Privacy Policy & Cookie Policy

This policy applies to the website casitaland.com and all its subpages. It explains what personal data we collect, why, and your rights under the GDPR (Regulation EU 2016/679) and Spanish data protection law (Ley Orgánica 3/2018, LOPDGDD).

1. Data Controller

The data controller responsible for personal data processed through this website is:

• Name / Razón Social: [FILL IN: full legal name or company name]
• NIF / CIF: [FILL IN: tax identification number]
• Address: [FILL IN: full address, city, postcode, Spain]
• Email: contact@casitaland.com

2. Data We Collect

Data you provide voluntarily

When you contact us via email or a contact form, we collect your name, email address, and any information you include in your message. You are not required to provide this data — doing so is entirely voluntary.

Data collected automatically (analytics — only with consent)

If you accept analytics cookies, Google Tag Manager (GTM) will activate Google Analytics 4 (GA4) on your session. GA4 collects:

• Pages visited, time on site, and navigation paths
• Approximate geographic location (country/region level — no precise geolocation)
• Device type, browser, and operating system
• Scroll depth and click events (used to improve content)

The GTM container script loads on all page visits to manage tag execution, but it does not collect personal data or set cookies. The GA4 analytics tag inside GTM is blocked by default and only fires after you explicitly accept analytics cookies via the cookie banner. If you decline or ignore the banner, no analytics data is collected.

Data stored locally (no server transmission)

Your favourited listings and cookie consent preference are stored in your browser's localStorage. This data never leaves your device and is never transmitted to us or any third party.

3. Purposes & Legal Basis

Purpose	Legal Basis (GDPR Art.)
Responding to contact enquiries	Legitimate interest (Art. 6(1)(f)) / contract performance (Art. 6(1)(b))
Analytics via Google Analytics 4	Consent (Art. 6(1)(a)) — opt-in via cookie banner
Newsletter (if subscribed)	Consent (Art. 6(1)(a))

We do not use your data for automated decision-making or profiling with legal or similarly significant effects.

4. Retention Periods

• Contact enquiries: retained for 2 years from the date of last contact, then permanently deleted.
• Analytics data: Google retains GA4 event data for 14 months by default. We do not export, store, or independently retain this data.
• Newsletter subscribers: retained until you unsubscribe or withdraw consent. After unsubscription, your email address is deleted within 30 days.

5. Third-Party Data Processors

We do not sell or rent your personal data to any third party. We share data only with the processors below, each under a data processing agreement:

• Google Tag Manager (Google Ireland Ltd) — tag management system that controls when and how analytics tags fire. GTM itself does not collect personal data; it only passes data to tags you have consented to. Google Privacy Policy
• Google Analytics 4 (Google Ireland Ltd) — website analytics, activated only after cookie consent. Data is processed in the EU where required. Google Privacy Policy — Opt-out add-on
• Email service provider (if applicable) — used for newsletter delivery only. No personal data is shared for any other purpose.

All processors are contractually bound to process personal data only on our instructions, to implement appropriate technical and organisational security measures, and not to transfer data outside the European Economic Area without adequate safeguards.

6. Your Rights

Under the GDPR and LOPDGDD you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten"), where no legal obligation requires us to retain it.
• Restriction — ask us to suspend processing in certain circumstances (e.g. while accuracy is disputed).
• Portability — receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, for any processing based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, email contact@casitaland.com with your request. We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the Spanish Data Protection Authority (AEPD — aepd.es).

7. Cookie Policy

What are cookies?

Cookies are small text files placed on your device by a website. We also use localStorage, a browser storage mechanism that functions similarly but is never transmitted in HTTP requests.

How we handle cookie consent

In compliance with GDPR and AEPD guidance, analytics cookies and the Google Analytics 4 tag are blocked by default. The GTM container loads on every visit to manage tag execution but does not itself set analytics cookies or collect personal data. GA4 is only activated after you click "Accept" in the cookie banner. If you close the banner without accepting, or click "Decline", no analytics cookies are set and no analytics data is collected.

Cookies and storage we use

Name	Type	Purpose	Consent required	Set by
tc_cookie_consent	localStorage	Stores your cookie preference (accept/decline)	No (strictly necessary)	CasitaLand
tc_favorites	localStorage	Stores your saved/favourited listings	No (strictly necessary)	CasitaLand
_ga, _ga_*	Cookie	Google Analytics 4 — measures traffic, navigation, and content engagement	Yes — only set after consent	Google (via GTM)
GTM container (GTM-KM7FJZ8M)	Script	Tag management — controls which tags fire. Fires on all page loads but does not set cookies or collect personal data independently.	Loads on all visits (no personal data)	Google

Managing your consent

You can change your analytics consent at any time by clearing your browser's localStorage and reloading the page — the cookie banner will reappear. You can also opt out of Google Analytics measurement across all websites using Google's browser add-on. Your browser's built-in privacy settings can also be used to block or delete cookies.

8. Changes to This Policy

We may update this policy to reflect changes in the law or in our data practices. The "Last updated" date at the top will be revised accordingly. Material changes (such as new data uses or new processors) will be highlighted on the site for 30 days following the update.