Privacy Policy

Effective date: 21 May 2026 Last updated: 21 May 2026

1. Who We Are (the Data Controller)

es.casa is operated by:

Echo Marketing B.V.

KvK (Dutch Chamber of Commerce): 76053415
BTW (VAT): NL860490853B01
Registered address: Goorsestraat 49, 7496 AC Hengevelde, The Netherlands
Contact: hola@es.casa

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), Echo Marketing B.V. is the data controller of personal data processed through es.casa.

In this Privacy Policy, "es.casa", "we", "us", and "our" refer to Echo Marketing B.V. acting under the trade name es.casa. "Platform" means the website at es.casa, all city subdomains (such as marbella.es.casa and ibiza.es.casa), and related services.

2. Scope

This Privacy Policy applies to personal data we collect when:

You visit the Platform.
You create an account or use any account-based feature.
You contact an estate agent through the Platform.
You subscribe to property alerts, newsletters, or download buying guides.
You purchase Agent Credits or use paid services.
You communicate with us by email, social media, or other channels.

This Policy does not cover websites operated by third parties, even where we link to them. Their privacy practices are governed by their own policies.

3. Privacy Contact

You can reach us about anything in this Privacy Policy at:

hola@es.casa

We aim to respond to data subject requests within 30 days, in line with GDPR Article 12(3).

We have not appointed a Data Protection Officer (DPO), as we are not currently required to do so under GDPR Article 37. If our processing activities change in scope, we will appoint a DPO and update this section.

4. What Data We Collect

4.1 Data you give us directly

Account data

First and last name
Email address
Password (stored as a salted hash; we never see your plain-text password)
Phone number (if you choose to provide it)
Country of residence
Preferred language

Profile data

Profile photograph (optional)
Buyer or Agent role
For Agents: business name, registered address, tax identification number (NIF/CIF), real estate license number where applicable, business contact details

Listing data (Agents only)

Property descriptions, addresses, prices, features
Property photographs and videos
Energy performance certificates and other regulatory disclosures

Communications data

Messages you exchange with Agents (or Buyers) through the Platform
Messages you send to us (support, feedback)
Property inquiry submissions

Search and preference data

Saved searches and favourite properties
Search filters you apply
Notification preferences

Payment data (Agents purchasing Credits)

Payment is processed by our payment provider. We receive only confirmation of payment and an order reference; we do not store full card or bank-account details.

4.2 Data we collect automatically

Device and technical data

IP address (collected, then truncated for analytics purposes within 24 hours)
Browser type and version
Operating system
Screen size and device type
Referring URL
Pages visited and time spent

Usage data

Properties viewed
Searches performed
Buttons and links clicked
Conversion events (sign-up, inquiry sent, guide downloaded, etc.)

Marketing attribution data

UTM parameters (source, medium, campaign, term, content)
Click identifiers from advertising platforms (such as gclid for Google, fbclid for Meta where applicable)
Referrer

Cookies

See Section 10 below for the cookies section.

4.3 Data we receive from third parties

If you sign in using a third-party identity provider (such as Google), we receive the basic profile information you authorise that provider to share.
We may receive aggregated reports from advertising platforms about the performance of our campaigns, which may include limited information about you if you interacted with one of our ads.

5. Why We Process Your Data, Lawful Bases (GDPR Article 6)

Under the GDPR, every use of your personal data must rest on a specific lawful basis. The table below maps each processing activity to the basis we rely on.

Processing activity	Lawful basis	Reference
Creating and managing your account	Performance of a contract	Art. 6(1)(b)
Sending transactional emails (sign-up, password reset, inquiry receipts, account notices)	Performance of a contract	Art. 6(1)(b)
Forwarding your property inquiry to an Agent	Performance of a contract	Art. 6(1)(b)
Storing your saved searches and favourites	Performance of a contract	Art. 6(1)(b)
Phone-number verification (where applicable)	Performance of a contract / legitimate interest in fraud prevention	Art. 6(1)(b), 6(1)(f)
Verifying Agent credentials and listings	Legitimate interest in marketplace integrity	Art. 6(1)(f)
Detecting and preventing fraud and abuse	Legitimate interest in protecting the Platform and its users	Art. 6(1)(f)
Aggregated analytics for service improvement	Legitimate interest	Art. 6(1)(f)
Sending marketing emails, property alerts, and newsletters	Your consent	Art. 6(1)(a)
Setting analytics, advertising, and conversion-tracking cookies	Your consent	Art. 6(1)(a)
Processing Credit purchases and issuing invoices	Performance of a contract	Art. 6(1)(b)
Keeping financial and tax records	Legal obligation under Dutch and Spanish tax law	Art. 6(1)(c)
Responding to lawful requests from authorities	Legal obligation	Art. 6(1)(c)
Defending or bringing legal claims	Legitimate interest	Art. 6(1)(f)

5.1 Your right to object to legitimate-interest processing

Where we rely on legitimate interest, we have carried out a balancing test weighing our interest against your rights and freedoms. You can object to such processing at any time by emailing hola@es.casa. We will stop the processing unless we can demonstrate compelling legitimate grounds, or the processing is necessary for legal claims.

