How CasaCerta uses personal information

Who controls your information

The CasaCerta operator shown above is the controller for account, enquiry, advertising and report-purchase information processed through this platform. Advertisers who receive an enquiry normally act as separate controllers for their own follow-up.

Information we collect

• Account identity and contact details supplied by the sign-in provider.
• Saved homes, enquiries, viewing requests, messages and notification preferences.
• Professional profiles, agency details, AMI references, listings, uploaded document metadata and moderation records.
• Property-report and advertising orders, payment status and transaction references. CasaCerta does not receive full card details.
• Security, device and request logs needed to operate, protect and diagnose the service.

Where the information comes from

Most information comes directly from you when you sign in, save a home, contact an advertiser, buy a report or operate a professional account. Authentication details come from the configured sign-in provider, payment confirmation comes from the payment provider, and listing information may come from an authorised advertiser, agency feed or public authority source identified beside the relevant fact.

Why we use it

• To provide an account, save choices, deliver messages and fulfil paid services under our contract with you.
• To route enquiries to the advertiser you selected and keep an auditable delivery record.
• To verify, moderate and protect listings and accounts in our legitimate interests and those of platform users.
• To meet accounting, tax, fraud-prevention and other legal obligations.
• To send optional marketing only where a valid consent or another lawful basis applies; it must be possible to opt out.

Who receives it

Information is shared only as needed with the advertiser or professional you contact, and with contracted providers for hosting, authentication, database storage, transactional email, payment processing, security and support. Public listing information can be viewed by anyone. We do not sell personal information. The production processor register must identify the selected providers, their role, EEA location and any approved transfer mechanism before launch.

Retention schedule

• Active account information is kept while the account is used. After a verified closure request, data not subject to another duty is deleted or irreversibly de-identified within 30 days.
• Saved homes and search alerts are deleted with the account or earlier when the user removes them.
• Enquiries and viewing messages are scheduled for deletion 24 months after the last activity, unless a dispute, safety report or legal claim requires restriction for longer.
• Rejected or removed listing and moderation records are scheduled for deletion or de-identification five years after the final decision where they are no longer needed for a dispute or legal obligation.
• Security logs are scheduled for deletion after 12 months unless an incident requires a documented extension.
• Access, deletion and content-notice records are retained for three years to demonstrate how the request was handled.
• Invoices and supporting transaction records are retained for the Portuguese statutory tax/archive period, currently generally ten civil years. Unnecessary account-profile data is not retained merely because a transaction record must be kept.

International access and processors

Production providers must be assessed before launch. Where personal information is accessed outside the EEA, CasaCerta must document an adequacy decision or another lawful safeguard, such as approved standard contractual clauses, and make further information available on request.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier processing. Signed-in users can download account data or initiate deletion from My CasaCerta → Privacy & data. You may also contact the operator above. CasaCerta must answer without undue delay and normally within one month, subject to the GDPR rules for complex or repeated requests. You may complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD).

Children and automated decisions

CasaCerta is a property service for adults and is not directed at children. Do not submit a child’s personal information in enquiries, listings or documents. Search ordering, fit scores and moderation checks may use rules or automation, but this release does not make a solely automated decision that produces legal or similarly significant effects for a person. Paid visibility is kept separate from personal-fit signals and operator moderation decisions.