Privacy & cookie Policy

Last updated: 9 August 2026

This Privacy & Cookie Policy explains how Málaga, Sorted. (“we”, “us” or “our”), collects, uses, stores and protects personal data when you visit https://www.malagasorted.com, contact us, book a consultation, purchase a service or otherwise interact with us.

We are committed to handling personal data lawfully, fairly, transparently and securely in accordance with applicable data-protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (“LOPDGDD”), and other applicable Spanish laws.

PRIVACY POLICY

1. Who We Are

Trading name: Málaga, Sorted.

Data Controller: Khushbu Lakhani

Address: Calle San Miguel 1 y 3, 29620 Torremolinos, Málaga, Spain
Email: hello@malagasorted.com
Website: https://www.malagasorted.com

Málaga, Sorted provides relocation, settling-in, concierge, property-support and lifestyle-coordination services for individuals and families moving to, visiting, living in or owning property in Málaga and selected areas of the Costa del Sol.

2. Scope of This Policy

This policy applies to personal data processed through:

• our website;
• website contact and enquiry forms;
• email, telephone and WhatsApp communications;
• consultation and booking systems;
• relocation questionnaires and client onboarding;
• paid services and packages;
• newsletters and marketing communications;
• communications with professionals, suppliers and referral partners; and
• any other interaction connected with our services.

It does not govern the independent processing activities of lawyers, tax advisers, immigration professionals, estate agents, schools, healthcare providers, contractors, payment providers or other third parties. Those organisations may act as separate data controllers and will have their own privacy policies.

3. Personal Data We May Collect

The information we collect depends on how you interact with us and which services you request.

Information you provide directly

We may collect:

• your full name;
• email address;
• telephone or WhatsApp number;
• home address and current country of residence;
• nationality or citizenship;
• preferred language;
• planned moving or travel dates;
• details of the area in which you wish to live;
• property preferences, requirements and budget;
• details of adults and family members involved in a relocation;
• information concerning children where relevant to school or family relocation support;
• school preferences and educational requirements;
• vehicle, household, property-management or lifestyle requirements;
• details contained in enquiries, forms, emails and messages;
• consultation notes;
• information required to deliver a bespoke service;
• feedback, reviews and complaint information; and
• any other information you voluntarily provide.

Identification and administrative information

Where necessary for an agreed service, we may process information contained in documents such as:

• passports or identity documents;
• NIE or TIE documentation;
• residency-related documents;
• proof of address;
• appointment confirmations;
• forms and supporting administrative documents; and
• documents required by an independent professional or public authority.

We will only request identification or administrative documents when reasonably necessary for the agreed service.

Payment and transaction information

We may collect:

• billing name and address;
• invoice details;
• tax-identification information where legally required;
• details of the service purchased;
• payment status;
• transaction date and amount; and
• records of refunds or disputes.

Payments may be processed by an independent third-party payment provider. We do not ordinarily receive or store complete debit or credit card details.

Information concerning other people

You may provide information about a spouse, partner, child, family member, employee, tenant, guest or another person involved in your request.

You are responsible for ensuring that you have authority to provide that information and, where appropriate, that the person has been informed about this policy.

Information received from third parties

We may receive your personal data from:

• a family member or representative acting on your behalf;
• an estate agent, relocation consultant or referral partner;
• a lawyer, tax adviser, immigration professional or other adviser;
• a contractor, supplier or service provider;
• a business or employer arranging relocation support; or
• publicly accessible sources where appropriate and lawful.

Where required, we will inform you that we have received your information and explain its source.

Information collected automatically

When you use our website, certain technical information may be collected automatically, including:

• IP address;
• approximate location derived from your IP address;
• device type;
• browser type and version;
• operating system;
• referral source;
• pages viewed;
• date and time of access;
• time spent on the website;
• interactions with website features; and
• cookie or similar technology identifiers.

More information is provided in the Cookie Policy section below.

4. How We Use Personal Data

We may process personal data to:

• respond to enquiries;
• assess how we may be able to assist you;
• arrange and deliver consultations;
• prepare proposals, service plans and quotations;
• enter into and administer client agreements;
• provide relocation, settling-in, concierge and property-support services;
• research areas, schools, properties and relevant local services;
• coordinate property viewings, school visits, appointments and household services;
• communicate with professionals and suppliers at your request;
• introduce you to appropriate independent service providers;
• organise bookings, reservations, deliveries and appointments;
• manage payments, invoices, refunds and accounting;
• maintain client and service records;
• provide customer support;
• manage complaints and disputes;
• improve our website and services;
• protect our website, systems, clients and business from misuse or fraud;
• comply with tax, accounting, legal and regulatory duties;
• establish, exercise or defend legal claims;
• request feedback or reviews;
• send newsletters or promotional communications where permitted; and
• manage cookie preferences and website analytics.

