or click here to manage your preferences. Nothing non-essential is set before you consent, and refusing is as easy as accepting.

13. Embedded content from other websites

Articles on this site may include embedded content such as videos, images or articles. Embedded content from other websites behaves exactly as if you had visited that website directly. Those sites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with the embedded content, including if you are logged in to that website. Their privacy policies govern that, not ours, and we receive nothing from them.

14. Marketing

We only send marketing email if you have asked for it. Every marketing email has a one-click unsubscribe, and you can opt out at any time by emailing info@propertyboutique.es. We never pass your address to anyone else to market to you. Opting out does not stop service messages about your account, listings or payments.

15. Automated decision-making and profiling

We do not make decisions about you by automated means alone that produce legal or similarly significant effects, and we do not profile you for advertising.

Our anti-abuse system automatically assesses whether a form submission is likely to be automated, and our comment system automatically screens for spam. If either blocks something in error, contact us and a person will review it.

The AI Listing Assistant generates text suggestions. It makes no decisions about you, and nothing it produces is published unless you choose to publish it.

16. Children

This website is intended for adults. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.

17. Our incident commitment

We have never had a data breach, and our team works to keep that fact correct. If an incident ever did occur, you would not have to chase us for information. We would:

contain and investigate it immediately;
notify the ICO, and any other supervisory authority required, within 72 hours where the law requires it;
tell you directly and without delay where an incident is likely to present a high risk to you – explaining plainly what happened, what data was involved, what we are doing, and what you should do;
publish what we learned and what we changed as a result.

18. Changes to this policy

We may update this policy. The current version is always published here with the date it took effect. If we make a significant change – a new purpose, a new recipient, anything that affects the promises in clause 1 – we will tell you directly before it takes effect, not quietly amend the page.

19. Contact us and privacy assistance

Email: info@propertyboutique.es
Contact form: click here
Post: Infinitech Worldwide Ltd. High Street, Sunninghill, Ascot, Berkshire, SL5 9NE.
Security concerns: admin@propertyboutique.es

We take the protection of your data and your privacy very seriously, and we employ technical specialists to counter any type of threat. That expertise is available to you, not just to us. If you raise a privacy or security concern, we prioritise it ahead of ordinary correspondence, investigate it properly, and come back to you with the information you need to satisfy yourself that your data is safe.

Our services are supplied in accordance with applicable law. See our Terms of Use for full details.

Property Boutique is a trading name of Infinitech Worldwide Ltd. a company registered in England and Wales.

Privacy Policy