Privacy Policy

1. Data controller

CostaCasas is operated by Belgium Cleaning Service VOF, Nerviërslei 16, 2900 Schoten, Belgium. Enterprise number: 0471.430.094. VAT: BE0471430094. Privacy contact: costacasas@costacasas.be. We process personal data in accordance with the EU General Data Protection Regulation (GDPR). This staging notice does not approve owner/property synchronization or the separate draft processing statement and legitimate interest assessment.

2. Categories of data

Depending on how you use CostaCasas:

• Account: name, email, optional phone, profile photo, role and (for renters) nationality.
• Listings: property location, photos, videos, descriptions, prices, availability, licence/registration details and documents.
• Contact and agreements: inquiries, messages, reviews, rental agreements and electronic signatures (signer name, email, time, IP address, browser information and a fingerprint of the signed version).
• Payments to CostaCasas: order, invoice and payment status data (CostaCasas never receives full card details).
• Rental payment tracking: owner payment settings (provider name, external payment link, instructions) and, per agreement, amounts, currencies, due dates, owner-reported statuses, reminder settings and logs of reminder emails sent. CostaCasas does not store bank logins, card data or provider passwords.
• Guest identification: only where a confirmed applicable rule requires it, or where the owner requests it for a specific agreement: the identity details required, stored encrypted and deleted after the retention period of the applicable rule.
• Calendars: availability blocks, manually entered blocks and the external iCal links you connect (treated as private).
• Listing setup requests: the property details, photos and documents you submit for CostaCasas to prepare your listing.
• Community and reports: posts, comments, reports and moderation records.
• Reviews and reputation: property, host and guest reviews (scores, text, display or first name, month of stay, replies, status and dates), the related rental agreement and accounts, review invitations (guest email and name), reports and moderation decisions with their reason.
• Technical: login and security data, IP address for security purposes, device/browser data.
• Statistics: an anonymous visitor ID and visit ID, and with analytics consent Google Analytics measurement (pages visited, device/browser data, and the events “first property created” and “property published”, without name, email or address).

3. Purposes and legal basis

We do not rely on consent for everything. Main processing activities:

• Account management → performance of contract.
• Listing management, contact with owners, rental agreement tool → performance of contract.
• Payments and invoices → performance of contract and legal obligation (accounting).
• Fraud prevention and security → legitimate interest.
• Moderation, reports and complaints → legitimate interest and legal obligation (Digital Services Act).
• Reviews and guest reputation → legitimate interest of CostaCasas, hosts and guests in reliable, verified information about stays; review invitations and blind publication are part of the rental agreement tool. Guest reviews are only shown to the guest and to hosts in contact with that guest (see the review policy). You can object to this processing; we then assess your specific situation.
• Legal compliance and requests from authorities → legal obligation.
• First-party visitor statistics and Google Analytics → consent.
• Google Translate language choice → consent.
• Public display of nationality on renter profiles → shown as explained at registration; you can ask us to stop showing it.

Nationality is never used as a trust, quality, safety, ranking or recommendation score, and is never inferred from IP address, language or name. CostaCasas does not use automated decision-making with legal or similarly significant effects. The public availability calendar only shows available/unavailable; no guest names, contact details, booking references, notes or block reasons are shown.

4. Recipients

Inquiry details are shared only with the relevant owner or service provider. Reviews are shown as described in the review policy: property and host reviews publicly, guest reviews only to the guest and hosts in contact with that guest; moderation records only to authorised staff. We use processors for hosting, database, authentication, file storage and email delivery; Mollie B.V. (Amsterdam) for payments; Google for Maps/Places and, with consent, Translate and Google Analytics (Google Ireland Ltd.). Data may be shared with professional advisors or competent authorities where required by law. We do not sell personal data.

5. International transfers

Some providers may process data outside the European Economic Area. In that case we rely on appropriate safeguards such as an adequacy decision or the EU standard contractual clauses.

6. Retention

We keep data only as long as needed for the purpose, or longer where the law requires it:

• Account, profile and listings: for as long as your account exists; deleted on account deletion, except data we must keep by law.
• Inquiries and messages: for as long as the account of the owner or renter exists, or until deleted by the owner.
• Invoices and payment records: for the statutory accounting retention period (in Belgium currently 10 years), also after account deletion.
• Rental agreements, signatures and their audit trail: for as long as needed for the parties and possible disputes, as signed documents cannot be silently modified.
• Property reviews: while the listing exists, unless removed under the review policy.
• Host and guest reviews: for as long as the related rental agreement is kept. If the author deletes their account, the review stays with the name replaced by “Former member”. Guest reviews are only ever shown as described in the review policy.
• Review invitations: the guest’s email address is deleted automatically 30 days after an unused invitation expired (for stays with a rental agreement: when the 14-day review period closed), or 6 months after the review was published or after the latest moderation decision, whichever is later, so that the author can still be informed and contest a decision. Deletion is paused only while a specific complaint, appeal or legal dispute requires it, and is recorded without personal data. The guest name and the review itself are kept as described for reviews. The email address in the rental agreement itself follows the retention for rental agreements.
• Complaints, reports and moderation records: as long as needed to handle them and possible appeals or legal claims.
• Security and audit logs: for as long as necessary for security, fraud prevention and legal obligations.

We do not promise immediate deletion where a legal retention obligation applies.

7. Security

We protect data with appropriate technical and organisational measures, including private storage, access restrictions, role-based permissions, audit logging and encrypted connections.

8. Your rights

You can request access, rectification, erasure, restriction, portability, object to processing based on legitimate interest, and withdraw consent at any time. You can download your data and delete your account via Account › Password & security. Send other requests to costacasas@costacasas.be; we normally respond within one month. You have the right to complain to the Belgian Data Protection Authority (www.dataprotectionauthority.be) or the authority in your country of residence. Cookie choices can be changed via the cookie policy.

9. Airbnb export import (owners)

Owners can optionally import their own Airbnb data export (ZIP) to prepare listing drafts. How this works:

• The ZIP file is opened and read inside your own browser. The original ZIP file is not uploaded to or stored by CostaCasas.
• From the export we only extract listing information: title, description, location (city/country), number of guests, bedrooms and bathrooms, amenities, and photo files linked to a listing. Other contents of the export — such as messages, reservations, reviews, identity documents, payment or payout details — are not used, saved or sent to us.
• Only the listings and photos you select and confirm are saved: as a private draft in your account, with photos in private storage accessible only to you and authorised administrators. Photos that exist only as web links are not downloaded.
• Purpose and legal basis: preparing a listing at your request is necessary to perform our agreement with you (GDPR art. 6(1)(b)). Keeping the platform free from unlawful or infringing content is based on our legitimate interest (art. 6(1)(f)). We do not rely on consent for the import.
• If imported descriptions or photos contain personal data of other people (for example recognisable persons in photos), you must ensure you have a legal basis to share them and that those people are informed; remove such content if you cannot. We may remove it on request.
• Recipients: the same hosting, database and storage processors listed under Recipients. Imported data is only shown publicly after you publish the listing.
• Retention: drafts and their photos remain in your account until you delete them or your account; published listings follow the retention rules above. You can exercise your rights described under Your rights at costacasas@costacasas.be.