Privacy Policy
How Casa Direct collects, uses, shares and protects personal data.
Last updated: 15 August 2026
1. Data controller
GRUPO SOLUCIONES ANDALUCIA, S.L., trading as Casa Direct, NIF B56504764, Calle Rosarico la Joaquín, 11, Frigiliana, 29788, Málaga, Spain. Privacy requests: info@casadirect.eu.
2. Data we may collect
Depending on your interaction with us, we may process identification and contact details, property requirements, property-owner information, viewing and appointment details, rental dates and occupancy details, quotation and payment information, communications, staff workflow records and, for invited rental applications, identity documents (passport/DNI/TIE) and proof of income. We do not ask customers to upload these sensitive documents through ordinary public enquiry forms.
3. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Responding to buyer, renter, seller, landlord, property, viewing and office enquiries | Steps requested before entering a contract; and legitimate interests in handling enquiries and providing our service. |
| Preparing quotations, reservations, rental applications, contracts, payments, check-ins/check-outs and transaction administration | Pre-contractual steps, performance of a contract, legitimate interests in administering the relationship, and legal obligations where applicable. |
| Identity, income and due-diligence checks for rental/property transactions | Pre-contractual/contractual steps, legitimate interests in assessing an application and preventing fraud, and legal obligations including anti-money-laundering obligations where they apply. |
| Currency-exchange referral | Your explicit consent to pass the referral information to the relevant currency partner. |
| Property alerts or direct marketing, where offered | Consent or another lawful basis permitted by applicable electronic-marketing law. You can opt out at any time. |
| Website security, staff authentication, audit records and fraud prevention | Legitimate interests in protecting Casa Direct, customers and the website, and legal obligations where applicable. |
4. Who receives data
Access is limited to authorised Casa Direct staff and, where necessary for the service or transaction, categories of recipients such as property owners, professional advisers, legal/accounting providers and relevant service providers. Processors/services currently used or contemplated by the website include Jolt.co.uk (Host Lincoln Limited) for hosting, our email provider, Slack for internal enquiry/application notifications, and Inmoweb for property/CRM or feed functions. If you expressly request a currency referral, relevant details may be passed to Currencies Direct. We do not send passport/DNI/TIE or proof-of-income uploads into Slack notifications.
5. International transfers
Website hosting is provided by Jolt.co.uk, which states that its main hosting data centres are in the United Kingdom. Where a service involves processing outside the European Economic Area, we use the safeguards available under applicable data-protection law. Slack may process data internationally and states that it offers the European Commission Standard Contractual Clauses and other applicable transfer mechanisms. We minimise the information sent to communication tools such as Slack.
6. Retention
| Record | Normal retention approach |
|---|---|
| General enquiries, viewing/office requests and abandoned property requirements | Normally up to 12 months after the last meaningful contact, unless the matter proceeds or a longer period is needed for a claim or legal obligation. |
| Quotations that do not proceed | Normally up to 12 months after closure/last contact, unless required for a dispute or legal obligation. |
| Unsuccessful or expired rental applications, including identity/income uploads | Normally deleted within 90 days after rejection/expiry, unless a dispute, fraud concern or legal obligation requires longer retention. |
| Successful transactions, contracts, invoices, accounting and business records | Generally retained for at least the periods required by Spanish commercial and tax law. Business documentation may need to be retained for six years. |
| Anti-money-laundering due-diligence records where Casa Direct is legally an obliged entity for the relevant transaction | Ten years as required by applicable Spanish AML legislation, with restricted access after five years where the legislation requires it. |
| Marketing/property alerts | Until consent is withdrawn or the relationship is reviewed as inactive. |
Retention periods can be extended where necessary to establish, exercise or defend legal claims or comply with a binding legal obligation. When the reason for retention ends, data is deleted or securely anonymised.
7. Your rights
You may request access, rectification, erasure, restriction of processing, objection and portability where applicable, and you may withdraw consent at any time without affecting processing already lawfully carried out. Contact info@casadirect.eu. You also have the right to complain to the Agencia Española de Protección de Datos (AEPD).
8. Security
Casa Direct uses access controls, HTTPS, protected server directories, staff authentication and other reasonable technical and organisational measures. Identity and income documents are stored in protected server storage and are restricted to authorised staff. No internet or storage system can be guaranteed absolutely secure.
9. Children and other occupants
Our services are directed to adults. A responsible adult may provide limited information about children who will occupy a rental property where necessary for the rental arrangement. We do not request identity/income documents from children through the website.
10. Automated decisions
The website may calculate prices, match property availability or assist staff workflows, but Casa Direct does not use the website to make solely automated decisions producing legal or similarly significant effects on customers. Rental acceptance and contractual decisions remain subject to human review.
11. Changes
We may update this policy when our services, processors or legal requirements change. The current version and update date will be published here.