Datenschutzerklärung
Privacy Policy
Secret Properties S.L. · C/ de la Llotgeta 14, AT, 07002 Palma de Mallorca · NIF: ES-B72424104
This notice explains what personal data Casa Uno collects across this website, the owner portal, and our messaging channels, why we process it, who we share it with, and the rights you have over it. For our registered company details, see our Legal Notice. For the specific cookies this website sets, see our Cookie Policy.
1. Who is responsible for your data
Casa Uno is operated by Secret Properties S.L., a company registered in Spain (NIF ES-B72424104, registered office C/ de la Llotgeta 14, AT, 07002 Palma de Mallorca). Secret Properties S.L. is the data controller for the processing described here. Full registered details are in our Legal Notice.
2. What data we collect, and why
- If you contact us or chat with MYLO on this website — your name, email, any message you type, and the options you pick (such as the kind of help you are looking for and your area), so we can answer you or assess whether Casa Uno is a fit.
- If you ask MYLO to hold a call — your name, email, and, only if you volunteer them, your property area, property type, and a note, so we can prepare for and confirm the call.
- If you open the Owner Portal demo — your name and email, so we can follow up about the demo. Before the demo opens we email a one-time code to that address, to confirm it is yours; the code is not stored.
- If you become a Casa Uno owner — the account, property, service-request, and messaging data needed to deliver the service you have contracted us for.
- If you browse this website — pseudonymous measurement of which pages and sections are read. Until you make a choice in the cookie banner, only cookieless measurement pings are sent; choosing "Anonymous" stops them, and choosing "Familiar" also allows analytics cookies. See our Cookie Policy.
3. Legal basis
We rely on the following legal bases under the GDPR and Spanish LOPDGDD:
- Contract performance — for data processed to deliver the Casa Uno service to existing owners, and to handle a booking request you initiate.
- Consent — for the website chat, the lead/contact form, and all non-essential analytics. You may withdraw consent at any time.
- Legitimate interests — for fraud prevention and security logging within the owner portal.
- Legal obligation — where retention is required under Spanish law.
4. Who we share your data with
We use a small number of specialist providers to run Casa Uno, described below by category. None of them may use your data for their own purposes. The specific companies behind each category, and the contractual safeguards we have in place with them, are set out in our data-processing agreements rather than on this page — write to us if you would like to know more about a particular one.
Database, authentication and hosting providers
Store and run the Casa Uno product — this is where owner accounts, property records, service requests, and messages are held, and where the application itself runs. Hosted in the EU; one of these providers has a US parent company.
Email delivery providers
Send account notifications and service-related messages to owners, deliver the notification email generated when you send an enquiry or book a call on this website, and send the one-time code that opens the Owner Portal demo. The provider behind our emails to owners keeps account data and delivery logs in the United States, covered by Standard Contractual Clauses; enquiry and booking emails from this website go through a provider in the EU.
WhatsApp Business (Meta)
We use WhatsApp Business as a communication channel with property owners and guests. Messages, phone numbers, and any property information you share via WhatsApp are processed by Meta Platforms Ireland Ltd. in accordance with their Business Terms of Service. Named specifically, unlike the categories above, because it is a channel you use directly rather than infrastructure behind the scenes.
AI processing providers
Power the MYLO chat on this website — what you type is sent to a language model so it can answer you — and Ask MYLO in the owner portal, which answers an owner's questions from that owner's own property, request, and visit records. We also use it to draft messages to owners, which our team reviews before anything is sent. Processing takes place in the EU, but the provider has a US parent company, so access by US authorities cannot be ruled out entirely. We do not send sensitive personal data to AI models, and the website chat has no access to any owner account, property record, or address.
Scheduling providers
If you ask MYLO to hold a time for a call, we write a provisional calendar entry carrying the details you gave for the booking, and send the same details to our team by email. A hold that is never confirmed is deleted once its call date is more than 90 days past; the deletion runs the next time anyone books a call, so it can happen later than that. A call we confirm stays in our calendar as an appointment. We have not verified where this provider stores calendar data.
Analytics providers
Measure which pages and sections of this website are read. Until you make a choice in the cookie banner, only cookieless measurement pings are sent and no analytics cookies are set; choosing "Anonymous" stops those pings too, and choosing "Familiar" allows analytics cookies. Pages still download the analytics script from the provider's servers, so the provider can see your IP address even after you choose "Anonymous". No name, email, or message content is ever included. The provider may transfer this data to the United States under Standard Contractual Clauses — see our Cookie Policy for the specific cookies involved.
5. International data transfers
Most of our providers process data within the EU. The exceptions are the provider behind our emails to owners, which keeps account data and delivery logs in the United States, and our analytics provider, which may transfer data to the United States; for both we rely on the EU's Standard Contractual Clauses. WhatsApp, our AI provider, and one of our hosting providers belong to groups with a US parent company, so access by US authorities cannot be ruled out entirely. We have not verified where our scheduling provider stores calendar data.
6. How long we keep your data
- Owner, property, and service-request data: for as long as you have an active service relationship with Casa Uno and for 90 days after it ends, then deleted. Records the law requires us to keep, such as invoices and formal business correspondence, are kept for the required period, and records of who accessed or changed data are kept as a security audit trail. You can also ask us to delete your data sooner — see "Your rights" below.
- Enquiries sent through this website (including the booking details emailed to our team): until conversion or six months, whichever comes first.
- MYLO chat messages: not stored by Casa Uno at all — processed only for the duration of generating a reply.
- Discovery-call booking holds: deleted once the call date is more than 90 days past, as described under "Scheduling providers" above.
- Analytics data: up to 14 months. The analytics cookies themselves can last up to 24 months — see our Cookie Policy.
- Cookie consent record: up to 12 months, stored only in your browser.
7. Your rights
Under the GDPR and LOPDGDD you have the right to: access your personal data; request rectification or erasure; object to or restrict processing; withdraw consent at any time; and lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es.
To exercise any of these rights, contact us at office@mycasauno.com or in writing to our registered address.
8. Cookies
This policy covers what data we process and why. For the specific cookies and browser storage this website uses, the two consent tiers, and how to change your choice at any time, see our Cookie Policy.
9. Changes to this policy
We may update this Privacy Policy as our services evolve or legal requirements change. The date of the most recent revision is shown at the top of this page.