We will not use personal data for purposes that are incompatible with those described in this policy unless permitted or required by law.

5. Legal Bases for Processing

We rely on one or more of the following legal bases.

Steps before entering into a contract

We may process information to respond to an enquiry, understand your requirements, prepare a proposal or arrange a consultation at your request.

Performance of a contract

We process information where necessary to enter into or perform an agreement with you, including coordinating and delivering the services you purchase.

Legal obligations

We may process and retain information where necessary to meet tax, accounting, invoicing, consumer-protection and other legal obligations.

Legitimate interests

We may process information where necessary for our legitimate business interests, provided that those interests are not overridden by your rights and interests.

These interests may include:

• managing and improving our services;
• maintaining records of enquiries and client communications;
• protecting the security of our website and systems;
• preventing fraud or misuse;
• managing our professional network;
• handling complaints;
• establishing or defending legal claims; and
• communicating with existing clients about closely related services where legally permitted.

Consent

We rely on consent where required, including for:

• non-essential cookies;
• certain marketing communications;
• processing special-category information where no other lawful condition applies; and
• sharing information in circumstances where your specific permission is appropriate.

You may withdraw consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Legal claims and vital interests

In exceptional circumstances, information may be processed where necessary to protect a person’s vital interests or to establish, exercise or defend legal claims.

6. Information Required to Provide Our Services

You are not generally required to provide personal data merely to browse our website.

However, certain information will be necessary for us to:

• respond meaningfully to a request;
• provide a quotation;
• enter into an agreement;
• issue an invoice;
• coordinate an appointment or service; or
• perform the service you have purchased.

Where required information is not provided, we may be unable to provide some or all of the requested service.

7. Children’s and Family Information

Our website and services are intended to be purchased by adults aged 18 and over.

We do not knowingly invite children to contact us directly, create accounts or purchase services.

However, relocation and school-search services may require a parent or legal guardian to provide limited information concerning a child, including:

• name;
• age or date of birth;
• school year;
• language requirements;
• educational preferences;
• school history;
• accessibility requirements; or
• other information relevant to the family’s relocation.

We will only process information about a child where reasonably necessary for the requested service and where it has been provided or authorised by a parent, guardian or other person legally entitled to act on the child’s behalf.

Please do not provide more information about a child than is necessary. In particular, sensitive educational, health or identification documents should not be sent through ordinary website forms or informal messaging unless we have specifically requested them and explained an appropriate method of transmission.

8. Sensitive and Special-Category Data

In limited circumstances, you may provide information concerning:

• health or disability;
• accessibility requirements;
• dietary or allergy information;
• religious requirements relevant to a school search;
• biometric data where processed for the purpose of uniquely identifying a person; or
• other sensitive personal circumstances.

We do not routinely request this information.

Where it is genuinely necessary to provide an agreed service, we will process it only where an appropriate legal condition applies, which may include your explicit consent.

Please do not provide sensitive information unless it is relevant and necessary. Where possible, we will minimise, redact or securely delete unnecessary sensitive information.

9. Professional Introductions and Third-Party Services

Málaga, Sorted may introduce or connect clients with independent third parties, including:

• estate agents and property professionals;
• lawyers;
• immigration professionals;
• tax advisers and accountants;
• gestors;
• mortgage brokers;
• schools and education providers;
• healthcare providers;
• insurance providers;
• removal and shipping companies;
• builders, electricians, plumbers and other contractors;
• cleaners and property-maintenance providers;
• vehicle rental or sales providers;
• boat, travel and leisure providers;
• restaurants and hospitality businesses; and
• other local suppliers.

We will only share information that is reasonably necessary for the introduction or requested service.

Where appropriate, we will ask for your permission before sharing your personal data with an independent professional or supplier.

Independent third parties are responsible for their own services and data-processing practices. You should review their privacy information before providing documents or entering into an agreement with them.

10. Who We Share Personal Data With

We do not sell personal data.

We may share personal data with:

• website-hosting and website-management providers, including GoDaddy;
• email, communications and cloud-storage providers;
• customer-support and website-chat providers, including Re:amaze;
• booking and scheduling platforms;
• payment processors and banks;
• accounting and invoicing providers;
• analytics and cookie-consent providers;
• marketing and newsletter platforms;
• professional advisers, including accountants and lawyers;
• independent professionals and suppliers required to fulfil your request;
• public authorities where necessary to provide an authorised service;
• regulators, courts, law-enforcement bodies or other authorities where legally required;
• insurers and professional advisers in connection with a complaint or claim; and
• a purchaser or successor if the business is sold, transferred or reorganised.

Service providers acting on our behalf may only process personal data for the agreed purposes and subject to appropriate contractual and security obligations.

