Last updated: November 2026
This policy explains how your personal data is processed when you use this website or contact us, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: Denise Nava (Heroes by Denise Nava / Heroes Coaching)
- Tax ID: Y3289707P
- Address: Alicante, Spain
- Email for privacy requests: denise.nava@expglobalspain.com
For real estate transactions carried out through eXp Realty España S.L. (Tax ID B42756742, Alicante, Spain), that company may also process your data under its own privacy policy.
2. What data we collect and why
- Enquiries (WhatsApp, email, contact or booking forms): name, contact details and the content of your message, to answer you and provide the service you request. Legal basis: your consent and pre-contractual measures.
- Services (real estate, photography, coaching): the data needed to deliver the service, such as contact details, property details, photographs or session information. Legal basis: performance of a contract.
- Purchases of digital products: billing details and payment data processed by our payment provider. We do not store your card number. Legal basis: contract and legal obligations (tax and accounting).
- Newsletter and emails: your email address and name, to send information and offers you have asked for. Legal basis: your consent, which you can withdraw at any time.
- Website analytics and advertising: online identifiers and browsing data collected through cookies and similar technologies, only after you accept them. See the Cookie Policy. Legal basis: your consent.
We do not ask for health data or other special categories of data. If you choose to share sensitive information during a coaching session, it is treated confidentially and used only for that session.
3. Who receives your data
We do not sell your data. We share it only with service providers who help us run the website and our services, under data processing agreements where required. Depending on how you interact with us, these may include: web hosting; email marketing (Kit); payments (Stripe); analytics and tag management (Google); advertising measurement (Meta); website behaviour analysis (Hotjar); review display (Trustindex); messaging (WhatsApp); booking tools; push notifications (OneSignal); and translation tools. We may also share data with public authorities when the law requires it, and with professionals involved in your transaction, such as notaries or lawyers, when you ask us to.
4. International transfers
Some providers are based outside the European Economic Area, mainly in the United States. In those cases, transfers rely on safeguards recognised by the GDPR, such as the EU-US Data Privacy Framework or standard contractual clauses.
5. How long we keep your data
We keep your data only as long as needed for the purpose it was collected: enquiries until they are resolved and for a reasonable period afterwards; client data for the duration of the service and the legal limitation periods; accounting records for the period required by tax law; and newsletter data until you unsubscribe.
6. Your rights
You can request access, rectification, erasure, restriction of processing, portability and objection, and you can withdraw your consent at any time without affecting earlier processing. Write to the email address above, attaching proof of identity. If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.
7. Minors
This website is not aimed at children under 14, and we do not knowingly collect their data. Where photography services involve minors, a parent or guardian must give consent.
8. Security
We apply reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access.
9. Changes to this policy
We may update this policy to reflect changes in the law or in our services. The date at the top shows the latest version.