Privacy Policy

Last updated: 15 November 2026

1. Who is responsible for your information?

Yes Costa S.L., CIF B-27573831, Calle Gabriel Miró 31B, 03181 Torrevieja, Alicante, Spain, operates MLSBASE.com and is the controller for its own account, subscription, contact and platform administration activities. Contact: contact@mlsbase.com.

This policy applies to website visitors, business customers, their representatives and individuals whose information is processed in connection with the platform. Business-only subscriptions do not remove individuals' privacy rights.

For personal data that a customer places in the CRM solely for that customer's purposes, the customer is the controller and MLSBASE acts as processor. The processing terms are included in our Terms and Conditions. If your request concerns a business using our CRM, you can contact that business or contact us so we can direct the request appropriately.

2. Information, purposes and legal grounds

Account and subscription information includes names, business contact details, organisation and tax details, authorised users and selected services. We use this to provide and manage the service. The legal ground is performance of a contract where the individual is the contracting customer, or our legitimate interest in delivering and administering business services where the individual represents an organisation.

Billing information includes invoice details, transaction and subscription references, payment status and refund records. We use this to collect payments and maintain required records, based on contract performance and legal accounting obligations. Card payments are processed through Stripe. Do not send full credit card details by email.

Support information includes correspondence and relevant information you provide. We use it to respond and resolve issues, based on contract performance or our legitimate interest in responding to enquiries and supporting customers.

Security information includes IP addresses and necessary access, device and incident information. Our legitimate interest is protecting systems, accounts and users, investigating incidents and preventing misuse. Collection is limited to what is necessary for these purposes.

Listing information may include property details, photographs and relevant business contact information obtained from participating providers and authorised source websites. We process it to import, update, translate and distribute authorised advertisements. The legal ground is contract performance where the individual is a party, or a legitimate interest in lawful business publication, subject to necessity and the individual's rights. A content licence does not by itself authorise every use of personal information. Unnecessary personal details or identifiable persons in images must be excluded or appropriately protected where publication is not justified.

Contract, licence and referral records include acceptance dates, versions, source websites and information needed to attribute and administer rewards. We process these to perform agreements and for our legitimate interests in establishing what was agreed and preventing fraud.

Optional analytics and marketing tracking may process identifiers, device and browser data, pages visited, interaction and conversion information and other data transmitted by the enabled tool. We use consent for these optional purposes. The Cookie Policy and cookie controls explain the available choices.

Required account and billing details are necessary to provide paid services. Refusing optional tracking does not cancel your subscription. Please do not submit identity documents, buyers' banking information or sensitive personal data through advertisements or ordinary support channels.

We receive information from you, your organisation, use of our services, payment providers and authorised listing sources. Where information about an individual is received indirectly, we provide the legally required information unless a lawful exception applies. You can ask us for the source of information concerning you.

Authorised advertisements may be available to platform users and through permitted feeds and participating websites. Non-public account, payment and CRM information is not made public merely because a provider supplies listings.

Service providers receive information necessary for their functions. Advisers, authorities and other recipients receive information only where there is an appropriate legal basis, for example to comply with a legal obligation or establish, exercise or defend legal claims.

4. Providers and international processing

IONOS provides website hosting, database hosting and email services. Our website and database servers are located in Spain. This does not mean all email, backup, support or other supplier processing takes place in Spain.

Stripe processes payments, recurring subscriptions and refunds. Its activities may involve processing outside the EEA, including the United States. Stripe may act as an independent controller for its own legal, payment security and fraud prevention purposes. Its privacy information is available at https://stripe.com/privacy.

Anthropic's Claude website is used only for advertisement content, not CRM leads, identity documents or payment details. Advertisement content can nevertheless contain personal information. We limit inputs to necessary information that we are entitled to process. Our content licence does not authorise general-purpose AI training. Anthropic's own processing depends on the service and settings used and can involve processing outside the EEA, including the United States. Its privacy information is available at https://www.anthropic.com/legal/privacy.

Google Analytics is used for website analytics only with the relevant consent. Google's services may involve international processing, including in the United States. Privacy information: https://policies.google.com/privacy.

The Meta/Facebook pixel is used for marketing and conversion measurement only with the relevant consent. Meta may link received information with its own information in accordance with its policies and may process information internationally, including in the United States. Where joint controllership applies to collection and transmission through Meta Business Tools, the applicable arrangement governs those activities; Meta's subsequent processing is subject to its own responsibilities. You may contact us or Meta concerning your rights. Information about the allocation of responsibilities is available on request. Meta privacy information: https://www.facebook.com/privacy/policy/.

Our WPLP cookie facility manages cookie choices. The cookie settings identify relevant technologies and any associated recipients.

For transfers outside the EEA, an applicable GDPR transfer mechanism is required. Depending on the recipient and activity, this can be an adequacy decision, including applicable certification under the EU-US Data Privacy Framework, or European Commission standard contractual clauses together with necessary assessments and additional safeguards. A provider's general participation in a framework does not automatically cover all processing. Contact contact@mlsbase.com for information about recipients and the safeguards applicable to your data, including how to obtain a copy where relevant.

5. Retention and deletion

Active account, CRM and platform data are kept for the service period. Following ordinary cancellation, the affected active data is deleted at the end of the paid term. After unresolved non-payment, deletion follows the seven-calendar-day recovery period. Timely requests for return of customer data are handled before final destruction.

Active listings are removed when their sale, withdrawal, rights restriction or end of permitted use is processed. Records needed for legal compliance or evidence do not authorise continued commercial publication.

Invoices, accounting entries and required business records are generally retained for six years from the last relevant accounting entry under Spanish commercial recordkeeping rules. Particular legal obligations, interrupted limitation periods or ongoing proceedings may require longer retention of relevant records.

Support, complaint, contract and licence records are kept as needed to resolve the matter and then only as justified by applicable legal obligations and limitation periods. Security logs are kept only as necessary for protection, investigation and relevant evidence. Retention is assessed according to the specific purpose and risk; data is not kept indefinitely for undefined future purposes.

Backups remain restricted during the applicable recovery cycle and are phased out. Deleted data is not restored for normal use without reapplying deletion instructions. Supplier deletion and backup cycles may differ from deletion in our active systems.

Cookie lifetimes and information about the applicable technologies are available through the cookie settings. Evidence of consent is retained only as necessary to demonstrate and manage the choices made.

For a valid, sufficiently verified erasure request, our service commitment is to remove information that may lawfully be erased from our active systems within 24 hours. If identity verification, a legal retention duty or action by an external provider affects this timeframe, we explain the limitation and applicable response. This is not a promise that all supplier systems or backup copies will be erased within 24 hours.

6. Your rights

Subject to applicable conditions, you can request access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time.

Where we rely on consent, you can withdraw it without affecting the lawfulness of earlier processing. Use the cookie controls to change tracking choices or email contact@mlsbase.com for other requests. We verify identity proportionately; do not send a full identity document unless specifically and lawfully required through an appropriate process.

We respond without undue delay and normally within one month. Where a lawful extension is necessary, we explain it within that first month. You may complain to the Spanish Data Protection Agency, AEPD, at https://www.aepd.es, or another competent supervisory authority.

7. Security and automated processing

We apply measures appropriate to the risks to protect confidentiality, integrity, access and recoverability. No system can guarantee absolute security.

Automated import and AI-assisted advertisement processing are used to prepare and present listings. They are not intended to make decisions about individuals producing legal or similarly significant effects. Any introduction of such decision-making would require an appropriate legal basis and additional information about its operation and safeguards.

8. Updates and contact

We update this policy when relevant processing changes and provide additional notice where required. The date above identifies this version. For privacy enquiries or requests, email contact@mlsbase.com.