🔒 Legal

Privacy & Cookie Policy

Last updated: March 2025 · Finance Consulting Group S.L. · Málaga, Spain

Your privacy matters to us. This policy explains what personal data Finance Consulting Group collects, why we collect it, how we use and protect it, and what rights you have under the EU General Data Protection Regulation (GDPR) and Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD, Ley Orgánica 3/2018).

1. Data Controller

The data controller responsible for your personal data is:

Finance Consulting Group S.L.
Esperanto 11, 29007 Málaga, Spain
Email: info@financeconsultingroup.com
Phone: +34 657 111 073

We do not currently have a designated Data Protection Officer (DPO) but handle all data protection queries directly. You may contact us at the address above for any data-related request.

2. Scope of This Policy

This policy applies to personal data collected through our website at financeconsultingroup.com and any subdomains thereof. It does not apply to third-party websites that may be linked from our site. We encourage you to review the privacy policies of those sites separately.

3. Legal Bases for Processing

We process personal data under the following legal bases set out in Article 6 of the GDPR:

Consent (Art. 6(1)(a)): For optional cookies (analytics, marketing) and for processing your contact form submission. You may withdraw consent at any time.
Legitimate interests (Art. 6(1)(f)): For essential website security logging and fraud prevention, where our interests do not override your rights.
Legal obligation (Art. 6(1)(c)): Where Spanish or EU law requires us to retain certain records.
Performance of a contract or pre-contractual steps (Art. 6(1)(b)): When you request a mortgage consultation, we process your data to take steps at your request prior to entering a contract.

4. Data We Collect and How

4.1 Website Visit Data

When you browse our website, our hosting provider automatically records standard server log data, which may include your IP address, browser type, operating system, pages visited, date and time of access, and the referring URL. This data is used solely for security and technical diagnostics and is not used to identify you personally.

4.2 Contact Form Submissions

When you submit our contact form, we collect: your first and last name, email address, phone number (optional), enquiry type, and any message you choose to include. This data is transmitted via FormSubmit.co (see Section 7) to our email inbox and is used only to respond to your enquiry.

4.3 Cookie Consent Records

When you interact with our cookie consent banner, we record your decision (accepted all / declined all / custom preferences), the timestamp, your IP address, approximate geographic location (country, city), your browser user-agent string, and internet service provider. This log is retained as evidence of consent under GDPR requirements.

4.4 Cookies and Similar Technologies

See Section 5 below for full details of all cookies we use.

5. Cookies

Cookies are small text files placed on your device by your browser. We also use localStorage and sessionStorage (browser-based storage that works similarly to cookies). The table below lists all storage items used by this website:

Name	Type	Category	Purpose	Duration
`fcg_consent_v3`	localStorage	Essential	Stores your cookie consent preferences so you are not asked again on each visit.	Persistent (until cleared)
`wa_shown`	sessionStorage	Essential	Prevents the WhatsApp chat bubble from appearing more than once per browser session.	Session only
`_ga`, `_ga_*`	Cookie	Analytics	Google Analytics — used to distinguish users and measure website traffic and behaviour anonymously.	Up to 2 years
`_fbp`	Cookie	Marketing	Facebook Pixel — used to measure the effectiveness of advertising and track conversions from Facebook ads.	3 months

Analytics and Marketing cookies are only set if you give your consent. Essential cookies are set automatically as they are strictly necessary for the website to function.

Manage your cookie preferences at any time:
You can review or change your cookie choices by clicking the button below. Your preferences are stored locally in your browser and can also be cleared by deleting your browser's local storage or cookies.

6. How We Use Your Personal Data

We use the data we collect for the following purposes:

To respond to mortgage, service, and general enquiries submitted via our contact form or WhatsApp.
To provide you with a mortgage consultation and, where applicable, to take steps toward arranging mortgage products or related financial services on your behalf.
To understand how visitors use our website and to improve content, navigation, and user experience (Analytics, with consent).
To measure the effectiveness of marketing campaigns (Marketing, with consent).
To maintain records of data processing activities and consent as required by GDPR.
To comply with our legal and regulatory obligations under Spanish and EU law.