11. WhatsApp and Other Communications Platforms

Where you choose to communicate with us through WhatsApp or another third-party platform, your use of that platform is also governed by the provider’s own terms and privacy policy.

Please avoid sending passports, financial records, sensitive health information or other highly confidential documents through WhatsApp unless specifically requested and an appropriate method has been agreed.

We may retain relevant business communications where necessary to provide the service, maintain an accurate record or protect our legal interests.

12. International Data Transfers

Some of the technology providers we use, including GoDaddy and Re:amaze, may process or store personal data in the United States or other countries outside the European Economic Area.

Where personal data is transferred internationally, we will take reasonable steps to ensure that an appropriate legal safeguard is in place.

Depending on the circumstances, this may include:

• a European Commission adequacy decision;
• approved standard contractual clauses;
• additional contractual, technical or organisational safeguards; or
• another lawful transfer mechanism permitted under the GDPR.

You may contact us for further information about the safeguards used for relevant international transfers.

13. Data Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting and reporting obligations.

As a general guide:

• enquiry information may be retained for up to 12 months after the last meaningful communication, unless you become a client or request earlier deletion;
• unsuccessful proposals and consultation records may be retained for up to two years where reasonably necessary for record-keeping or dispute management;
• client service records may be retained for the duration of the relationship and afterwards for the period reasonably necessary to manage legal claims and professional obligations;
• contracts, invoices, accounting records and supporting business documentation may be retained for up to six years or for any longer period required by law;
• marketing information is retained until you unsubscribe, withdraw consent or the information is no longer reasonably required;
• cookie-consent records may be retained for as long as necessary to demonstrate and respect your preferences; and
• identification documents and sensitive information will be deleted or securely restricted when no longer necessary for the specific service or a legal obligation.

We may retain limited information for longer where necessary to establish, exercise or defend legal claims, comply with a legal obligation or respond to an official investigation.

When information is no longer required, it will be securely deleted, anonymised or restricted from further use.

14. Marketing Communications

We may send newsletters, relocation guides, business updates and promotional communications where:

• you have expressly opted in;
• you are an existing client and the communication concerns similar services, where permitted by law; or
• another lawful basis applies.

You may unsubscribe at any time by:

• using the unsubscribe link in an email; or
• contacting hello@malagasorted.com.

Unsubscribing from marketing will not prevent us from sending essential communications concerning a booking, contract, payment or service.

We do not purchase unrelated marketing lists or sell contact details to advertisers.

15. Automated Decision-Making

We do not currently use personal data to make solely automated decisions that produce legal effects or similarly significant effects concerning you.

If this changes, we will update this policy and provide the information required by law.

16. Data Security

We use reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• alteration;
• misuse;
• disclosure; and
• destruction.

These measures may include access controls, password protection, secure systems, limited staff or contractor access, data minimisation, secure deletion and appropriate provider agreements.

No website, email system or method of electronic storage can be guaranteed to be completely secure. You should take care when sending confidential documents electronically and contact us if you believe your information may have been compromised.

17. Your Data-Protection Rights

Subject to the conditions and exceptions provided by law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing;
• withdraw consent at any time;
• request portability of certain information;
• obtain information about relevant international-transfer safeguards; and
• lodge a complaint with a supervisory authority.

To exercise a right, contact:

Email: hello@malagasorted.com
Address: Calle San Miguel 1 y 3, 29620 Torremolinos, Málaga, Spain

Please state which right you wish to exercise and provide sufficient information for us to identify the relevant records. We may request reasonable proof of identity before responding. We aim to respond within the period required by applicable law.

You also have the right to complain to the Spanish Data Protection Agency:

Agencia Española de Protección de Datos (AEPD)
Website: www.aepd.es

We would appreciate the opportunity to address your concern directly before you submit a complaint, although you are not required to contact us first.

18. Third-Party Websites

Our website may contain links to independent websites, platforms or service providers.

We do not control those websites and are not responsible for their privacy, security or cookie practices. You should review the relevant third party’s privacy information before providing personal data.

COOKIE POLICY

19. What Cookies Are

Cookies are small files or pieces of information stored on your computer, mobile phone or other device when you visit a website.

Cookies and similar technologies can enable a website to function, remember preferences, understand how visitors use the website and support advertising or marketing activities.

Some cookies may involve the processing of personal data, such as an IP address, device identifier or information about browsing activity.

20. Types of Cookies We May Use

Strictly necessary cookies

These cookies are required for the website to operate or to provide a feature requested by the visitor.

They may be used for:

• website security;
• network management;
• navigation;
• saving cookie preferences;
• completing forms;
• booking functions;
• shopping-cart or payment functions; and
• other essential website operations.

