Privacy Policy

The controller within the meaning of the GDPR is:

Personal data is only processed when you actively submit it through one of the forms, contact me by email or messenger, or where technical access data is unavoidably logged.

a) Contact form

• Name
• Email address
• Preferred language
• Message (optional)

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (pre-contractual steps).

Purpose: To handle and answer your enquiry.

Retention: Until the exchange is completed, at most 24 months after the last contact; deletion afterwards unless statutory retention obligations apply.

b) Viewing request

• Name
• Email address
• Phone number (optional)
• Up to three preferred slots
• Message (optional)
• Preferred language

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (pre-contractual steps at your request).

Purpose: To arrange the on-site viewing in Escazú and send a confirmation.

Retention: Up to 24 months after the appointment or the end of the enquiry.

c) Rental enquiry

Name, email address, phone number (optional), desired start/term of the lease, message and preferred language.

Legal basis: Art. 6(1)(a) and (b) GDPR.

Retention: Up to 24 months after the enquiry ends if no lease is concluded.

d) Exposé and checklist downloads

On download, the selected language, file category and your browser's User-Agent string are stored – without your IP address – to analyse language usage anonymously.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in aggregated, non-personal reach measurement).

Retention: Up to 24 months in anonymised form.

e) Contact by email, phone and WhatsApp

If you contact me by email, phone or WhatsApp, your details (e.g. name, number, email address, message content) are processed to handle your enquiry – legal basis: Art. 6(1)(b) or (f) GDPR. With WhatsApp, processing additionally takes place at WhatsApp Ireland Ltd.; use is voluntary, email and the forms are available as alternatives.

f) Server and access logs

The hosting provider processes technical access data (IP address, timestamp, requested resource, referrer, user agent) to deliver, secure and stabilise the website. Legal basis: Art. 6(1)(f) GDPR. This data is not combined with form submissions and is deleted after 30 days at the latest.

The following service providers act as processors under Art. 28 GDPR for operation, storage and email delivery:

• Lovable (hosting & deployment) – Provision and delivery of the website (EU / USA)
• Supabase (database & file storage) – Storage of form submissions, photos, videos and documents (EU (data centre), support possibly USA)
• Cloudflare – Content delivery and edge protection (EU / USA)
• Resend / Lovable Email – Delivery of confirmation and notification emails (EU / USA)
• Google Ireland Ltd. (Google Maps) – Map display – loaded only after an explicit click (Ireland / USA)
• WhatsApp Ireland Ltd. – Optional contact via messenger (Ireland / USA)

Data is never sold or passed on for advertising. Web fonts are served locally from this server, with no connection to Google servers. No payment service providers are used.

This site uses no marketing cookies, no tracking pixels, no ad networks and no analytics services such as Google Analytics or the Meta Pixel. Only technically necessary browser storage (LocalStorage) is used, e.g. to remember your language choice and your entries in the area calculator. Such storage is exempt from consent under § 25(2) no. 2 TDDDG, so no cookie banner is required.

Fonts (Cormorant Garamond, Inter) are loaded locally from this server. Your IP address is not transmitted to Google Fonts.

The Google Maps map uses a two-click solution: it only loads after you explicitly activate it. Only then is data (including your IP address) transmitted to Google Ireland Ltd. and possibly to the USA. Legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time with effect for the future by not activating the map or reloading the page. Videos are served exclusively from this server; there are no YouTube or Vimeo embeds.

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR) – without affecting the lawfulness of prior processing

To exercise your rights, an informal message suffices to info@sandralochmann.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Deutschland

Additional rights for prospects in Costa Rica (Ley 8968)

For data subjects residing in Costa Rica, the rights under Costa Rican data protection law Ley N.º 8968 “Protección de la Persona frente al tratamiento de sus datos personales” and its regulation (Decreto 37554-JP) apply in addition to the GDPR rights. I grant these rights equally:

• Right of access to the personal data stored about you (Art. 7 Ley 8968)
• Right to rectification of inaccurate or incomplete data
• Right to erasure of data that is no longer necessary
• Right to withdraw consent at any time (Art. 5 Ley 8968)
• Right to information on purpose, recipients and retention period
• Right to lodge a complaint with the supervisory authority PRODHAB

Supervisory authority: Agencia de Protección de Datos de los Habitantes (PRODHAB), Ministerio de Justicia y Paz, San José, Costa Rica.

An informal message — also in Spanish — is sufficient to exercise these rights: info@sandralochmann.com.

Where data is transferred to providers in third countries (in particular the USA), this is based on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and – where recipients are certified under the EU-U.S. Data Privacy Framework – on the adequacy decision under Art. 45 GDPR. Additional technical measures such as transport encryption are applied.

No AI system that you interact with is used on this website: there is no chatbot, no voice or speech recognition, no transcription, no sentiment or emotion analysis, no automated matching and no AI-based recommendation feature. Your form entries are not transmitted to AI providers and are not used to train AI models. No automated decision-making, including profiling, with legal effect within the meaning of Art. 22 GDPR takes place. Should individual visuals exceptionally be AI-generated or AI-edited, they are labelled “AI-generated” directly at the image; all property photos and videos are unedited recordings of the property. Information on this website does not constitute legal, tax, medical or financial advice.

This privacy policy is updated when the law, the services used or the data processing change. The current version is always available on this page.