5.2 Your right to withdraw consent

Where we rely on your consent, you can withdraw it at any time:

For marketing emails: via the "unsubscribe" link in any marketing email, or by emailing hola@es.casa.
For tracking cookies: via the "Cookie settings" link in the footer of any page, which opens the cookie preference center.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How We Use Your Data, Purposes

To provide the service. Creating your account, displaying property Listings, forwarding your inquiries, storing favourites.
To communicate with you. Sending transactional emails, responding to support requests, providing updates about your account.
To enable Buyer–Agent interaction. Forwarding inquiries to Agents you contact and sharing your contact details with the Agent so they can respond.
To run paid services for Agents. Processing Credit purchases, applying Credits to advertising, issuing invoices.
To improve the Platform. Analysing how Users interact with the Platform to fix bugs, improve usability, and develop new features.
To market our services. With your consent, sending you property alerts, market updates, and offers we believe may interest you.
To measure marketing effectiveness. With your consent, tracking how Users find and use the Platform, and reporting that to advertising platforms (Google Ads; Meta where applicable) to optimise our campaigns.
To prevent fraud and abuse. Detecting suspicious activity such as fake Listings, scraping, or account takeovers.
To meet our legal obligations. Keeping accounting records, responding to authority requests, complying with the EU Digital Services Act.
To defend legal claims. Preserving relevant data where we are involved in or anticipate legal proceedings.

7. Who We Share Your Data With

We do not sell your personal data. We share it only with the parties listed below, and only to the extent necessary for the purpose described.

7.1 Other Users of the Platform

Agents you contact receive your name, email, and any other contact details you provide, plus the inquiry message you submit. This is necessary for them to respond to you.
Public Listings. When an Agent publishes a Listing, the Listing data, including any photographs the Agent provides, becomes public. Information about the Agent (business name, business contact) appears with the Listing.

7.2 Sub-processors

We share personal data with the following service providers, who process data on our behalf under written contracts compliant with GDPR Article 28:

Sub-processor	Role	Data categories	Location	Transfer mechanism
Lovable (lovable.dev)	Application hosting platform	All Platform data, account, listings, inquiries, communications	EU + US infrastructure	Standard Contractual Clauses; EU-US Data Privacy Framework where applicable
Supabase Inc.	Database, file storage, authentication backend	Account credentials, profile data, uploaded media, listing data, messages	EU region (Frankfurt) primarily; US backup	Standard Contractual Clauses
Cloudflare, Inc.	Content delivery network, DNS, edge workers (img.es.casa, tags.es.casa, sitemaps.es.casa, og.es.casa)	Technical data, IP address, request headers, cookies, performance telemetry	Global edge network	EU-US Data Privacy Framework + Standard Contractual Clauses
Google LLC / Google Ireland Limited	Google Analytics 4, Google Ads, Google Tag Manager, Google Fonts	Pseudonymous identifiers, truncated IP address, interaction events, conversion events	EU + US	EU-US Data Privacy Framework
Resend, Inc.	Transactional email delivery	Email address, name, message content for delivery purposes	US	Standard Contractual Clauses
Mollie B.V.	Payment Service Provider for Agent Credit purchases, card processing, SEPA, iDEAL, Bancontact, wallets, fraud prevention	Name, email address, billing address, business identifier (e.g. VAT number), payment instrument details, transaction history, IP address, device data	Netherlands (EU)	Processing within the EU; Standard Contractual Clauses where any onward transfer occurs

Mollie B.V. acts as our Payment Service Provider for all Credit purchases. Echo Marketing B.V. remains the seller of record and issues the invoice. Mollie is a joint controller in respect of the payment data it collects directly from you at checkout for its own fraud prevention and regulatory obligations. Mollie's privacy notice is available at https://www.mollie.com/privacy.

If we engage a new sub-processor (for example Meta Platforms for advertising), we will update this list before processing begins through the new provider.

