Privacy Policy
What CasaViva Costa collects, why it is needed, who may receive it, and how you stay in control.
- Responsible operator
- CasaViva Costa · Manu Jacobsinfo@casavivacosta.com
Who is responsible for your data?
CasaViva Costa uses personal data only to run the service you request, meet legal duties, keep the website secure, and—with a separate valid basis—send communications you choose to receive.
- Controller
- Manu Jacobs, trading as CasaViva Costa
- NIF/NIE
- Y8461516Z
- Activity
- Real estate intermediation and related property services
- Professional attention point
- Partida Lomas GP.2, 197, 03340 Albatera (Alicante), Spain
CasaViva Costa operates from a professional address in Albatera, with client attention at that address by prior appointment. It is not presented as an exclusively online-only or exclusively telematic service.
The data we use
The exact data depends on what you ask us to do. We do not require every category for every visitor.
- Contact and preferences
- Name, email, telephone, language, messages, budget, preferred locations, property criteria, and communication choices.
- Account and security
- Login and account details, saved homes, alerts, session continuity, access and security events, and anti-abuse signals.
- Property and transaction
- Property, ownership, valuation, viewing, reservation, mandate, payment, invoice, KYC, and supporting document information when relevant.
- Communication and assistant
- Email delivery events, newsletter choices, assistant messages, page context, requested actions, human hand-off, and service notes.
For a holiday stay, legally required traveller details may be requested. CasaViva Costa does not ask you to upload or store a copy of your identity document through the public guest form.
Why we use data and how long it remains
We apply the shortest relevant period rather than one indefinite period for everything. A legal hold, dispute, fraud investigation, or binding duty may require restricted retention for longer.
Property and service enquiries
- Data
- Contact details, language, messages, property preferences, budget, and appointment or follow-up context.
- Purpose
- Answer the request, recommend suitable options, arrange viewings, prepare a valuation, and support buying, selling, or renting.
- Legal basis
- Steps requested before a contract, performance of a contract, and legitimate interests in coherent client service.
- Retention
- While the request or client relationship is active, then only for applicable limitation, evidence, and defence periods.
Where an enquiry came from
- Data
- The page on which you sent the enquiry, the domain of the website or app that referred you, campaign tags in the page address (such as utm_source), and ad click identifiers (such as gclid or fbclid).
- Purpose
- See which channels bring real enquiries, so we invest in what helps buyers find us. Nothing is stored on your device for this.
- Legal basis
- Legitimate interests in measuring our own marketing.
- Retention
- Kept with the enquiry it belongs to and deleted with it.
Visit statistics
- Data
- Which pages are visited, the referring website, country, browser and device type, and how fast pages load. Cloudflare Web Analytics measures this without cookies and without storing anything on your device.
- Purpose
- See which pages help visitors and keep the website fast.
- Legal basis
- Legitimate interests in running and improving our website.
- Retention
- Detailed measurements for 7 days, then only aggregated statistics, available for up to six months.
Accounts, security, and saved homes
- Data
- Account identity, login and security events, preferred language, saved homes, alerts, and account settings.
- Purpose
- Provide the account, keep it secure, synchronise requested features, and prevent unauthorised access or abuse.
- Legal basis
- Performance of the user service and legitimate interests in security and service continuity.
- Retention
- For the life of the account, followed by deletion or restricted retention where a legal or claims period still applies.
Newsletter and relevant recommendations
- Data
- Email address, name, language, consent evidence, stated preferences, and first-party interactions where allowed.
- Purpose
- Send requested market updates and make property recommendations more relevant without third-party advertising profiles.
- Legal basis
- Consent. You can unsubscribe or object at any time.
- Retention
- Until unsubscribe, withdrawal, or objection; limited consent evidence may be retained for accountability.
Digital assistant and human hand-off
- Data
- Your messages, language, current page, conversation context, requested actions, and contact details only when you provide them.
- Purpose
- Understand your question, search CasaViva Costa information, use relevant calculators, carry out confirmed actions, and involve a team member when requested.
- Legal basis
- Your request, steps requested before a contract, and legitimate interests in efficient support.
- Retention
- Conversation records are kept only for continuity, follow-up, security, and claims needs. Useful account preferences may remain until changed, removed, or the account is deleted.
Transactions, documents, invoices, and compliance
- Data
- Property, ownership, identity, payment, reservation, mandate, visit, invoice, and compliance information relevant to the matter.
