Loading…
Privacy
Last updated 24 September 2026. Applies to casaalphadeals.com and the CasaAlpha Deals service.
CasaAlpha Deals is a trading name of Gratia Nova Limited (“we”), registered in England and Wales, company number 16914141, registered office 66 Paul Street, London, EC2A 4NA. We are the controller of the personal data described here and are registered with the UK Information Commissioner's Office (ICO) under registration number ZC249602. Contact our privacy team at support@casaalphadeals.com.
| Data | Purpose | Lawful basis |
|---|---|---|
| Your account (email, sign-in tokens) | Provide the service you signed up for | Contract — Art. 6(1)(b) |
| Billing (name, billing address, payment status; card data stays with Stripe) | Take payment, prevent fraud, meet tax/accounting duties | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Unlock history (which homes you unlocked, when) | Enforce plan limits, prevent bulk copying, resolve disputes | Legitimate interests — Art. 6(1)(f) |
| Privacy requests | Handle and evidence your requests | Legal obligation — Art. 6(1)(c) |
| Saved searches and alert choice | Show new homes when you visit; email you only if you switch email on for a search | Contract — Art. 6(1)(b); email alerts: your choice, switch off any time |
| Viewing requests (name, email, optional phone, availability, message) | Pass your request to the selling agent, who becomes a separate controller of the details you share | Your request and consent — Art. 6(1)(b) and 6(1)(a) |
| Public-record listing data (property addresses, court/case references linked to a sale) | Show homes for sale in lawful public sales to people looking to buy | Legitimate interests — Art. 6(1)(f) (assessment summary below) |
Our directory is built from notices that courts, government bodies and appointed officers must publish so buyers can find public sales (for example the Spanish BOE and the Italian Portale delle Vendite Pubbliche). Before anything is stored we remove the names, identity numbers and contact details of debtors, owners, occupiers, custodians and officials. Read more on our data sources page.
An exact address linked to a court case can still indirectly relate to a person. So we:
Our legitimate-interests assessment concluded that this limited processing is necessary to support the lawful purpose for which the notices are published, and that the safeguards above keep the impact on individuals low. Because contacting each person would involve disproportionate effort (UK/EU GDPR Art. 14(5)(b)), we publish this notice instead. You can object at any time: use the request form and choose “A listing contains information about me or my home”. We review these within 72 hours and hide the listing while we do.
| Data | Retention |
|---|---|
| Account & profile | Until you ask us to close your account |
| Billing records | Held by Stripe for as long as tax and anti-money-laundering law requires (typically 6–10 years) |
| Unlock history | 24 months, then deleted automatically |
| Exact address, coordinates and case reference of a home | Deleted automatically 12 months after the auction date |
| Privacy-request records | 3 years after the request is closed |
| Saved searches | Until you delete them or your account |
| Viewing requests (our copy) | 12 months, then deleted automatically. The agent keeps theirs under their own privacy notice |
| Server logs (Vercel) | Per Vercel's retention, typically ≤ 30 days |
You have the right to access, correct, delete, restrict or port your data, and to object to processing based on legitimate interests. To use any of these rights, including getting a copy of your data or closing your account, use the privacy request form or email support@casaalphadeals.com. We respond within one month.
You can complain to the UK Information Commissioner's Office (ico.org.uk, quoting our registration number ZC249602), or to your local EU supervisory authority (for example the AEPD in Spain or the Garante in Italy). We'd appreciate the chance to resolve your concern first.
Our deal ratings rate properties, not people. It makes no decisions about individuals and has no legal or similarly significant effect on anyone, so Art. 22 GDPR does not apply.
We encrypt data in transit, restrict each member to their own records, and keep sensitive listing details separate from the public site. Access is logged, and staff access follows least privilege. If a breach is likely to put your rights at risk, we'll notify the regulator within 72 hours and tell you without undue delay.