You may request a copy of the data processing agreement with any sub-processor by writing to hola@es.casa.

7.3 Authorities and legal counsel

We may disclose personal data to:

Law enforcement, courts, regulators, and tax authorities where required by law or court order.
Our legal advisers, in connection with the establishment, exercise, or defence of legal claims.
Auditors and accountants, under confidentiality obligations.

7.4 Business transfers

If we sell or transfer our business (in whole or in part), personal data may be transferred as part of the transaction, subject to confidentiality obligations and continued compliance with this Privacy Policy. We will notify you of any such transfer.

8. International Data Transfers

Some of our sub-processors are based outside the European Economic Area (EEA), primarily in the United States. When personal data is transferred outside the EEA, we rely on one or more of the following legal mechanisms required by GDPR Chapter V:

EU-US Data Privacy Framework for providers self-certified under this framework (verifiable at https://www.dataprivacyframework.gov).
Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914) for providers not DPF-certified.
Supplementary measures, including encryption in transit (TLS 1.2+), encryption at rest, access controls, and contractual restrictions on access to data by government authorities.

You may request copies of the SCCs we rely on by emailing hola@es.casa.

9. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes for which it was collected and to meet our legal obligations.

Data category	Retention period
Active account data	While your account is open + 12 months after closure
Inactive account data (no log-in for 24 months)	We will notify you and delete the account 90 days later unless you reactivate
Property inquiries and messages	24 months from last activity
Saved searches and favourites	While your account is open
Marketing consent records	Until you withdraw consent + 36 months (to evidence prior consent if challenged)
Google Analytics 4 data	14 months (GA4 default)
Google Ads conversion data	Up to 540 days (Google Ads default)
Invoices and accounting records (Credit purchases)	7 years (Dutch tax law: Art. 52 AWR) / 6 years (Spanish tax law: Art. 66 LGT), we keep the longer of the two applicable periods
Security and fraud-detection logs	12 months
Server access logs (IP addresses)	30 days
Cookie consent records	24 months

When a retention period expires, we either delete the data or anonymize it so it can no longer be linked back to you.

10. Cookies and Similar Technologies

10.1 What we use

The Platform uses cookies and similar technologies (local storage, pixels) for the following purposes:

Strictly necessary cookies. Required for the Platform to function, for example, to keep you logged in, store your language preference, and remember your cookie consent choices. These do not require consent.
Functional cookies. Remember choices you make to give you a better experience, saved searches, recently viewed properties.
Analytics cookies. Help us understand how Users interact with the Platform (Google Analytics 4). Set only with your consent.
Advertising and conversion-tracking cookies. Used to measure the effectiveness of our advertising and to show you relevant ads on third-party sites (Google Ads; Meta where applicable). Set only with your consent.

10.2 Managing your cookie choices

We display a cookie consent banner on your first visit. You can accept all, reject all, or set granular preferences. You can change your choices at any time by clicking the "Cookie settings" link in the footer of any page, which opens the cookie preference center.

You can also block cookies through your browser settings, although doing so may disable some Platform features.

10.3 Detailed cookies list

A detailed list of cookies we use, including each cookie's name, purpose, provider, and duration, is maintained by Echo Marketing B.V., the operator of es.casa. When you purchase Agent Credits, our Payment Service Provider Mollie B.V. may set cookies required for payment processing and fraud prevention during the checkout process.

11. Your Rights Under the GDPR

Subject to certain conditions, you have the following rights regarding your personal data:

Right of access (Art. 15). Obtain confirmation that we process your data and receive a copy.
Right to rectification (Art. 16). Have inaccurate data corrected and incomplete data completed.
Right to erasure / "right to be forgotten" (Art. 17). Have your data deleted, where one of the grounds in the GDPR applies (such as the data no longer being necessary, or you having withdrawn consent).
Right to restriction (Art. 18). Have processing limited where, for example, you contest the accuracy of the data or have objected to processing.
Right to data portability (Art. 20). Receive a copy of the data you provided us in a structured, commonly used, machine-readable format (JSON or CSV), and transmit it to another controller.
Right to object (Art. 21). Object at any time to processing based on legitimate interest, including for direct marketing.
Right not to be subject to automated decision-making (Art. 22). Not be subject to decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. See Section 14.
Right to withdraw consent (Art. 7(3)). Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

12. How to Exercise Your Rights

To exercise any of the rights in Section 11:

Email hola@es.casa with a clear description of your request.
Where the request concerns your account, log in first so we can verify your identity through your existing session.
Where the request is made by email from an unverified address, we may ask for additional information to confirm your identity, we cannot disclose personal data to someone else.