We will never sell, rent, or trade your personal data with third parties for their own marketing purposes.

7. Data Sharing and Third-Party Processors

We share your data only where necessary and with appropriate safeguards in place. The third parties who may receive your data are:

FormSubmit.co — a form-handling service that transmits contact form submissions and consent logs to our email. FormSubmit acts as a data processor on our behalf. Data is transmitted over TLS-encrypted connections. For more information, see formsubmit.co/privacy.
ipapi.is — a geolocation API used at the moment of your cookie consent to retrieve your approximate location (country and city) and ISP, for consent-logging purposes. No personal data is sent to this service; it processes your IP address to return approximate location data. See ipapi.is/privacy.html.
Google Analytics (if consented) — website analytics service operated by Google Ireland Ltd. Google may transfer data outside the EEA; this is subject to standard contractual clauses. See Google's Privacy Policy.
Meta (Facebook) Pixel (if consented) — advertising measurement tool operated by Meta Platforms Ireland Ltd. Meta may transfer data outside the EEA under standard contractual clauses. See Meta's Data Policy.
Mortgage lenders and banking partners — if you proceed to a mortgage application, we will share the personal and financial data necessary to complete your application with the relevant lender(s). We will inform you which lender(s) your data will be shared with before doing so.
Legal and regulatory authorities — we may disclose data if required to do so by law, court order, or regulatory authority (e.g., AEPD, CNMV, Banco de España).

8. International Data Transfers

Your personal data is stored and processed primarily within the European Economic Area (EEA). Where data is transferred to countries outside the EEA (for example, through Google Analytics or Meta Pixel), such transfers are made subject to appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) as provided for under Article 46(2)(c) GDPR.

9. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law:

Contact form submissions: Retained for up to 24 months from the date of receipt, unless an ongoing client relationship requires longer retention.
Cookie consent logs: Retained for 36 months as required to evidence compliance with GDPR consent obligations.
Client mortgage files: Retained for a minimum of 5 years after the end of the client relationship, in accordance with Spanish anti-money laundering (AML) regulations (Ley 10/2010).
Server logs: Automatically deleted by our hosting provider after 30 days.

10. Your Rights Under GDPR

Under Articles 15–22 of the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15): You may request a copy of the personal data we hold about you.
Right to rectification (Art. 16): You may ask us to correct inaccurate or incomplete data.
Right to erasure (Art. 17): You may request deletion of your data ("right to be forgotten"), subject to any legal retention obligations.
Right to restriction of processing (Art. 18): You may ask us to pause processing of your data in certain circumstances.
Right to data portability (Art. 20): Where processing is based on consent or a contract, you may request your data in a structured, machine-readable format.
Right to object (Art. 21): You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent (Art. 7(3)): Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Right not to be subject to automated decision-making (Art. 22): We do not use automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, please contact us at info@financeconsultingroup.com. We will respond within one month (extendable by a further two months in complex cases, with notice). We may need to verify your identity before processing your request.

11. How We Protect Your Data

We take reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

All data in transit is encrypted using TLS (HTTPS).
Access to contact form submissions is restricted to authorised personnel only.
We do not store payment card data or other sensitive financial data on our website.
Our website does not store form submissions locally — they are transmitted directly via email.

No method of data transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Children's Privacy

Our website and services are not directed at persons under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly.

13. Links to Third-Party Websites

Our website may contain links to external websites operated by third parties (for example, LinkedIn, Facebook). We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing any personal data.

14. Changes to This Policy

We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of our website after any changes constitutes acceptance of the updated policy.

15. Complaints and Supervisory Authority

If you have a complaint about how we handle your personal data and are not satisfied with our response, you have the right to lodge a complaint with the competent supervisory authority:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
Web: www.aepd.es
Phone: +34 901 100 099

If you are located in another EU Member State, you may also contact your local data protection authority.

16. Contact

For any questions, concerns, or requests relating to this Privacy & Cookie Policy or the personal data we hold, please contact:

Finance Consulting Group S.L.
Esperanto 11, 29007 Málaga, Spain
Email: info@financeconsultingroup.com
Phone: +34 657 111 073 | +34 626 327 588