Privacy Policy

1. Identity and contact details of the data controller

Data controller: SEED THE FUTURE, LDA (Portuguese taxpayer number 515362107), registered office at Odivelas, Portugal, conducting real-estate brokerage activities under licence AMI 23990, under the trading name Jean Paulo Imóveis. For any matter related to data protection you can contact us by e-mail at info@jeanpauloimoveis.com.

2. Data Protection Officer

The single point of contact for all matters relating to the processing of your personal data is info@jeanpauloimoveis.com. We undertake to respond to any request concerning the exercise of the rights set out in the General Data Protection Regulation (GDPR) within 30 days, with a possible extension of a further 60 days where the complexity or volume of requests so requires, in accordance with Article 12(3) of the GDPR.

3. Categories of personal data processed

We collect only the data strictly necessary for each purpose. You can choose not to provide certain data — in that case we may not be able to deliver the requested service.

• Identification and contact data: name, e-mail address, phone number (international format), preferred language and preferred contact channel.
• Intent data: intended use of the property (primary residence, investment, second home) and free-text notes you may share.
• Attribution and browsing data: pages visited, UTM parameters, campaign identifiers (gclid, fbclid), referrer, user agent, truncated IP address and request timestamps.
• Consent records: state of your cookie and marketing preferences, version of the policy accepted, date and channel of consent.
• Contractual data (only for clients moving to CPCV signature): identification document, taxpayer number and details required by the legal regime of real-estate brokerage and by anti-money-laundering rules.

4. Purposes of processing and legal bases

Each purpose has its own legal basis under Article 6 of the GDPR.

• Responding to requests for information and pre-contractual steps — performance of pre-contractual measures at the request of the data subject (Article 6(1)(b)).
• Compliance with legal obligations applicable to real-estate brokerage (AMI regime, anti-money-laundering, invoicing) — legal obligation (Article 6(1)(c)).
• Marketing communications (VIP newsletter, information about new developments) — prior, free, informed and specific consent (Article 6(1)(a)), revocable at any time.
• Aggregate statistical analysis of site and paid-campaign performance — legitimate interest (Article 6(1)(f)) or consent, as required by Portuguese Law 41/2004 and CNPD guidance on non-strictly-necessary cookies.
• Security, fraud prevention and defence of legal rights — legitimate interest (Article 6(1)(f)).

5. Recipients and processors

Your data is not sold to third parties. It is accessed only by the strictly necessary number of staff and processors acting on our behalf, under written contract and confidentiality obligations. The main categories of processors are:

• Hosting, database and e-mail providers, established in the European Union, with safeguards adequate to the GDPR.
• Digital measurement and advertising platforms (traffic analytics, campaign attribution, retargeting) processing only the data necessary and subject to prior consent where required.
• Developer and construction-company partners — only with your express authorisation and exclusively where necessary to fulfil the request.
• Public authorities, where there is a legal duty of disclosure.

6. International transfers

We process your data preferentially within the European Economic Area. Where transfer to a third country is necessary — for example, measurement platforms whose head office is outside the EEA — we carry it out only in two situations: (i) the destination country benefits from a European Commission adequacy decision; or (ii) the transfer is covered by approved standard contractual clauses and, where applicable, the EU-US Data Privacy Framework, combined with supplementary technical and organisational measures.

7. Retention periods

We retain personal data only for as long as necessary for each purpose.

• Information requests and commercial contacts: 3 years from the last interaction, unless you ask for earlier deletion.
• Direct marketing (VIP list): until consent is withdrawn, without prejudice to the legal period for demonstrating proof of consent.
• Contractual and tax documentation required by the AMI regime and anti-money-laundering rules: for the legally fixed periods, typically 7 to 10 years.
• Server technical records and security logs: up to 12 months, in pseudonymised form.
• Records flagged as spam or clearly fraudulent: 6 months, for the defence of legal rights.

8. Rights of data subjects

In the processing of your data, and pursuant to the GDPR, you have the right to:

• Access the personal data concerning you and obtain a copy thereof (Article 15);
• Request rectification of inaccurate or incomplete data (Article 16);
• Request erasure of the data, except where there is a legal obligation to retain (Article 17);
• Request restriction of processing in specific situations (Article 18);
• Receive your data in a structured, commonly used and machine-readable format, or request its transmission to another controller (Article 20);
• Object to processing based on our legitimate interest, including profiling for direct marketing (Article 21);
• Withdraw consent at any time, without compromising the lawfulness of processing carried out on the basis of consent previously given.

9. Automated decision-making and profiling

We do not take decisions with legal or similarly significant effects based solely on automated processing within the meaning of Article 22 of the GDPR. There may be an internal quality classification of inquiries for commercial triage; this classification is purely indicative, is always reviewed by a person before any relevant communication and never replaces your right to be served.

10. Cookies and similar technologies

We use cookies strictly necessary for the functioning of the site and, subject to your consent, analytics, marketing and preference cookies. The detailed description — categories, purposes, duration, provider — is set out in our Cookies Policy, accessible from the footer of every page. Your consent can be reviewed or withdrawn at any time.

11. Information security

We have implemented technical and organisational measures proportionate to the risk: encryption in transit (TLS), encryption at rest at the provider level, granular access controls, multi-factor authentication on management systems, audit logs, environment segregation and periodic security reviews. In the event of a personal-data breach involving risk to your rights, we will notify the CNPD within the legal deadlines and, where applicable, the data subject.

12. Minors

The site and associated services are intended exclusively for persons over 18 years of age. We do not knowingly collect data from minors. If you become aware that a minor has provided us with personal data, please contact us by e-mail so that we can proceed with its deletion.

13. Complaints

Without prejudice to judicial recourse, you have the right to lodge a complaint with the national supervisory authority, the National Data Protection Commission (CNPD), Avenida D. Carlos I, 134, 1.º, 1200-651 Lisbon, www.cnpd.pt. Before doing so, we kindly ask you to contact us by e-mail so we can understand and resolve the situation.

14. Changes to this policy

We reserve the right to update this policy whenever justified, namely to reflect legal, regulatory or operational changes. Updates are published on this page with the corresponding update date. In the event of a substantial change, we will inform data subjects through appropriate means and may seek renewed consent where the legal basis so requires.