Privacy & Cookies
Last updated: 11 October 2026.
This notice explains how we handle information when you visit ashandkey.com or contact Ash & Key.
Who Is Responsible
Ash & Key is operated by Schellhammer Brokerage, S.L., CIF B93210375, at CC San Roque Club, Local 3D, 11360 San Roque, Cádiz, Spain. Schellhammer Brokerage, S.L. is responsible for the personal information described here.
To ask a privacy question or exercise your rights, use our contact form and start your message with “Privacy request”, or write to the postal address above.
Your Enquiry
Our forms ask for your name, email address and message. A property enquiry also includes the relevant property reference. We use these details to respond and handle the request you have made. Please provide only information relevant to your enquiry; do not include identity documents, bank details or other sensitive information.
Where you ask about engaging our services, the legal basis is taking steps at your request before entering a contract. For other correspondence, our legitimate interest is responding to enquiries about our business. Providing the required form fields is necessary for us to receive and answer your enquiry. Analytics consent is optional and does not affect the form.
Submitting this form does not subscribe you to a mailing list. The website does not make automated decisions about you with legal or similarly significant effects.
Website Security and Service Providers
The website uses form checks and a short-lived submission limit to reduce spam. Hosting, network and email services process technical information needed to deliver the website and your message, such as connection details and service logs. The form uses an IP-derived identifier for its 15-minute submission limit.
Your enquiry is delivered to the Ash & Key enquiry inbox. Authorised people handling enquiries and the service providers supporting the website and email may process it for these purposes. Any further sharing needed to arrange a viewing or progress a transaction should be explained when that service is arranged.
Service-provider categories include website hosting, network security, email delivery and storage, and website maintenance. These services may involve processing in other countries. Where personal information is transferred outside the European Economic Area, the applicable transfer arrangement must provide the protection required by data protection law, such as an adequacy decision or appropriate contractual safeguards. You may contact us for information about the safeguards relevant to your data.
Optional Analytics
If you choose “Accept Analytics”, we use Google Analytics to measure visits, property views and successful enquiries. It receives technical and browsing information, including cookie identifiers, page visits and the property’s catalogue reference. Our tracking code does not send form names, email addresses or message contents to Google, and removes query strings and fragments from the page and referrer addresses it sends.
Analytics runs only after your consent. You can reject it or withdraw permission through “Cookie Settings” at the bottom of any page. Withdrawal stops further analytics collection in that browser; it does not undo earlier lawful processing. Our implementation disables Google Signals and advertising personalisation.
Google may process data outside the European Economic Area. See Google’s Privacy Policy and how Google uses information from partner sites. Google describes its use of adequacy frameworks and, where applicable, Standard Contractual Clauses in its international data transfer information.
Cookies
- ak_analytics: a first-party preference cookie remembering whether you accepted or rejected analytics, for up to six months.
- _ga and _ga_*: first-party cookies used by Google Analytics after consent to distinguish browsers and understand visits. Our implementation sets a maximum lifetime of 13 months.
- ak_lead_receipt: after a successful enquiry with analytics consent, a first-party cookie lasting up to five minutes connects that success to one analytics event. Its server-side receipt is consumed once to avoid counting a page refresh as another lead.
You can also delete cookies through your browser settings. Clearing the preference cookie means we will ask for your choice again. Administrative sign-in cookies, where applicable, are separate from the public visitor experience.
How Long We Keep Information
Our retention policy is to keep enquiry information while it is needed to answer your request and manage any resulting property search, viewing or client relationship. Once that purpose ends, information should be deleted or anonymised unless it is needed to meet a legal obligation or establish, exercise or defend a legal claim. Relevant criteria include whether the enquiry is still active, whether a transaction or dispute is ongoing, and applicable statutory retention or limitation periods.
Cookie lifetimes are listed above. They are separate from Google Analytics server-side retention: aggregated reports may remain available after individual event records expire. Technical security records and backup copies are subject to their separate operational retention cycles and access restrictions.
Your Rights
Subject to the applicable conditions, you may request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. You may withdraw consent at any time. We may ask for proportionate information to verify your identity before fulfilling a request.
You can complain to the Spanish Data Protection Agency (AEPD), or to another competent data protection authority. You do not have to contact us first.
Changes
We will update this notice when our website or handling of information changes. The date above identifies the latest version.