Privacy Policy

Paula Brandão respects users' privacy and is committed to protecting personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019 of 8 August (implementing GDPR in Portugal).

1. Data controller

VILLÈ Real Estate — Mediação Imobiliária
AMI licence no. 15973 — IMPIC, I.P.
Registered office: Rua do Pinheiro Manso, 662, Escritório 1.13, 4100-411 Porto
Email: geral@paulabrandao.pt
+351 912 582 904

2. Data we collect

We collect the following data:

• Identification and contact: name, email, phone, tax ID (only when required for invoicing, CPCV or credit contract)
• Communication data: messages sent via the form, WhatsApp or email
• Property data for valuation: address, layout, area, year built, condition, photos
• Mortgage data (only when applicable and with consent): income, debt-to-income ratio, household composition
• Browsing data: IP, browser, operating system, pages visited (via analytics cookies)

3. Purposes and legal bases

We process your data for the following purposes on the following legal bases:

• Responding to enquiries, scheduling viewings and valuations — basis: pre-contractual measures (art. 6(1)(b) GDPR)
• Property mediation (CPCV, deed) — basis: contract performance
• Referral to credit intermediaries and banks — basis: explicit consent
• Invoicing and tax obligations — basis: compliance with legal obligation
• Marketing communications (newsletter, new listings) — basis: revocable consent
• Traffic analytics and fraud prevention — basis: legitimate interest

4. Data retention

Data retention periods:

• Enquiries without contract: 12 months
• Completed mediations: 10 years (tax obligations)
• Referred credit documents: only for as long as strictly necessary; deleted after the referral
• Newsletter: until you unsubscribe
• Browsing logs: 6 months (Portuguese Law 32/2008)

5. Processors

We share strictly necessary data with:

• Banks and credit intermediaries — only with consent, for mortgage simulation and origination
• Insurance providers — life and building insurance linked to the mortgage
• Notaries and land registries — formalisation of deeds and registrations
• Vercel Inc. (USA, certified under the Data Privacy Framework) — website hosting
• Resend Inc. (USA, DPF) — transactional emails
• Portuguese Tax Authority — when legally required

6. Your rights (GDPR)

• Access, rectification and erasure of data
• Portability, objection and restriction of processing
• Withdraw consent at any time (without retroactive effect)
• Lodge a complaint with the Portuguese Data Protection Authority (CNPD) — Av. D. Carlos I, 134 — 1st floor, 1200-651 Lisbon

To exercise these rights please contact geral@paulabrandao.pt. I will respond within the legal 30-day deadline.

7. Security

HTTPS across the whole site, database encrypted at rest, automatic backups, strong authentication access controls and data minimisation applied to each request.