Joint Controller Agreement

Joint Controller Agreement — Summary for Data Subjects

This page summarises the arrangement between CasaVanguardia (operated by Far Horizons OÜ, Estonia) and the estate agents and agencies listed on the platform regarding the processing of your personal data when you submit a property inquiry.

Under Article 26 of the General Data Protection Regulation (GDPR), when two or more controllers jointly determine the purposes and means of processing personal data, they are “joint controllers” and must document their arrangement. The essence of this arrangement must be made available to data subjects.

1. Parties

2. Scope

This arrangement applies to the processing of property inquiry personal data only:

• Name
• Email address
• Phone number (if provided)
• Message content
• Source attribution data (which listing, which page)

This arrangement does not apply to account registration data, browsing analytics, or payment data, which are processed by CasaVanguardia alone as sole controller.

3. CasaVanguardia’s Responsibilities

CasaVanguardia is responsible for:

• Collection: Providing the inquiry form on the platform and collecting the data you submit
• Storage: Storing inquiry data securely in our database (encrypted at rest via Cloudflare D1)
• Transmission: Forwarding your inquiry data to the relevant agent or agency
• Data subject rights: Providing an interface for you to exercise your rights (access, erasure, portability, rectification)
• Security: Maintaining appropriate technical and organisational measures to protect inquiry data
• Breach notification: Notifying agents of any data breach affecting inquiry data within 24 hours

4. Agent’s Responsibilities

The receiving agent or agency is responsible for:

• Purpose limitation: Processing your inquiry data only for the purpose of responding to your property inquiry
• Confidentiality: Not sharing your inquiry data with unauthorised third parties
• Retention: Deleting your inquiry data when it is no longer necessary for the inquiry purpose
• Cooperation: Cooperating with CasaVanguardia on data subject rights requests within 5 business days
• Security: Maintaining appropriate security measures for any inquiry data they receive
• Breach notification: Notifying CasaVanguardia of any data breach affecting inquiry data without undue delay

5. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your inquiry data:

• Right of access (Art. 15) — Request a copy of the inquiry data held about you
• Right to rectification (Art. 16) — Correct inaccurate data
• Right to erasure (Art. 17) — Request deletion of your inquiry data
• Right to restriction (Art. 18) — Request that processing be restricted
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format
• Right to object (Art. 21) — Object to processing based on legitimate interest

You may exercise any of these rights against either controller:

• CasaVanguardia (primary contact): privacy@farhorizons.io
• The agent/agency: Using the contact details displayed on their listing or agency profile

If you contact the agent directly, they are required to forward your request to CasaVanguardia within 5 business days so that it can be processed across both systems.

6. Data Retention

7. Liability

Each party is liable for its own processing activities. As a data subject, you may bring a claim against either controller for damages resulting from a violation of the GDPR (Art. 82). Either controller that is held liable for the full damage may seek contribution from the other controller in proportion to their responsibility.

8. Contact

For questions about this joint controller arrangement or to exercise your data rights:

This summary is provided in accordance with GDPR Article 26(2). The full joint controller agreement between CasaVanguardia and each agent/agency is incorporated into the Agent Terms of Service.

Last updated: 16 February 2026