Privacy policy

Who is responsible

Controller: [to be published]. Tax ID (NIF): [to be published]. Address: [to be published]. Contact: [to be published].

CasaJusta Lanzarote is a non-profit citizen project (it is not an association).

What data we collect (and what we don't)

When you add a case we store only: municipality, month (never the day), rental type, whether the price comes from a contract or a listing, square metres, monthly price, previous price if you give it, and the abuses you tick.

We do not ask for or store your name, email, phone, address or plain IP. Cases cannot be used to identify anyone.

If you tick "Other" you can write a short text (up to 200 characters). That text is never published: only the team reads it, to improve the list of abuses. Before saving it we automatically remove emails, phone numbers and links. Please do not include names or addresses.

To prevent mass submissions we keep, for 24 hours, a (non-reversible) HMAC hash computed from your IP and browser. After 24 hours it is deleted.

We also store the exact time of submission with the case, only to detect manipulation. It is never published.

Why

To publish aggregated statistics (medians and percentages) by municipality and period, always with at least 5 cases behind them. We never publish individual cases.

Legal basis: cases are anonymous data. The temporary device hash is processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) to protect the observatory against abuse.

Anti-bot verification

We use Cloudflare Turnstile to check that a person is submitting. Cloudflare processes technical data from your browser for that check under its own privacy policy. We do not use advertising or tracking cookies.

How long

Anonymous cases are kept while the observatory is active, because they form the historical series. The device hash, 24 hours. Cases discarded as manipulation may be deleted at any time.

Where it is stored

The website is hosted on Vercel and the database on Neon (Postgres). Both act as data processors.

Your rights

Because cases contain no identifying data, we cannot link them to a person. For any questions, write to [to be published]. You can file a complaint with the Spanish Data Protection Agency (aepd.es).