Privacy Notice

1. Who is responsible

Shane Fullwood, a UK-based sole trader trading as Costa Bridge, is the controller of the personal information described here. Costa Bridge is not a limited company. For all privacy questions and requests, email hello@costabridge.co.uk.

Postal address: Unit J, Digby Studios, Digby Street, Ilkeston, Derbyshire, DE7 5TG, United Kingdom. ICO registration number: 00016055836.

Businesses listed in the directory are independent. When they receive your enquiry or you contact them directly, they are responsible for their own use of your information under their own privacy notices.

2. Information we collect

• Enquiries and service requests: your name, email, optional telephone number, message, service interest, move plans and the source page or link associated with your enquiry. We also keep relevant correspondence and the permission recorded by a contact form.
• Clients: answers to our onboarding questionnaires, practical information about your household and relocation plans, reports, delivery records and payment references. Provide only what is necessary for your agreed service.
• Provider accounts: business details, owner/account email, account and listing identifiers, claim and sign-in records, profile changes and support correspondence. We send service emails such as sign-in links, claim invitations and relevant profile reminders.
• Public profiles and properties: business names, descriptions, public contact details, service areas, links, photographs, property descriptions, prices, features and the location information chosen for publication. Published information can be indexed by search engines and copied by others. Account email, unpublished drafts, internal review notes and optional discovery answers are not public profile fields.
• Provider feedback and portal messages: optional answers about how you found us, why you joined, where your business is based and services you are interested in; your latest note; portal message drafts and delivery records. Owners can update or clear their discovery answers. Portal delivery is not a read receipt or email marketing permission.
• Recommendations: when you recommend a local business, your name, email, the town, the business and what you wrote. We may email you to confirm it, and we review it before it appears. Your name is shown with it only if you choose, and your email is never published.
• Residents' stories: when you share your story of moving to Spain, your first name, email, town, the optional details you add (part of town, where you moved from, the year and how long you have lived there), your answers, any voice notes and an optional photo. We publish your answers, lightly edited, with your first name and town on our website and our social media (including quotes in posts and videos) only because you agree to it, and your photo only if you tick that box; your email is never published. Voice notes are typed out by a transcription service and the recordings are deleted once your story is published or turned down. Every story email has a link to take your story down at any time, which also deletes your answers, voice notes and photo.
• Newsletter and resources: your email, optional name, signup source and subscription record when you choose to join a mailing list or request a resource. A service enquiry or directory signup does not itself subscribe you to a newsletter.
• Security and use of the website: hosting request logs, technical information and temporary IP-based rate limits help us prevent abuse. Optional visitor statistics are explained below.

We receive information directly from you, from an authorised representative, and sometimes from public business websites or public listings when preparing a directory entry. Contact us to ask about the source, correct an entry or request its removal. Required form fields are marked; without them we may be unable to answer, create an account or deliver the requested service.

3. Why we use it

• Contract or steps you request before a contract: answering service requests, delivering purchased work, managing provider accounts and publishing the listings you ask us to host.
• Legitimate interests: handling general questions, reviewing listings, preventing fraud and spam, maintaining business records, responding to complaints and improving our directory using voluntary business feedback. We consider your interests and you can object to processing on this basis.
• Consent: publishing a resident's story, optional newsletters and optional browser analytics. You can withdraw consent at any time without affecting earlier lawful use. Withdrawing marketing or analytics consent does not close your provider account.
• Legal obligations: keeping required tax records and responding to valid legal requirements.

We do not sell personal information. We do not make decisions producing legal or similarly significant effects about you solely through automated processing.

4. Enquiries, publication and sharing

A directory or property enquiry is stored by Costa Bridge and reviewed so it can be passed to the named business. Your name, message and supplied contact details may be shared with that business to answer your request. This does not permit unrelated marketing. If you use a direct phone, website or WhatsApp link, you contact the business through that separate service.

We publish only the profile and listing information intended for public display after review. Check contact details and location settings before submitting; do not upload private documents or photographs you lack permission to publish. Removing a listing does not immediately remove copies held by search engines or other websites.

We ask before sending your personal details to a partner professional or estate agent for an introduction. If you use that partner, Costa Bridge may earn a referral fee; it never changes what you pay. We may also disclose information where required by law or necessary to establish or defend legal claims.

