Privacy Policy

1. What data we collect

• When you contact us through the form: your name, email, phone number (optional), subject, message and, where applicable, the property you are interested in. We also record the language and the page of the website from which you sent the request.
• When you contact us by WhatsApp, phone or email: the data you share with us in that conversation.
• If you are our client (buyer, seller, landlord or tenant): identification and contact details, tax number, marital status and property regime (where the deal requires it), details of the property and its documents (land registry and tax records, energy certificate) and the terms of the deal.
• Under our legal anti-money laundering obligations: a copy of your identity document, occupation, source of funds, the beneficial owner (for companies) and whether you are a politically exposed person.
• When you use the website’s AI assistant: the messages you write and the answers it generates. The conversation only exists while the page is open and is not stored, neither by us nor in your browser; to generate the answers, the messages are sent to the AI model provider (see section 5). Please do not write personal data in the assistant.
• Anonymous usage statistics: pages viewed, clicks on the contact buttons, the website you came from (for example, google.com) and the type of device (phone, tablet or computer). We do not store IP addresses, we do not use cookies and we do not build visitor profiles.
• Technical data: our hosting providers may log technical data, such as your IP address, for a limited period to keep the website secure and prevent abuse.

2. Why we use your data and on what legal basis

We do not use your data to send you advertising without your express consent, we do not sell or rent it, and we do not reuse it for purposes other than those for which it was collected.

3. How long we keep your data

• Contact requests: for as long as needed to reply to you and follow up your interest and, after that, only for as long as required to meet legal obligations or to establish or defend legal claims. You can ask us to delete them at any time (see section 7).
• Brokerage agreements and deal data: while the agreement is in force and, after that, for the applicable limitation period.
• Data collected to prevent money laundering: 7 years after the end of the business relationship or transaction (Article 51 of Law No. 83/2017).
• Accounting and tax records: 10 years.
• Anonymous statistics do not identify anyone.

4. Cookies and local storage

This website does not use advertising, analytics or social media cookies, so you do not need to accept cookies to browse it.

• The website stores nothing on your device: it uses no cookies, local storage or similar technologies.
• The team’s private area (management panel) uses a session cookie, which is needed to sign in. It is not used for anything else.
• The maps on property pages are loaded from OpenStreetMap, which receives your IP address in order to send the map images.

5. Who we share data with

We use providers that process data only on our behalf, following our instructions and with appropriate safeguards:

• Vercel Inc. — website hosting (the website’s functions run in the Dublin, Ireland region);
• Supabase — the database where contact requests are stored (Ireland region, European Union);
• Cloudinary — hosting of the property photographs;
• Vercel AI Gateway and Anthropic — generating the AI assistant’s answers (messages are processed to produce the reply and are not used to train models);
• the agency’s email provider, to notify us of new contact requests.

Where any of these providers processes data outside the European Economic Area, the transfer takes place with the safeguards set out in the GDPR — for example, a European Commission adequacy decision or standard contractual clauses.

In the course of a deal, and only as far as necessary, we also share data with the other party; with notaries, lawyers, solicitors and registry offices involved in the deed; with banks and credit intermediaries, when you ask us for help with financing; and with other agencies sharing the deal with us, if you allow it.

By law, we report the transactions we take part in to IMPIC (the regulator of real estate brokerage) and, where the law requires, report suspicious transactions to the Financial Intelligence Unit and the DCIAP. We may also disclose data to judicial, police or administrative authorities where required by law or by court order.

6. How we protect your data

The website is always served over an encrypted connection (HTTPS). Contact requests are only accessible to the agency’s team, through personal accounts with passwords, and access to the panel is blocked after several failed attempts. Although we take appropriate precautions, no computer system is completely secure.

7. Your rights

Under the GDPR, you may at any time ask us for:

• Access — to know whether we process your data and obtain a copy;
• Rectification — to correct inaccurate or incomplete data;
• Erasure — to delete your data where one of the grounds set out in the law applies;
• Restriction of processing, in the cases provided for by law;
• Objection to the processing of your data;
• Portability — to receive your data in a structured, commonly used format;
• Withdrawal of consent, without affecting processing carried out before the withdrawal.

Some rights may be limited where the law requires: for example, data collected to prevent money laundering must be kept for the legal period, and the law forbids telling the data subject about reports made to the authorities in that context.

To exercise these rights, write to info@winwin-property.pt. You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

8. Children

The website is not directed at children under 16. We ask them not to send us personal data through the website, social media or email.

9. Sensitive data

Please do not send us sensitive personal data (for example, about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation). If we receive it anyway, it will be deleted.

10. Third-party websites

The website links to third-party services — such as WhatsApp, Instagram, Google Maps and the Portuguese Complaints Book. When you open them, their own privacy policies apply, for which Win Win Property is not responsible.

11. Changes to this policy

We may update this policy at any time. The version in force is always the one published on this page, with the date of the last update.

12. Contact

For any questions about this policy or your data, please contact us in writing at info@winwin-property.pt.