Privacy Policy

1. Who we are

Casa24 (“Casa24”, “we”, “us”) is the property portal available at casa24.com, operated by TP Travel LTD (company no. GICO-117987-78), Suite 2, 260 Main Street, Gibraltar, where private owners, real estate agencies and developers advertise properties for sale, yearly rental and new construction in Spain and Portugal, and where visitors can search listings and contact advertisers.

TP Travel LTD is the data controller for the personal data described in this policy. For any privacy matter, contact us at privacy@casa24.com.

2. What data we collect

• Account data — name, email address, password (stored as a cryptographic hash), phone number, company name and role (buyer, private owner, agent, developer) when you create an account.
• Enquiry data — name, email address, phone number, your message and the listing, unit and request type (information, viewing, reservation) it concerns, including any viewing dates you propose, when you contact an advertiser through our forms.
• Listing data — the property details, photos, location and price you provide when you advertise.
• Usage data — saved searches, favourites, recently viewed listings, selected language and approximate location (derived from your IP address, e.g. to preselect your phone country code), plus technical logs (IP address, browser type, pages visited) needed to run and secure the service.
• Communications — messages exchanged with advertisers through the Casa24 inbox and emails we send you.

We do not knowingly collect data from children under 16 or special-category data.

3. Why we use your data and on what legal basis

• Providing the service (accounts, publishing listings, saved searches, favourites, the inbox) — performance of a contract, Art. 6(1)(b) GDPR.
• Forwarding your enquiry — when you submit an enquiry or reserve request, we share your name, email, phone number and message with the advertiser of that listing so they can respond — steps prior to entering into a contract, Art. 6(1)(b), and our legitimate interest in operating a marketplace, Art. 6(1)(f).
• Email alerts you configure (saved-search alerts, inbox notifications) — performance of a contract, Art. 6(1)(b); you can switch them off in your account or via the unsubscribe link in every email.
• Direct marketing — see section 4.
• Security, fraud prevention and service improvement — legitimate interest, Art. 6(1)(f).
• Legal obligations (accounting, responding to authorities) — Art. 6(1)(c).

4. Marketing

When you create an account or submit an enquiry, we may use your email address and phone number to send you marketing about Casa24 and about properties, projects and services similar to those you showed interest in — for example new listings matching your search, price changes, or launches by developers in areas you enquired about. We rely on our legitimate interest in marketing our own and our advertisers’ comparable services to existing contacts (Art. 6(1)(f) GDPR and the “existing customer” rule of the ePrivacy rules as implemented in Spain and Portugal); where the law requires consent instead, we will ask for it.

• You can opt out at any time, free of charge: every marketing email contains an unsubscribe link, marketing SMS/calls state how to opt out, and you can always write to privacy@casa24.com or disable communications in your account settings.
• Opting out of marketing does not affect service emails you have requested.
• We never sell your personal data.

5. Who we share data with

• Advertisers — the owner, agency or developer behind a listing receives the enquiry data you submit about that listing. They act as independent controllers of that data once received.
• Service providers (processors) — hosting and content delivery (Vercel), database hosting (Neon, EU region), email delivery (Resend), automatic translation of listing descriptions (Anthropic — receives the listing text, not visitor data) and an approximate IP-based location lookup used to centre the map. Map tiles are loaded from OpenStreetMap and CARTO, which receive your IP address as part of the request; place search (OpenStreetMap/Nominatim) receives the search text, not your identity. Processors are bound by data-processing agreements under Art. 28 GDPR.
• Authorities — where required by law.

Where providers process data outside the EU/EEA, transfers are protected by adequacy decisions or the European Commission’s Standard Contractual Clauses, with supplementary measures where needed (Arts. 44–49 GDPR).

6. How long we keep data

• Account data — for the life of your account and up to 12 months after deletion.
• Enquiries and inbox messages — up to 24 months after the last interaction, so both sides keep a record of the exchange.
• Marketing preferences and opt-outs — kept as long as needed to honour them.
• Technical logs — up to 12 months. Data needed for legal claims or obligations may be kept for the applicable limitation periods.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (“right to be forgotten”, Art. 17);
• restrict processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest, and object to direct marketing at any time — marketing objections are always honoured (Art. 21);
• withdraw any consent at any time, without affecting prior processing (Art. 7(3));
• not be subject to solely automated decisions with legal effect (Art. 22) — Casa24 does not carry out such decision-making.

To exercise any right, email privacy@casa24.com. We respond within one month. You also have the right to lodge a complaint with your supervisory authority — in Portugal the CNPD (cnpd.pt), in Spain the AEPD (aepd.es), or the authority of your habitual residence.

8. Cookies and similar technologies

We only use cookies and browser storage needed for the site to work and to remember your choices: the sign-in session and security cookies, your language, the last city you searched, and — stored only in your browser — recently viewed listings, recent searches and display preferences. We do not use advertising or analytics cookies. The cookie banner records your choice; you can clear these cookies and stored data at any time in your browser settings.

9. Security

We apply appropriate technical and organisational measures (Art. 32 GDPR): encrypted connections (TLS), hashed passwords, role-based access, EU-region data hosting and the principle of least privilege. No system is 100% secure; if a breach is likely to result in a risk to you, we will notify the supervisory authority and, where required, you, in line with Arts. 33–34 GDPR.

10. Changes to this policy

We may update this policy as the service or the law evolves. Material changes will be announced on the site or by email. The date above shows the latest revision. This policy is drafted in English; translations are provided for convenience, and in case of any discrepancy the English version prevails.

See also our Terms & Conditions and Legal notice.