- Purpose
- Verify parties and property information, prepare and administer the transaction, meet tax and accounting duties, and comply with anti-money-laundering rules where applicable.
- Legal basis
- Requested pre-contractual steps, contract performance, legal obligations, and legitimate interests in transaction administration and defence of claims.
- Retention
- According to the document and legal duty. Commercial documentation is generally retained for six years; AML records may require ten years.
Holiday-rental requests and stays
- Data
- Reservation and guest details, stay information, and the traveller data legally required for lodging registration.
- Purpose
- Handle the reservation, prepare the stay agreement, administer the stay, and make legally required lodging reports.
- Legal basis
- Requested pre-contractual steps, contract performance, and legal obligations under the applicable lodging rules.
- Retention
- Operational requests follow the related claims period. Where the statutory lodging register applies, required register data is retained for three years after the stay.
Required fields are needed to provide the requested service or meet a legal duty. Optional fields may be left blank. A privacy acknowledgement records that this notice was made available; it is not marketing consent. Marketing choices remain separate and optional.
Digital assistant, AI, and automated support
The CasaViva Costa assistant is identified as an AI assistant. It first determines the type of request, then uses only the relevant website, property, account, or calculator context needed to respond. It may use OpenAI through CasaViva Costa’s server and may transfer the conversation to a team member when you ask for human help or the request requires it.
- The assistant can search inventory, explain site content, run available calculators, and prepare an action for your confirmation.
- Actions with a real effect are subject to the same account, permission, validation, and confirmation rules as the website.
- Calculator and assistant results are indicative; important legal, tax, mortgage, or transaction decisions require professional verification.
- The website does not make solely automated decisions that produce legal or similarly significant effects for you.
For signed-in users, useful non-secret preferences may be stored with the account to improve continuity. Anonymous visitors are remembered only through the active conversation and browser session unless they choose to provide contact details or request follow-up.
Who may receive data
Authorised CasaViva Costa staff and suppliers receive only the information needed for their role. Data may also be shared with an owner, developer, agent, lawyer, notary, bank, insurer, tax adviser, public authority, or other transaction professional when necessary for the specific service, law, or transaction.
- Hosting, database, and application delivery
- Render; Cloudflare R2Operate the website, database, media storage, backups, and secure content delivery.
- Security and human verification
- CloudflareProtect forms, accounts, and infrastructure against abuse and automated attacks.
- Email and mailbox services
- Postmark; MicrosoftDeliver service and newsletter email, process delivery events, and support mailbox follow-up.
- AI-assisted functions
- OpenAIPower enabled assistant, translation, search-normalisation, and content-support functions.
- Property inventory sources and professional partners
- Authorised property feeds, developers, owners, agents, and advisers involved in a requestProvide inventory information and perform the specific property or transaction service requested.
Where personal data is processed outside the European Economic Area, an applicable transfer mechanism is used, such as an adequacy decision or European Commission standard contractual clauses with supplementary safeguards where required. You may request information about the safeguard that applies to your data.
Property publication, rentals, and data from others
When an owner authorises marketing, approved property details, photographs, and videos may be published on CasaViva Costa channels and authorised portals. Identity documents, signatures, financial information, and private contact details are not listing content. Public maps use an approximate location unless an exact location is intentionally authorised for publication.
For lodging services, required registration data may be disclosed to Spain’s competent security authorities. Where the statutory register applies, the legally required register data is retained for three years after the service ends.
Information may also come from a co-buyer, owner, developer, representative, professional partner, or public source connected with a request. Where Article 14 GDPR requires a separate notice, it will be provided unless a lawful exception applies.
The website is not directed at children. Information about a minor is processed only where an adult provides it for a legally relevant stay or transaction and only to the extent needed for that purpose.
How we protect information
CasaViva Costa uses role-based access, secure sessions, two-factor protection for privileged access, encrypted transport, rate limits, human-verification controls, audit records, restricted document links, backups, and supplier controls appropriate to the risk. No system can promise absolute security, but access and retention are limited and incidents are handled under the applicable notification duties.
Your choices and rights
Depending on the processing, you may request access, rectification, erasure, restriction, portability, or objection, and you may withdraw consent without affecting earlier lawful processing. You may object to direct marketing at any time.
Send a clear request to the controller contact shown on this page. We may request proportionate proof of identity where needed. Requests are normally answered within one month; legally permitted extensions will be explained.
Contact CasaViva Costa View AEPD rights guidance
If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).
