Privacy Notice
1. Controller
The controller responsible for the processing of personal data in connection with this website is:
GM-Prosale GmbH
Birkenkamp 13
49214 Bad Rothenfelde
Germany
Email: casa@secretparadisegroup.com
Project name: Secret Paradise Group
2. Website Operation
When you access this website, technical information required to deliver, secure and operate the website may be processed. This may include your IP address, date and time of access, requested pages, browser information and technical connection data.
This processing is necessary to provide and secure the website and to detect technical problems or misuse.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of this website.
Technical log data is retained only for as long as necessary for these purposes, unless a longer retention period is required by law or necessary in connection with a security incident.
3. Contact by Email
If you contact us by email, we process the information you provide in order to review and respond to your enquiry.
Depending on the nature of the enquiry, processing is based on Article 6(1)(b) GDPR where it concerns steps taken at your request prior to a possible transaction, or Article 6(1)(f) GDPR where processing is necessary for our legitimate interest in handling business enquiries.
Your information is retained only for as long as necessary to process the enquiry and any subsequent discussions, subject to statutory retention requirements.
4. Acquisition Enquiry Form
If you submit an acquisition enquiry through the website, we process the information you provide.
This may include:
- your name;
- email address;
- organisation, where voluntarily provided;
- your role in the enquiry;
- the stage of your acquisition interest; and
- the type of information you are interested in.
The information is used to review, qualify and respond to enquiries concerning the possible acquisition of Casa Verde Cliff Resort & Spa.
Where explicit consent is requested before submitting an enquiry, processing based on that consent is carried out pursuant to Article 6(1)(a) GDPR.
Where processing is necessary in connection with steps requested by you prior to a possible transaction, Article 6(1)(b) GDPR may also apply.
Consent may be withdrawn at any time with effect for the future by contacting:
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Casa Verde Private Acquisition Assistant
This website provides the Casa Verde Private Acquisition Assistant, an AI-supported chat function designed to answer questions about Casa Verde Cliff Resort & Spa and the acquisition process.
When you use the Assistant, the messages you enter and technical information required to operate the chat are processed in order to generate and provide responses.
The Assistant uses technical services for workflow automation and artificial-intelligence processing, including services provided through n8n and OpenAI.
Please do not enter sensitive personal information, identification documents, passport information, bank details or confidential financial documents into the chat.
The Assistant may use information provided during the conversation to support internal qualification and routing of an acquisition enquiry.
Any such classification is used only as an internal review aid. It does not constitute an automated decision producing legal or similarly significant effects. Human review remains authoritative.
Using the chat alone does not submit an acquisition enquiry.
Where the Assistant offers an enquiry-submission process, information is submitted only after the relevant qualification steps and the required explicit confirmation have been completed.
Processing required to provide the conversational service is based on Article 6(1)(f) GDPR, reflecting our legitimate interest in providing an efficient information and enquiry service.
Where explicit consent is requested for submission of an acquisition enquiry, Article 6(1)(a) GDPR applies to that submission.
6. Session Storage and Technically Necessary Functions
The website uses limited browser storage where this is necessary to provide functions requested by the visitor.
This may include:
- temporary storage of chat messages during the current browser session;
- a temporary chat session identifier;
- the page from which the Assistant was opened; and
- temporary storage used to restore the visitor's page position.
These items are used for website functionality and are not used for advertising, behavioural profiling or cross-site tracking.
Session-based information is generally removed when the browser tab or session is closed.
Personal invitation links may additionally use short-lived technical identifiers required to provide the personalised invitation and related enquiry process.
7. Cookies and Tracking
The public website currently does not use advertising cookies, marketing tracking, behavioural analytics or session-recording technologies.
No Google Analytics, Google Tag Manager, Meta Pixel or comparable marketing or analytics service is currently used.
Website fonts and icons are hosted locally and are not loaded from external font providers.
Technically necessary cookies or similar technologies may be used where required to provide a function expressly requested by the visitor or to ensure the secure technical operation of the website.
If optional analytics, advertising or other non-essential tracking technologies are introduced in the future, this Privacy Notice and any required consent mechanism will be updated accordingly.
8. Service Providers and Recipients
We use technical service providers where necessary to operate the website and provide its enquiry and chat functions.
Depending on the relevant processing activity, these may include providers of:
- website and application infrastructure;
- database services;
- workflow automation;
- artificial-intelligence services; and
- email and communication infrastructure.
Personal data is processed only to the extent required for the relevant service.
Where personal data is processed outside the European Economic Area, appropriate safeguards required under applicable data-protection law are used where necessary.
9. Retention
Personal data is retained only for as long as necessary for the purpose for which it was collected.
Enquiry and communication data may be retained for the duration of the acquisition review and any subsequent discussions.
Data may be retained for a longer period where required by statutory retention obligations or where necessary to establish, exercise or defend legal claims.
Where consent is withdrawn and no other legal basis or retention obligation applies, the relevant personal data will be deleted.
10. Your Rights
Subject to the applicable legal requirements, you may have the right to:
- obtain information about personal data processed about you;
- request correction of inaccurate personal data;
- request deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive personal data in a portable format where applicable; and
- withdraw consent at any time where processing is based on consent.
You also have the right to lodge a complaint with a competent data-protection supervisory authority.
To exercise your rights, please contact:
11. Changes to this Privacy Notice
This Privacy Notice may be updated if the website, enquiry process, technical services or applicable legal requirements change.
Last updated: 29 October 2026