These cookies do not ordinarily require consent where they are used solely for a strictly necessary purpose.

Preference or functionality cookies

These cookies remember choices such as language, location or display preferences.

Where a preference is specifically requested by the user and used only to provide that feature, consent may not be required. Other preference cookies will only be used where permitted by law.

Analytics cookies

Analytics cookies help us understand matters such as:

• how visitors find the website;
• which pages they visit;
• how long they remain on a page;
• which links or features they use; and
• whether technical errors occur.

Non-essential analytics cookies will not be placed unless you provide consent.

Marketing and advertising cookies

Marketing cookies may be used to:

• measure the effectiveness of advertising;
• understand visitor interests;
• limit repeated advertisements;
• build audiences; or
• display more relevant advertising on third-party platforms.

These cookies will only be used where you have provided consent.

Third-party cookies

Some website features may be supplied by third parties, including:

• website-hosting providers;
• analytics services;
• maps;
• embedded videos;
• booking calendars;
• social-media features;
• payment tools; and
• advertising platforms.

These providers may place their own cookies or collect information when you interact with their features.

Additional analytics and marketing technologies

We may use additional analytics or marketing technologies, including Google Analytics and the Meta Pixel, where these have been enabled on our website. Where consent is required, these technologies will only operate after you have accepted the relevant cookies through our cookie banner.

21. Cookies Currently Used

Our website is built and hosted using GoDaddy Websites + Marketing. The website currently uses cookies and similar technologies associated with the operation of the website, visitor measurement and cookie-preference management, including:

_scc_session
Provider: GoDaddy
Purpose: Supports website session and core site functionality
Duration: Session / short-term

_tccl_visit
Provider: GoDaddy
Purpose: Helps measure website visits and performance
Duration: Approx. 30 minutes

_tccl_visitor
Provider: GoDaddy
Purpose: Helps distinguish visitors for aggregated website statistics
Duration: Approx. 1 year

cookie_warning_dismissed
Provider: GoDaddy / Málaga, Sorted.
Purpose: Records that the cookie notice has been dismissed or declined
Duration: Approx. 60 days

cookie_terms_accepted
Provider: GoDaddy / Málaga, Sorted.
Purpose: Records that the visitor has accepted the cookie terms
Duration: Approx. 60 days

dps_site_id
Provider: GoDaddy
Purpose: Supports website hosting, routing and performance
Duration: Session

x-visitor-id
Provider: GoDaddy
Purpose: Provides a visitor identifier used by website functionality after cookies are accepted
Duration: Approx. 60 days

rmz.*
Provider: Re:amaze
Purpose: Supports website chat and customer-service functionality
Duration: Persistent

We may also use Google Analytics, the Meta Pixel or other analytics and marketing technologies where these have been enabled. Where these technologies require consent, they will not operate until you have accepted the relevant cookies through our cookie banner. 

The cookies used by our website may change as website features, integrations or service providers are added or updated. We review this information periodically and update this policy where appropriate.

22. Cookie Consent

When you first visit the website, you will be shown a cookie notice or consent-management tool.

Except for strictly necessary cookies, optional cookies will only be activated after you have made a choice where consent is legally required.

The cookie banner provides clearly visible options to accept or decline optional cookies. Rejecting optional cookies is intended to be as straightforward as accepting them.

Your consent choices will be recorded so that the website can respect your preferences.

23. Changing or Withdrawing Cookie Consent

You may withdraw or change your consent to optional cookies at any time by adjusting your browser settings to block or delete cookies already stored on your device.

When you next visit our website after deleting the relevant cookies, the cookie banner will be displayed again so that you can make a new choice.

Withdrawing consent does not affect the lawfulness of any processing carried out before consent was withdrawn.

Please be aware that blocking strictly necessary cookies may affect the operation of certain parts of the website.

24. Cookie Duration

Cookies may be:

• session cookies, which expire when you close your browser; or
• persistent cookies, which remain on your device for a specified period or until deleted.

The duration of each cookie currently used by our website is shown above.

Consent will be requested again where required by law, where the cookies or purposes materially change, or after an appropriate period.

25. Changes to This Policy

We may update this Privacy & Cookie Policy to reflect:

• changes to our services;
• new website tools or providers;
• changes in how we process personal data;
• legal or regulatory developments; or
• improvements to our privacy practices.

The updated policy will be published on this page with a revised “Last updated” date.

Where a change materially affects how we use personal data, we will provide additional notice where appropriate.

26. Contact Us

For questions about this policy, the use of your personal data or your cookie preferences, contact:

Khushbu Lakhani, trading as Málaga, Sorted.
Calle San Miguel 1 y 3
29620 Torremolinos
Málaga, Spain

Email: hello@malagasorted.com
Website: https://www.malagasorted.com