We will respond within 30 days of receiving a valid request. For complex or numerous requests, we may extend this by up to two further months, in which case we will tell you within the first month and explain why.

Exercising your rights is free of charge, unless your request is manifestly unfounded or excessive (for example, repetitive), in which case we may charge a reasonable fee or refuse to act, in line with GDPR Article 12(5).

13. Marketing Communications

13.1 Email marketing

We send marketing emails (property alerts, newsletters, market updates, special offers) only:

After you have given affirmative consent during sign-up or via a preference centre; or
Where we are entitled to do so under the "soft opt-in" exception for existing customers (Spanish LSSI Art. 21.2), in which case the messages will be similar to services you have already obtained from us, and you will be given a clear way to opt out at every contact.

You can opt out of marketing emails at any time by:

Clicking "unsubscribe" in any marketing email.
Updating your preferences in your account settings.
Emailing hola@es.casa.

Opting out of marketing does not affect transactional emails about your account, which we will continue to send.

13.2 SMS and phone

We will send marketing SMS or call you for marketing purposes only with your prior consent. Transactional SMS (such as phone-number verification codes) may be sent without separate marketing consent, where they are necessary to provide the service.

14. Automated Decision-Making and Profiling

We use limited automated processing on the Platform:

Property matching. We rank Listings in your search results based on the filters you apply and, where you are signed in, your past saved searches and favourites. This is not a decision that produces legal or similarly significant effects within the meaning of GDPR Article 22.
Fraud detection. We use automated signals (such as IP reputation and unusual login patterns) to flag potentially fraudulent accounts. A human reviews any account before suspension or termination.

We do not currently make any decisions about you that are based solely on automated processing and produce legal or similarly significant effects. If we introduce such processing in future, we will update this Section and request your consent or provide the safeguards required by GDPR Article 22.

15. Children's Privacy

The Platform is intended for adults, Users must be at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact hola@es.casa and we will delete it.

16. Data Security

We apply appropriate technical and organisational measures to protect personal data, including:

TLS 1.2+ encryption for all data in transit.
Encryption at rest for stored personal data (managed by our hosting and database providers).
Salted-hash storage for passwords (we never see your plain-text password).
Access controls and role-based permissions for our team.
Logging and monitoring to detect unauthorised access attempts.
Annual review of security practices.

No system is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security.

17. Data Breach Notification

If a personal data breach occurs and is likely to result in a risk to your rights and freedoms, we will:

Notify the lead supervisory authority (the Dutch Autoriteit Persoonsgegevens) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.
Notify you directly without undue delay if the breach is likely to result in a high risk to your rights and freedoms, in accordance with GDPR Article 34.

We maintain an internal breach register as required by GDPR Article 33(5).

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent change.

For material changes (such as new data uses, new sub-processors handling sensitive data, or changes to your rights), we will provide at least 30 days' advance notice by email to registered account holders and by prominent notice on the Platform.

You can request previous versions of this Privacy Policy by emailing hola@es.casa.

19. Supervisory Authority and Complaints

If you believe we have not handled your personal data in accordance with the law, you have the right to lodge a complaint with a data protection authority. You may complain to the authority in the EU/EEA country where you live, where you work, or where the alleged infringement occurred.

Because Echo Marketing B.V. has its main establishment in the Netherlands, our lead supervisory authority under the GDPR one-stop-shop mechanism is:

Autoriteit Persoonsgegevens (AP) Postbus 93374 2509 AJ Den Haag The Netherlands Website: https://autoriteitpersoonsgegevens.nl Phone: +31 (0)70 888 85 00

If you are a resident of Spain, you may also lodge a complaint with your local authority:

Agencia Española de Protección de Datos (AEPD) C/ Jorge Juan, 6 28001 Madrid, Spain Website: https://www.aepd.es Phone: +34 901 100 099 / +34 91 266 35 17

If you are resident in another EU/EEA country, you may complain to your local data protection authority, a directory is maintained by the European Data Protection Board at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We would, however, appreciate the chance to address your concerns first, please email hola@es.casa before escalating.

20. Contact Us

For any question about this Privacy Policy, or to exercise any of your rights:

Echo Marketing B.V. Goorsestraat 49 7496 AC Hengevelde The Netherlands Email: hola@es.casa

Thank you for trusting es.casa with your data. We take this responsibility seriously.