Privacy Policy

1. About Casa PH

Casa PH ("we," "us," or "our") is a Philippine-based online real estate platform that connects licensed property brokers with prospective buyers and renters. We act as the Personal Information Controller (PIC) for the personal data we process through our website and services.

2. Data Protection Officer

In accordance with RA 10173, we have designated a Data Protection Officer (DPO) to oversee our compliance with the Data Privacy Act and to serve as your point of contact for privacy-related concerns.

3. Personal Information We Collect

We collect personal information that you voluntarily provide when you use our platform, as well as information gathered automatically. The types of data we process include:

3.1 Information You Provide

• Broker registration data: Full name, email address, phone numbers, PRC license number, government-issued ID details, LinkedIn/Facebook profile URLs
• Property listing data: Listing details, descriptions, images, property addresses, pricing, and features
• Inquiry and tour request data: Name, email, phone number, and message content submitted through contact and scheduling forms
• Reports and feedback: Information you provide when reporting a listing or contacting support

3.2 Automatically Collected Information

• Device and browser information: Browser type, operating system, screen resolution
• Network information: IP address and approximate geographic location
• Usage data: Pages visited, time spent on pages, clicks, search queries, and navigation patterns
• Cookies and similar technologies: Session identifiers, preferences, and analytics data (see Section 9)

3.3 Sensitive Personal Information

We collect government-issued ID numbers (e.g., PRC license, passport, NBI clearance) strictly for broker identity verification. This constitutes sensitive personal information under RA 10173 and is processed only with your explicit consent and solely for verification purposes.

4. Purpose and Legal Basis for Processing

Under RA 10173 and its IRR, we process your personal information based on the following lawful criteria:

5. Data Sharing and Third-Party Services

We share personal information only when necessary and with appropriate safeguards. The following third-party service providers act as Personal Information Processors (PIPs) on our behalf:

• Supabase (Singapore/US): Database hosting, user authentication, and file storage
• Google Maps Platform (US): Interactive maps, geocoding, and nearby places data
• Vercel (US): Website hosting and content delivery

We do not sell, trade, or rent your personal information to third parties for marketing purposes. We may disclose information when required by law, court order, or lawful government request.

6. Cross-Border Data Transfers

Some of our third-party service providers operate outside the Philippines. When your personal data is transferred abroad, we ensure that appropriate safeguards are in place as required by RA 10173 and NPC Circular 2016-02, including contractual clauses that guarantee an adequate level of data protection comparable to Philippine standards. We only transfer data to jurisdictions or entities that meet the adequacy requirements set by the National Privacy Commission.

7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our general retention periods are:

• Active broker accounts: Retained while the account is active and for 3 years after deactivation or last login
• Property listings: Retained while the listing is live and for 1 year after removal or expiry
• Inquiry and tour data: Retained for 2 years from submission
• Analytics and usage data: Aggregated and anonymized after 1 year
• Government IDs (verification data): Retained for the duration of the broker's active account for revalidation purposes; securely deleted within 30 days of account closure

Upon expiry of the retention period, personal data is securely deleted or anonymized so that it can no longer be linked to you.

8. Data Security

We implement reasonable and appropriate organizational, physical, and technical security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These include:

• End-to-end encryption for data in transit (HTTPS/TLS)
• Encryption at rest for stored personal data
• Row Level Security (RLS) policies ensuring brokers can only access their own data
• Passwordless authentication to eliminate credential-based attacks
• Regular access reviews and role-based access controls
• Secure hosting infrastructure with monitoring and intrusion detection

While we strive to protect your personal information, no method of electronic transmission or storage is completely secure. We encourage you to take your own precautions, such as keeping your email account secure.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve our platform. The types of cookies we use include:

• Essential cookies: Required for authentication, session management, and core platform functionality. These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with our website so we can improve the experience. These are only set with your consent.
• Preference cookies: Remember your settings and choices (e.g., search preferences, map view). These are only set with your consent.

You can manage your cookie preferences through the cookie consent banner displayed on your first visit, or by adjusting your browser settings. Disabling non-essential cookies will not affect core platform functionality.

10. Your Rights as a Data Subject

Under RA 10173, you have the following rights regarding your personal information. You may exercise these rights at any time by contacting our Data Protection Officer.

• Right to be Informed: You have the right to know what personal data we hold about you, how it was collected, and how it is being used.
• Right to Access: You may request a copy of the personal data we process about you.
• Right to Correction: You may request the correction of inaccurate, incomplete, or outdated personal data.
• Right to Erasure or Blocking: You may request the deletion or blocking of your personal data when it is incomplete, outdated, falsely obtained, or no longer necessary for the declared purpose.
• Right to Object: You may object to the processing of your personal data, including processing for direct marketing, automated processing, or profiling.
• Right to Data Portability: You may request an electronic copy of your personal data in a structured, commonly used format for transfer to another controller.
• Right to File a Complaint: You may file a complaint with the National Privacy Commission if you believe your data privacy rights have been violated.
• Right to Damages: You may claim compensation for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.

To exercise any of these rights, please email dpo@casaph.com with the subject line "Data Subject Request." We will respond within fifteen (15) days from receipt of your request, as required by law.

11. Data Breach Notification

In the event of a personal data breach that is likely to cause harm to affected data subjects, Casa PH will notify the National Privacy Commission (NPC) and the affected individuals within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 2016-03. The notification will include the nature of the breach, the personal data potentially affected, measures taken to address the breach, and recommendations for affected individuals to protect themselves.

12. Children's Privacy

Our services are not directed to individuals under eighteen (18) years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a minor without verified parental consent, we will take steps to delete such information promptly. If you believe a minor has provided us with personal data, please contact our DPO immediately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Material changes will be communicated through a prominent notice on our website. We encourage you to review this page periodically. Your continued use of the platform after changes are posted constitutes acceptance of the updated policy.

14. National Privacy Commission

If you have unresolved concerns about how we handle your personal data, you may file a complaint with the National Privacy Commission:

15. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: