Privacy Policy
Last updated: 22 October 2026
This Privacy Policy describes how Casas Unitas ("we", "our", or "us") collects, uses, and protects your personal information in compliance with the General Data Protection Regulation (GDPR) and applicable Spanish data protection laws.
1. Data Controller
Casas Unitas is run by Injurad SL, which is the data controller for the personal information described in this policy. Casas Unitas operates as a marketplace connecting property stakeholders with licensed professionals in Spain.
Contact Information
Email: privacy@casasunitas.org
Data Protection Officer: dpo@casasunitas.org
2. Information We Collect
2.1 Information You Provide
- Account Information: Name, email address, password (encrypted)
- Property Information: Property addresses, type, size, region, municipality
- Document Uploads: Property documents, contracts, licenses, cadastral certificates
- Payment Information: Processed by Stripe (we do not store card details)
- Service Requests: Questionnaire responses, property assessments, specific requirements
- Casas Unitas in ChatGPT: When you use our app inside ChatGPT, we receive the listing text or link you share, and a cadastral reference if you give one. We use them only to answer that request and do not store them. A cadastral reference is looked up in the public Spanish Catastro.
2.2 Automatically Collected Information
- Technical Data: IP address, browser type, device information, operating system
- Usage Data: Pages visited, time spent, click patterns, feature usage
- Performance Data: Page load times, error reports, API latency
2.3 Information from Third Parties
- Payment Processors: Transaction confirmation from Stripe
- Professional Services: Reports from architects and lawyers
- Referral Sources: Referral codes and attribution data
3. How We Use Your Information
We process your personal data for the following purposes:
Service Delivery
- Providing marketplace services
- Processing service requests
- Generating reports
- Facilitating professional reviews
Account Management
- Creating and maintaining accounts
- Authentication and security
- Membership management
- Referral program tracking
Communications
- Service notifications
- Payment confirmations
- Support responses
- Newsletter (with consent)
Legal Compliance
- Tax reporting
- Fraud prevention
- Legal obligations
- Dispute resolution
Legal Basis for Processing (GDPR Article 6)
- Contract Performance: Necessary to provide services you requested
- Legitimate Interest: Fraud prevention, service improvement, security
- Consent: Marketing communications, non-essential cookies
- Legal Obligation: Tax compliance, dispute resolution
4. Document Security and Automatic Deletion
Important: Document Retention Policy
All user-uploaded documents are automatically deleted 30 days after service completion. This policy protects your privacy and ensures we only retain documents for the minimum time necessary to deliver services.
- During Service Processing: Documents are accessible only to assigned professionals and administrators
- After Service Completion: 30-day retention period for dispute resolution
- After 30 Days: Secure deletion (documents overwritten and permanently removed)
- Manual Deletion: You may delete documents at any time from your dashboard
Document Security Measures
Encryption
Documents encrypted at rest (AES-256) and in transit (TLS 1.3)
Access Control
Role-based permissions; professionals see only assigned cases
Secure Storage
Firebase Storage with user-specific paths and signed URLs
Audit Logging
All document access logged with timestamp and user ID
5. Data Sharing and Third Parties
We share your personal data only with the following parties and only as necessary:
- Licensed Professionals: Service delivery. Property details, documents, questionnaire responses
- Stripe (Payment Processor): Payment processing. Name, email, payment amount (not card details)
- Google Cloud Services: Hosting and infrastructure. Technical data, encrypted documents
- Cloudflare: Hosting the Casas Unitas app in ChatGPT. Listing text or link and cadastral reference you share there (not stored)
- Google Gemini AI: Contract analysis, risk assessment. Anonymized document text (personal data removed)
Note on Professional Access
Licensed architects and lawyers access your documents solely to deliver requested services. They are bound by professional confidentiality obligations and our data processing agreements. We do not sell or share your data for marketing purposes.
6. Your Rights Under GDPR
You have the following rights regarding your personal data:
Right to Access
Request a copy of all personal data we hold about you
Right to Rectification
Correct inaccurate or incomplete personal data
Right to Erasure
Request deletion of your personal data ("right to be forgotten")
Right to Data Portability
Receive your data in a machine-readable format
Right to Object
Object to processing based on legitimate interests or direct marketing
Right to Restrict Processing
Request temporary suspension of data processing
How to Exercise Your Rights
To exercise any of these rights, contact us at:
- Email: privacy@casasunitas.org
- Response Time: Within 30 days of request
- Verification: We may request ID verification to prevent unauthorized access
7. Data Retention Periods
- User Account Data: Until account deletion + 90 days. Legal obligations, dispute resolution
- Uploaded Documents: Service completion + 30 days. Automatic deletion policy
- Transaction Records: 7 years. Tax and legal requirements
- Service Reports: Indefinitely (user-owned). User downloads and keeps reports
- Support Conversations: 3 years. Customer service quality, legal claims
- Anonymized Analytics: Indefinitely. Cannot identify individuals
8. International Data Transfers
Your data is primarily stored within the European Union (EU). However, some service providers may process data outside the EU:
- Google Cloud (Firebase): EU region (europe-west1), GDPR compliant
- Stripe: EU/US with Standard Contractual Clauses (SCCs)
- Cloudflare: runs the Casas Unitas app in ChatGPT on its worldwide network, so a request may be handled outside the EU; a US company, with SCCs
- Google Gemini AI: US with data anonymization and SCCs
All transfers outside the EU are protected by appropriate safeguards including Standard Contractual Clauses approved by the European Commission.
9. Cookies and Tracking
We use the following types of cookies:
Essential Cookies
Required for authentication, security, and basic functionality
Cannot be disabled
Functional Cookies
Remember your preferences (language, property selection)
Can be disabled
Analytics Cookies
Help us understand how you use the platform
Requires consent
10. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be communicated via email to registered users. Continued use of our services after changes constitutes acceptance of the updated policy.
11. Contact and Complaints
Questions or Concerns?
Data Protection Officer
Email: dpo@casasunitas.org
General Privacy Inquiries
Email: privacy@casasunitas.org
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority, particularly in your country of residence, workplace, or where an alleged infringement occurred.
Spanish Data Protection Authority (AEPD)
Website: www.aepd.es