5. Systems and service providers

We use service providers to operate Costa Bridge, including:

• Directus hosted on Railway: website content and operational records, including enquiries, provider accounts, listings, portal messages and subscriptions.
• Vercel: website hosting, security and operational logs, file storage and, if you allow it, Web Analytics and Speed Insights.
• Resend and Zoho Mail: automated service emails, delivery records and business correspondence.
• Fillout: our earlier client questionnaires. New questionnaires are Costa Bridge's own forms and are stored in Directus; answers already given through Fillout may remain there until they are deleted.
• Stripe: payment processing where a payment service is offered and you choose to use it. We do not store full card details. Planned directory subscriptions are not automatically activated by signing up.
• AI model providers (Nous Portal, with OpenRouter as a fallback): Admin drafting and research tools process text and page context that staff submit. If you ask for a free Readiness Review, your questionnaire answers are sent to an AI model, which drafts your review from Costa Bridge's own guides; unusual answers hold the review for a person to check before anything is sent, and you can ask for a person to look at any review. The review is preparation guidance and does not decide your entitlement to any service or immigration outcome. Sensitive client documents should not be entered into these tools.
• ElevenLabs: types out voice notes sent with residents' stories, and reads scripts aloud for our videos. It receives the recording, not your email address.
• Adobe Fonts and image delivery services: loading fonts and images can disclose technical request information such as your IP address to the hosting service.

External links and embedded services have their own privacy notices. Earlier records may remain in legacy business systems such as Airtable while they are reviewed or migrated; new website operational records use Directus.

Some suppliers operate internationally, including in the United States. International transfers require an applicable adequacy decision or other lawful safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, and EU safeguards where applicable. Contact us for information about the suppliers and transfer arrangements relevant to your records.

7. How long we keep information

• General enquiries and correspondence: our retention policy is up to 24 months after last meaningful contact, unless a continuing service, complaint or legal requirement justifies longer retention.
• Provider accounts, listings and portal records: while the account or listing is in use, and afterwards only as needed to resolve enquiries, prevent abuse, meet legal duties or handle disputes. You can request closure or removal by email. Archiving a listing hides it from the public; it is not the same as deleting its records.
• Paid work: necessary contract and service records may be retained for up to seven years to handle contractual matters. Tax records must be kept for the applicable statutory period; for UK Self Assessment this is normally at least five years after the relevant 31 January submission deadline. This does not mean every questionnaire answer needs to be kept for that long.
• Residents' stories: while your story is published, until you take it down or ask us to. If we don't publish a story, we delete your answers, voice notes, photo and email when we decide, keeping only your first name and town as a record that it was received. Stories are for adults: please don't send one if you are under 18.
• Newsletter: while subscribed. After you opt out, a minimal suppression record may be retained to avoid contacting you again.
• Technical records: session and preference lifetimes are stated above. Security logs follow the hosting service settings. Aggregate statistics may be kept longer where they no longer identify a person.

Retention depends on the purpose, sensitivity and any outstanding legal obligation. Removal requests are reviewed individually; deletion is not always automatic when an account or listing becomes inactive. Residual copies may remain in restricted backups until those backups are replaced.

8. Sensitive information and security

Please do not send passport scans, bank statements, medical details, criminal convictions, access codes or information about children that is unnecessary for your request through general forms, listing uploads or portal messages. If an onboarding question invites sensitive details, skip it and contact us. Volunteering sensitive information does not by itself establish a lawful basis for us to use it; any necessary special handling must be agreed separately with the required legal conditions and safeguards.

We use access controls, signed sessions and encrypted website connections. Access is limited to authorised people and suppliers supporting the service. No system can guarantee absolute security. We will handle and report personal data breaches as required by law.

9. Your rights and complaints

Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your information, object to processing based on legitimate interests, and withdraw consent. Email hello@costabridge.co.uk. We normally respond within one month; we may need proportionate identity checks and will explain if a lawful extension or exception applies.

To stop newsletters, reply asking to unsubscribe or email us. Provider email preferences and necessary account/security messages are separate. You can change analytics choices above.

You can complain to the UK Information Commissioner’s Office, or to your local data protection authority where applicable, including the Spanish AEPD. You do not have to complain to us first.

10. Changes to this notice

We update this notice when the service or our data handling changes and show the revision date above. Where a material change requires an additional notice or fresh consent, we will provide it. Our Terms of Service explain service boundaries and directory responsibilities.