Privacy policy

Last updated: 15 August 2026 · Alladies sp. z o.o.

This policy describes how we process personal data of costacasa.estate users in accordance with the GDPR (Regulation EU 2016/679).

1. Data controller

The controller of your personal data is Alladies sp. z o.o., registered in Poznań, Poland, ul. Pamiątkowa 2, entered in the National Court Register (KRS) under no. 0000901734, VAT ID: PL7831837282, share capital PLN 30,000 paid in full (the "Controller"). Contact for data matters: office@costacasa.estate.

2. What data we process

We only process data you provide voluntarily, plus basic technical data:

—contact-form data: name, e-mail address, phone number, message content;

—data shared by phone, e-mail or WhatsApp;

—the phone number you enter in the call-back widget (CallPage), together with call request metadata;

—technical data: IP address, browser type, approximate location, usage data (via cookies — see the Cookies policy).

3. Purposes and legal bases

—responding to your enquiry and presenting property offers — steps prior to entering into a contract (Art. 6(1)(b) GDPR);

—marketing of our own services, including newsletters — solely based on consent (Art. 6(1)(a) GDPR), withdrawable at any time;

—analytics and service improvement — the Controller’s legitimate interest (Art. 6(1)(f) GDPR);

—establishing, pursuing or defending claims — the Controller’s legitimate interest (Art. 6(1)(f) GDPR).

4. Retention periods

Enquiry data is kept for the duration of the correspondence and then for up to 3 years from the last contact (limitation period for potential claims). Consent-based data — until consent is withdrawn. Technical data — for the periods stated in the Cookies policy.

5. Recipients of data

Personal data may be shared with entities supporting the operation of the service, communication with users and the delivery of our services — only to the extent necessary for the given purpose.

Depending on the nature of the cooperation, these entities may process data on our behalf as processors or act as separate controllers.

Recipients may include in particular:

—hosting, IT infrastructure and e-mail providers;

—Web3Forms / Web3Creative — the contact-form service provider through which data submitted in the form is processed and forwarded to our e-mail address;

—CallPage sp. z o.o., Warsaw, Poland — provider of the call-back widget; if you use this feature, the data processed includes in particular your phone number and call-handling data;

—accounting, legal and IT service providers which — depending on the nature of the services — may act as processors or as separate controllers;

—developers, property owners, agencies and other partners in Spain — where the transfer is necessary to present an offer, arrange a property viewing, maintain contact regarding a chosen offer or deliver services related to the purchase of a property.

6. Transfers outside the EEA

In connection with the use of certain service providers, personal data may be transferred outside the European Economic Area or processed by entities established outside the EEA.

This may concern in particular services such as Web3Forms and WhatsApp, as well as — in certain cases — subcontractors or infrastructure providers used by CallPage.

Where personal data is transferred to countries outside the European Economic Area, mechanisms ensuring an adequate level of data protection required by the GDPR are applied, in particular:

—European Commission adequacy decisions;

—the EU–US Data Privacy Framework, where it applies to a given recipient;

—standard contractual clauses approved by the European Commission and, where required, additional safeguards.

Information about the safeguards applied to transfers outside the EEA can be made available at the user’s request.

7. Your rights

You have the right to:

—access your data and obtain a copy;

—rectification, erasure or restriction of processing;

—data portability;

—object to processing based on legitimate interest;

—withdraw consent at any time (without affecting prior lawful processing);

—lodge a complaint with the Polish supervisory authority (PUODO, ul. Stawki 2, 00-193 Warsaw).

8. Voluntary provision of data

Providing data is voluntary but necessary to answer your enquiry or present offers. Without contact details we will not be able to reach you.

9. Automated decisions and profiling

We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you.

10. Changes to this policy

This policy may be updated to reflect changes in law or in how the service operates. The current version, with its update date, is always available on this page.