Kasa24 Ltd ("Kasa24", "we", "us", "our") is the data controller responsible for your personal data. We are a property advertising platform registered in England and Wales.
Registered company name: Kasa24 Ltd
Company registration number: 14 XXX XXX
Registered address: Kasa24 Ltd, Manchester Technology Centre, Oxford Road, Manchester, M1 7ED
ICO Registration number: ZA123456
We collect personal data in the following categories depending on how you use Kasa24:
Identity & Contact Data
- Full name, email address, phone number
- Property address (for listing purposes)
- Company name and registration number (for agencies)
- Job title and professional memberships
Account & Technical Data
- Login credentials (password stored as a secure hash — never in plain text)
- IP address, browser type, device type
- Session data and usage logs
- Pages visited, search queries, listing views
Property Listing Data
- Property photographs, descriptions, pricing
- Property attributes (bedrooms, bathrooms, EPC rating, etc.)
- Listing publication history and modifications
Communications Data
- Enquiries sent via the platform between buyers/tenants and listers
- Support messages and email correspondence
- Feedback and survey responses
Financial Data
- Subscription plan selection
- Payment processing is handled by our third-party payment provider (Stripe) — we do not store card numbers or full payment details
We use your personal data for the following specific purposes:
| Purpose | Data Used | Lawful Basis |
|---|---|---|
| Creating and managing your account | Name, email, password | Contract |
| Publishing your property listing | Address, photos, description, price | Contract |
| Sending email verification codes | Email address | Contract |
| Processing subscription payments | Plan selection, billing info | Contract |
| Facilitating buyer/tenant enquiries | Name, email, message content | Contract |
| Providing customer support | Name, email, correspondence | Legitimate Interest |
| Improving platform performance | Usage data, search queries | Legitimate Interest |
| Fraud prevention & security | IP address, session data | Legitimate Interest |
| Sending marketing emails (opt-in) | Name, email | |
| Legal compliance & audit | Account and transaction records | Legal Obligation |
Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:
Contract (Article 6(1)(b))
The majority of our processing is necessary to perform our contract with you — i.e. to provide the Kasa24 platform services you have signed up for. Without this processing, we cannot deliver the service.
Legitimate Interests (Article 6(1)(f))
We process some data based on our legitimate interests as a business — such as improving the platform, preventing fraud, and providing customer support. We have conducted Legitimate Interest Assessments (LIAs) for each of these activities and determined that our interests do not override your rights and freedoms.
Consent (Article 6(1)(a))
Where we rely on consent — such as for marketing emails — you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
Legal Obligation (Article 6(1)(c))
In some cases, we are required by law to retain certain data — for example, financial transaction records for HMRC purposes.
We never sell your personal data to third parties for their own marketing or commercial purposes. We share data only in limited circumstances:
Service Providers (Processors)
We share necessary data with trusted third-party processors who help us operate the platform. All processors are bound by Data Processing Agreements (DPAs) and must handle your data in compliance with UK GDPR:
- Stripe — Payment processing (PCI DSS compliant)
- Amazon Web Services (AWS) — Cloud hosting and data storage (UK/EU regions)
- SendGrid / Mailgun — Transactional email delivery
- Cloudflare — Security, CDN and DDoS protection
- Google Analytics — Anonymised usage analytics
- Intercom — Customer support chat (data minimised)
Legal Disclosure
We may disclose your data where required by law, court order, or regulatory authority — for example, in response to a valid request from the police or HMRC. We will notify you where legally permitted to do so.
Business Transfers
In the event of a merger, acquisition, or sale of Kasa24's business, personal data may be transferred as part of that transaction. We will notify you before your data is transferred or becomes subject to a different privacy policy.
We use cookies and similar technologies to make Kasa24 work properly and to understand how you use it. You can manage your cookie preferences at any time.
As a data subject under UK GDPR, you have the following rights. We will respond to all valid requests within 30 days.
We retain personal data only for as long as necessary for the purposes it was collected. Our retention schedule is as follows:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account data (active users) | Duration of account + 12 months | Service provision |
| Listing data | 3 years after listing expires | Market data & dispute resolution |
| Financial transaction records | 7 years | HMRC legal requirement |
| Enquiry / message data | 2 years | Dispute resolution |
| Support correspondence | 3 years | Service improvement |
| Marketing preferences (opted in) | Until consent withdrawn + 1 year | Legal basis record-keeping |
| Security & access logs | 90 days | Fraud prevention |
| Deleted account data | 30 days (then purged) | Accidental deletion recovery |
When retention periods expire, data is securely deleted or anonymised. We conduct annual data audits to ensure compliance with this schedule.
Kasa24 is a UK-based platform and we store the vast majority of data on UK and EU-based servers. However, some of our third-party service providers may process data outside the UK and EEA.
Where international transfers occur, we ensure they are protected by one of the following safeguards:
- UK Adequacy Regulations — transfers to countries with an adequacy decision from the UK Secretary of State
- International Data Transfer Agreements (IDTAs) — the UK equivalent of Standard Contractual Clauses (SCCs)
- Binding Corporate Rules (BCRs) — where applicable for multinational processors
Kasa24 is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information without parental consent, please contact us immediately at privacy@kasa24.com and we will promptly delete the information.
Our terms of service require all users to confirm they are 18 or over before registering an account.
We take data security seriously and implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security measures include:
- Encryption in transit: All data transmitted between your browser and Kasa24 uses TLS 1.3 encryption (HTTPS)
- Encryption at rest: Databases are encrypted using AES-256
- Password security: Passwords are hashed using bcrypt — we never store passwords in plain text
- Access controls: Role-based access controls limit which staff can access personal data
- Regular penetration testing: Annual third-party security audits
- Two-factor authentication: Available for all agency accounts
- Data breach procedures: We have a documented incident response plan and will notify the ICO within 72 hours of becoming aware of a breach where required
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make significant changes, we will:
- Update the "Last updated" date at the top of this page
- Send a notification email to all registered users
- Display a prominent notice on the Kasa24 platform for 30 days
Your continued use of Kasa24 after the effective date of any changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.
If you have any questions about this policy, want to exercise your data rights, or wish to raise a concern, please contact our Data Protection team:
Kasa24 Ltd, Manchester Technology Centre,
Oxford Road, Manchester, M1 7ED