Costaia
Sign in

Legal

Privacy Policy

Effective and last updated: 27 September 2026

1. Who controls your data

Costaia is operated by Simpleafied Solutions, a registered trademark, of Jaurisova 515/4, Prague 4, 140 00, Czech Republic, company ID 05190886 (the “controller”, “Costaia”, “we”, “us”, or “our”).

General enquiries: contact@costaia.eu. Privacy enquiries: contact@costaia.eu.

2. Personal data we collect

  • Account data: name, email address, authentication records, and account settings.
  • Saved activity: saved properties, saved searches, and related preferences when you use those features.
  • Property enquiry data: your name, email, optional phone number, preferred language, buying timeframe, financing status, message, property details, consent records, and relevant campaign parameters.
  • Technical data: security, request, device, browser, and server-log information generated when you use the service.
  • Communications: information you provide when contacting Costaia or responding to support correspondence.

3. Why we use personal data

We use personal data to provide accounts and saved features, operate property discovery tools, receive and manage enquiries, maintain security, prevent abuse, troubleshoot the service, communicate with you, and meet legal or compliance obligations.

4. Legal bases

Depending on the activity, we rely on performance of a contract or steps requested before entering one, your consent, our legitimate interests in operating and protecting Costaia and keeping appropriate business records, and compliance with legal obligations. Where processing relies on consent, you may withdraw it for future processing at any time.

5. Property enquiries and agencies

Costaia receives and stores the buyer enquiry you submit. We may then forward it manually to the agency responsible for the relevant listing so that the agency can respond. We do not promise that an enquiry will be delivered automatically or that an agency will respond.

After receiving an enquiry, the agency processes the personal data under its own privacy obligations. Costaia may retain an operational history of the enquiry, forwarding activity, and related communications where reasonably necessary for legitimate business, security, dispute-management, or compliance purposes.

6. Service providers and other recipients

We may share personal data with hosting, database, authentication, email, security, and professional-service providers acting for Costaia, as well as with responsible listing agencies when you request contact. We may also disclose data where required by law, to protect rights or safety, or in connection with a business reorganisation.

7. International transfers

Some providers or agencies may process data outside your country or the European Economic Area. Where data-protection law requires it, we use an approved transfer mechanism or another lawful safeguard and assess supplementary protections where appropriate. You may contact us for information about safeguards relevant to your data.

8. Retention

We retain personal data only as long as reasonably necessary for the purposes described above, including account operation, enquiry handling, security, legal obligations, and the establishment or defence of claims. Retention periods depend on the record type, the relationship with you, and applicable legal requirements. Data is deleted or anonymised when it is no longer needed.

9. Security

We use reasonable technical and organisational measures intended to protect personal data. No internet service is completely secure, so we cannot guarantee absolute security.

10. Your rights

Subject to applicable law, you may have rights to access, correct, delete, restrict, or object to processing of your data; receive portable data; and withdraw consent without affecting earlier lawful processing. You may also object specifically to processing based on legitimate interests.

To exercise a right, contact contact@costaia.eu. We may need to verify your identity. You also have the right to complain to the data-protection supervisory authority in the country where you live or work, or where you believe an infringement occurred.

11. Cookies and analytics

Costaia uses first-party cookies, a first-party event log, and optional third-party analytics services to run and improve the service. Google Analytics and Microsoft Clarity load only after you explicitly accept analytics. We do not use third-party advertising pixels or cross-site advertising tracking.

Authentication cookie (sign-in session)

  • Purpose: keeps you signed in to your account.
  • Lifetime: up to 14 days, or until you sign out.
  • Data stored: an encrypted session token identifying your account -- not your password.
  • First-party. Strictly necessary; set only once you sign in.
  • Core operation: sign-in, saved properties, saved searches, and admin access all depend on it. Browsing, searching, viewing listings, and submitting an enquiry do not require signing in and work without it.
  • If disabled/blocked: you cannot stay signed in, so anything that requires an account stops working. This cookie carries no analytics data, so it has no separate effect on tracking.

Anonymous session cookie (costaia_aid)

  • Purpose: groups activity from the same browser across a visit (for example, to measure how a search leads to an enquiry) without identifying you personally.
  • Lifetime: up to 1 year.
  • Data stored: a random identifier only -- no fingerprinting, no IP-based identity, no cross-device linking.
  • First-party, set by our server when you first arrive.
  • Core operation: not required. Browsing, searching, viewing listings, saving properties (when signed in), and submitting enquiries all work the same with this cookie blocked.
  • If disabled/blocked: individual funnel events (a page view, a save, an enquiry) still record normally, and are still attributed to your account if you’re signed in -- what’s lost is the ability to group an anonymous visitor’s own events together across page loads into one session.

Campaign attribution cookie (costaia_utm)

  • Purpose: if you arrive via a tagged link (for example from an ad or social post), remembers which campaign brought you, so an enquiry you later submit can be credited to it.
  • Lifetime: up to 30 days.
  • Data stored: the campaign source, medium, and campaign name from the link you arrived on, and when it was captured. No personal data.
  • First-party, set by our server only when a link you followed included campaign parameters.
  • Core operation: not required. Submitting an enquiry works identically with this cookie blocked.
  • If disabled/blocked: campaign crediting degrades rather than breaking -- we fall back to whatever campaign parameters are present on the page at the moment you submit an enquiry (last-touch), instead of the first link that brought you to the site (first-touch).

Cookie Consent Choice (costaia_consent_v1)

  • Purpose: remembers your cookie consent preferences for optional analytics cookies.
  • Lifetime: 180 days.
  • Data stored: version, analytics choice (granted or denied), and timestamp. No personal data.
  • First-party, set in your browser when you accept or reject optional analytics cookies.

Google Analytics (optional)

  • Purpose: measures website traffic, search filter usage, and conversion interactions to help us improve Costaia.
  • Operates under Google Consent Mode v2 BASIC behavior -- analytics scripts load and fire strictly after you grant consent.
  • Ad storage, ad user data, and ad personalization features are permanently disabled.
  • You can withdraw or update your analytics consent at any time using the "Cookie settings" link in the site footer.

Microsoft Clarity (optional)

  • Purpose: helps us understand how visitors use Costaia through aggregated interaction analytics, heatmaps, and session recordings so we can find usability problems and improve the product.
  • Clarity loads only after you explicitly accept analytics in Costaia's cookie banner.
  • Clarity may set analytics cookies such as _clck and _clsk. If you withdraw analytics consent, Costaia removes those first-party Clarity cookies and reloads the page without the Clarity script.
  • Session recordings are used for product and usability analysis, not for advertising or cross-site profiling.
  • You can withdraw or update your analytics consent at any time using the "Cookie settings" link in the site footer.

Buyer-funnel event log

  • Purpose: records events such as viewing the homepage, viewing search results, running a search, viewing a property, saving a property, and submitting an enquiry, to power internal measurement (for example, our admin funnel report).
  • Not a cookie -- a server-side record, tied to the anonymous session cookie and, if you’re signed in, your account.
  • Not shared with advertisers and never used for cross-site tracking.

Costaia uses a custom first-party cookie banner allowing visitors to accept or reject optional analytics measurement. Necessary cookies and core platform logs are essential for site functionality, security, and fulfilling buyer enquiries.

12. Changes to this policy

We may update this policy as the service or legal requirements change. The date above shows the latest revision. Material changes will be communicated through an appropriate notice where required.

Please also read our Terms.