Privacy Policy

1. Introduction

Durgesta Investimentos, Lda. respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your personal information, in accordance with the General Data Protection Regulation (GDPR) and other applicable legislation.

2. Data Controller

3. Personal Data Collected

3.1 Data Provided Directly

We collect the following data when you contact us or use our services:

• Identification data: Name, surname
• Contact data: Email, phone, address
• Professional data: Company, position (where applicable)
• Preferences: Property type, location, budget
• Communications: Messages sent through forms

3.2 Data Collected Automatically

• Technical data: IP address, browser type, operating system
• Browsing data: Pages visited, time spent
• Cookies: As per our Cookie Policy

3.3 Data Obtained from Third Parties and Public Sources

We may process personal data obtained from public sources (e.g., records and documentary databases related to properties) and from partners (e.g., real estate agencies, listing platforms, co-brokers), where permitted by law.

Data categories: identification and contact, professional data, information about lease/purchase/sale needs and property characteristics.

When data is not obtained directly from the data subject, we provide the information set out in Article 14 of the GDPR, namely the source and categories of data, within the applicable legal timeframe (at the latest by the time of first contact).

4. Purposes of Processing

4.1 Service Provision

• Responding to information requests
• Scheduling property visits
• Providing real estate consultancy
• Processing real estate transactions

4.2 Marketing and Communication

• Sending newsletters and commercial communications with prior consent (opt-in)
• Soft opt-in for existing customers on similar products/services, ensuring opt-out in each message
• Market and satisfaction studies

4.3 Legal Compliance

• Compliance with tax and regulatory obligations
• Fraud prevention and detection
• Legal documentation archiving

4.4 Anti-Money Laundering (AML/CFT)

• Customer/counterparty identification and due diligence, under applicable legal requirements

5. Legal Basis for Processing

The processing of your personal data is based on:

• Consent: For direct marketing and non-essential cookies
• Contract performance or pre-contractual steps: For provision of requested services
• Legitimate interest: For service improvement, security and B2B/B2C relationship management, without prejudice to your rights
• Legal obligation: For tax and regulatory obligations, including AML/CFT

6. Data Sharing

We may share personal data with the following categories of recipients:

• IT and cloud providers: hosting, email, storage, maintenance
• Analytics and marketing platforms: traffic measurement, newsletter delivery
• CRM and productivity tools: contact and process management
• Professional consultants and service providers: legal, accounting, tax
• Real estate sector entities: notaries, banks, insurers, agencies/co-brokers, contractors and specialized technicians
• Public authorities and regulators: when legally required

We enter into data processing agreements with subcontractors, ensuring confidentiality, security and compliance. We do not sell personal data to third parties.

7. International Transfers

Your data is preferably processed within the European Economic Area (EEA). When we use providers located outside the EEA (for example, cloud, email or analytics services), we ensure adequate safeguards, namely EU-approved Standard Contractual Clauses and a Transfer Impact Assessment (TIA), as well as supplementary technical and organizational measures where appropriate.

8. Data Retention

We retain your personal data for as long as necessary for:

• Active customer data: During the commercial relationship
• Contractual and tax data: For the legal retention periods (generally up to 10 years)
• Marketing data: Until consent is withdrawn or objection is raised
• AML/KYC data: For the legally required period, up to 7 years after the end of the relationship

9. Data Security

We implement technical and organizational measures to protect your data, including:

• Data encryption in transit and at rest
• Role-based access control
• Regular monitoring and auditing
• Team training in data protection
• Security incident response plans

In the event of a personal data breach likely to pose a risk to the rights and freedoms of data subjects, we will notify the CNPD and, where required, the affected data subjects, in accordance with legal requirements.

10. Your Rights

Under the GDPR, you have the right to access, rectification, erasure, restriction, portability, objection (including to direct marketing) and the right to withdraw consent at any time, where processing is based on consent.

We respond to rights exercise requests within 1 month of receipt, extendable by up to 2 months in complex cases, informing you of the reasons for the extension. The exercise of rights is, as a rule, free of charge; we may charge a reasonable fee when the request is manifestly unfounded, repetitive or excessive. For your security, we may request additional information to confirm your identity.

To exercise these rights, contact us at: info@durgesta.com

11. Complaints

If you consider that your rights have been violated, you may lodge a complaint with the National Data Protection Commission (CNPD):

12. Minors

Our services are not intended for minors under 13 years of age. We do not knowingly collect personal data from minors. If we make information society services available to minors, we will observe the applicable age of consent in Portugal (13 years) and, where necessary, obtain verifiable consent from those exercising parental responsibilities.

13. Policy Changes

We may update this Privacy Policy periodically. Significant changes will be communicated through the website or by email. We recommend that you regularly consult this page.

14. Contact

For questions about data protection or to exercise your rights:

15. Automated Decisions and Profiling

Currently, we do not carry out automated individual decision-making, including profiling, that produces effects on the legal sphere of data subjects or that significantly affects them in a similar manner. Should we adopt such practices, we will provide clear and additional information on the logic involved and the associated rights, including the right to obtain human intervention.