Privacy policy - Ocasio24

This policy explains what personal data we process when you use Ocasio24 (ocasio24.com), why, how long we keep it and what rights you have. It applies to visitors, users with an account and the companies that use the site.

1. Who processes the data

The controller is the company that runs the site, described on the Legal notice page (name, tax number, registered office). For any question or request about your data, write to contact@ocasio24.com or use the contact form.

2. What data we process

Account: name, e-mail address, password (stored only as an irreversible hash), the date the account was created, preferred language and theme, the date you accepted the terms. If you sign in with Google or Facebook, we receive your name, e-mail address and an account identifier from them.
Profile: the data you choose to add: phone (and whether it has WhatsApp), address, town, region, postal code, profile picture.
Company account: company name, tax number, registration number, registered office, phones, public e-mail address, website, opening hours, description, images and team members. The official name, registration number and office may be checked in public registers.
Listings: text, photos, price, features, town and, if you enter them, the address and the point on the map. We remove the hidden data (EXIF) from photos, including where they were taken.
Messages exchanged with other users through the site.
Reviews, favourite listings, followed companies and saved searches.
Notifications on your phone or computer, if you turn them on: the address where your browser’s notification service delivers them, the keys they are encrypted with, and the type of device (for example “Android · Chrome”).
Reports of listings (if you have no account, the name and e-mail address you enter) and the moderation decisions that concern you.
Messages sent through the contact form and our replies.
Technical and security data: IP address and browser type (for the login session, limiting repeated attempts and protection against bots and attacks; at sign-up we use ALTCHA: your browser solves a small calculation, which we check on our own server, with no cookies and no third-party service), the log of e-mails sent (recipient, subject, whether it was delivered) and the days on which you used your account.
Statistics: the number of listing views, phone reveals and clicks. They are totals only: we do not keep who viewed or clicked. Words searched on the site are kept without any link to the person who searched them.
Cookies: see the Cookie policy.

3. Why we process it and on what legal basis

Purpose	Legal basis (GDPR Art. 6)
Creating and managing the account, publishing listings, messages between users, reviews, favourites, saved searches, company pages	Performance of the contract with you (Terms and conditions) – Art. 6(1)(b)
Service e-mails: address confirmation, password reset, new messages, changes to the status of listings or the account	Performance of the contract – Art. 6(1)(b)
Saved-search alerts and reminders about your listings	Your consent – Art. 6(1)(a); you can stop them at any time in your account or through the link in every e-mail
Site security: protection against bots, fraud and spam, security logs, removing contact details from listing texts	Our legitimate interest in keeping the site safe – Art. 6(1)(f)
Keeping the public listings of inactive accounts as an archive, without the seller's details and with no way to contact them	Our legitimate interest in keeping on the site information that is useful to visitors and search engines – Art. 6(1)(f); you can object and we delete them
Moderating listings, handling reports and acting against illegal content	The legal obligations of online platforms (Regulation (EU) 2022/2065, DSA) – Art. 6(1)(c) – and legitimate interest – Art. 6(1)(f)
Checking companies in public registers	Legitimate interest in companies on the site being real – Art. 6(1)(f)
Aggregate statistics and improving the site	Legitimate interest – Art. 6(1)(f)
Notifications on your phone or computer	Your consent, given when you turn them on; you can turn them off at any time in Notifications or in your browser settings – Art. 6(1)(a)
Audience measurement with Google Analytics	Your consent, given in the cookie banner – Art. 6(1)(a)
Answering messages sent through the contact form	Legitimate interest in answering you – Art. 6(1)(f)
Complying with legal obligations and defending legal claims	Art. 6(1)(c) and (f)

We do not sell your data, we do not use it for personalised advertising and we do not make automated decisions that have legal effects on you. Automatic filters (for example the ones that remove phone numbers from listing texts) only flag or correct content; decisions about accounts are made by people.

4. What is public on the site

Listings are public: text, photos, price and town. The map shows only an approximate area a few hundred metres across; the street and number appear only if you choose "Show the exact location". The phone number appears only when a visitor presses the button to see it. The public profile shows your name, the date you joined, your active listings and the reviews you received; for a company account, the company page shows the company details you entered. Reviews you write appear with your name. Listings and the public profile can also be found through search engines (for example Google), which may keep them in their results for a while after you delete them.

5. Who we share data with

Other users: messages reach their recipient; if you write to a company, the members of the company's team see the message.
Providers working for us (processors, under contract): Hetzner Online GmbH (servers, data centre in Finland, EU); Resend (Plus Five Five, Inc., USA; sending e-mails, from the EU region); mailbox.org (the site's mailboxes, Germany).
Google and Facebook (Meta), only if you choose to sign in with their account.
Google Analytics, only if you accept analytics cookies.
OpenStreetMap (the OSMF foundation): maps and address search are loaded from their servers, which receive your browser's IP address and the area shown; addresses entered in forms are sent to the Nominatim service to find them on the map.
The browsers’ notification services (Google for Chrome, Edge and Android, Mozilla for Firefox, Apple for Safari, Microsoft for Windows), only if you turn notifications on: they receive the encrypted notification, which they cannot read, and deliver it to your device.
WhatsApp, only when you open a WhatsApp chat with a seller.
Authorities, when the law requires it (for example at the request of a court or the police).

6. Transfers outside the European Economic Area

Google, Meta and Resend may process data in the United States. These transfers are based on the EU–US Data Privacy Framework, under which they are certified, and on the European Commission's standard contractual clauses. The OpenStreetMap Foundation is in the United Kingdom, for which the European Commission has recognised an adequate level of protection.

Notifications on your device may pass through servers outside the EU of your browser’s notification service; their content is encrypted from us all the way to your device.

7. How long we keep the data

An account not confirmed by e-mail is deleted after 3 days.
A closed account can be reopened by logging in for 30 days; after that it is anonymised: the name becomes "Deleted user", and the e-mail, phone, address and picture are deleted, as are favourites, saved searches and the company page. Listings are deleted with their photos; messages and reviews stay with the other users, without your name.
An ended listing (sold, rented, unavailable) stays visible for 90 days, then its address points to similar pages; you can delete it at any time.
An account nobody has logged into for 3 years is anonymised the same way. Its listings that were public stay on the site as an archive, without the seller's name, phone, exact address or links and without any way to contact them; we delete them on request. The account of a company that publishes through the API, a feed or a CRM is not considered inactive while these are in use.
Messages sent through the contact form: 12 months.
Conversations between users are deleted, with their messages, 3 years after the last message.
E-mail log: 90 days. Account activity days: 90 days.
Security logs: 14 days. Log of administrators viewing accounts for support: 365 days.
Notifications on a device: until you turn them off, log out on that device, the browser cancels them or the account is closed.
Searched words (not linked to any person): 400 days.
The login session expires after 120 minutes of inactivity; "Remember me" lasts at most 400 days.
Other account data is kept as long as you have the account, then as above. We keep data longer only where the law requires it or where it is needed in an ongoing dispute.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest and to withdraw your consent at any time, without affecting the processing carried out before. You can exercise many of them directly in your account:

change your data in Profile and on the company page;
download a copy of your data, as a JSON file, with the "Download my data" button in Profile;
close your account in Profile;
stop alerts and reminders in your account or through the link in every e-mail;
change your cookie choice in "Cookie settings", at the bottom of the page.

For any other request, write to contact@ocasio24.com from your account's address. We answer within one month at the latest. If you are not satisfied, you can lodge a complaint with the data protection authority competent for the controller (see the Legal notice) or with the authority of the country where you live or work.

9. Minimum age

Only people aged 18 or over can create an account. We do not knowingly collect data about minors; if you learn that a minor has an account, write to us and we will delete it.

10. Data security

The site uses encrypted connections only (HTTPS), passwords are stored only as irreversible hashes, access to data is limited to the people who need it, and administrators viewing accounts for support can only look, and every such access is logged.

11. Changes

When we change this policy, we update the date above and, if the change is important, we let you know in your account.