EN
1. Who is the data controller
The controller of the personal data collected on this website is Surpresa Plena, a licensed estate agency holding AMI licence 19499, with Portuguese company tax number (NIPC) 515729515 and registered office at Rua Ernesto da Silva 25, 1495-068 Algés, Oeiras, Lisboa.
For any question about your personal data, you can email us at contacto@surpresaplena.com or call us on 962 345 240. Given the size and nature of our business, we are not required to appoint a data protection officer; this is our contact point for everything related to privacy.
2. What data we collect
We only collect the data you give us when you fill in a form on the website, call us or write to us:
- your name and phone number, required on every form, so that we can reply to you;
- your email address, only if you provide it;
- the details of your request: what you need, the location and type of the property, the area and budget of the home you are looking for, or the figures for the mortgage you want to prepare, depending on the form;
- any message you choose to write;
- the language in which you used the website and the page from which you sent the request, so that we can reply in the right language.
The IP address of anyone who sends a form is used only at the moment of sending, to stop automated mass submissions, and is not stored with the request.
Please do not include in your message any data about health, religion, ethnic origin or other special categories of data: we do not need it to reply to your request.
If you contact us on WhatsApp, the conversation goes through the WhatsApp service, which handles the data under its own privacy policy.
3. What we use your data for
We use the data to reply to your request and follow it up: to contact you, value your property, look for a home for you, arrange viewings or prepare your mortgage application.
If the contact leads to an estate agency agreement, the data is also processed to perform that agreement and to comply with the legal obligations of the business, such as the customer identification requirements laid down in the Portuguese anti-money laundering law (Law No. 83/2017).
We do not use the data from requests to send advertising, and we do not sell it or pass it on to third parties for commercial purposes.
Your name and phone number are needed for us to reply to you: without them we cannot follow up your request. All other fields are optional.
4. Our legal basis
- Replying to your request and following it up (a valuation, a property search, a viewing, mortgage support): these are steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR). The box you tick on the form confirms that you have read this policy; it is not a request for consent.
- Performing the estate agency agreement, where there is one (Article 6(1)(b) GDPR).
- Complying with the legal obligations of estate agency, such as customer identification and the reporting of transactions required by the Portuguese anti-money laundering law (Law No. 83/2017), and tax obligations (Article 6(1)(c) GDPR).
We will only ask for your consent for anything that is not part of your request, such as receiving property news by email or SMS, and always in a separate, unticked and optional box. The website does not currently make that request.
5. How long we keep the data
- Requests that did not lead to a contract: [PERIOD, E.G. 12 MONTHS] from our last contact with you. After that they are deleted.
- Estate agency agreements: at least 5 years from signature (Law No. 15/2013).
- Tax documents, such as invoices bearing your name and tax number: 10 years (Portuguese Corporate Income Tax Code, Código do IRC).
- Identification data required by the anti-money laundering law: 7 years from the end of the business relationship (Law No. 83/2017), used for that purpose only.
While a legal retention period is running, any deletion you request can only be carried out at the end of that period. Outside these cases, you can ask for deletion at any time.
6. Who we share the data with
The data is handled by the Surpresa Plena team, only to the extent needed to reply to your request.
We use technical service providers that process the data on our behalf, on our instructions and under contractual confidentiality and security obligations (processors, Article 28 GDPR):
- OVH (OVHcloud), hosting of the website and the database, on servers in the European Union (France);
- Twilio SendGrid, sending of the email that alerts our team to each new request, with servers in the United States (see the next section).
If you ask us for mortgage support, the data needed to assess your case (name, phone number, property value and available deposit) is sent to our partner, Fernandes & Mota Intermediários, Lda (DSIC Algés), a tied credit intermediary with registration no. 0007037 with the Banco de Portugal (the Portuguese central bank). The partner processes that data as a controller in its own right, under its own privacy policy. Without that request, no data is sent to it.
The data may also be disclosed to public authorities where the law requires it, such as IMPIC (the Portuguese regulator of estate agency), the Unidade de Informação Financeira (the Portuguese financial intelligence unit) and the Autoridade Tributária (the Portuguese tax authority).
7. Transfers outside the European Union
The alert email for each request is sent through Twilio SendGrid, in the United States. The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Decision (EU) 2023/1795), to which Twilio has signed up, and on the standard contractual clauses approved by the Commission, which are included in the contract with Twilio. You can check its participation on the official Data Privacy Framework List.
No other data from the forms leaves the European Union.
8. Automated decisions
We do not take decisions about you solely by automated means, nor do we build profiles from your data. Every request is read and handled by a member of our team.
9. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you;
- ask for incorrect or incomplete data to be rectified;
- ask for the data to be erased;
- ask for processing to be restricted;
- receive the data you gave us in a commonly used format and ask for it to be transmitted to another organisation (portability);
- object to processing;
- withdraw at any time any consent you have given us for something optional, such as receiving news, without affecting what was done before.
To exercise any of these rights, email us at contacto@surpresaplena.com or write to us at our registered office. We reply within one month, which may be extended by a further two months for complex requests, in which case we will let you know. Exercising your rights is free of charge. We may ask you to confirm your identity before replying, so that we do not hand your data to someone else.
10. Complaints to the supervisory authority
If you believe that your data is not being processed in accordance with the law, you can lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD, the Portuguese data protection authority): Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, telephone +351 213 928 400, geral@cnpd.pt, or at www.cnpd.pt. We would be grateful if you spoke to us first, so that we can try to resolve the matter.
11. How we protect the data
- All communication with the website takes place over an encrypted connection (HTTPS).
- The personal data in each request (name, phone number, email, message and the other answers on the form) is stored encrypted in the database, and the encryption key is kept separately from it.
- The management area, where the team reads the requests, can only be accessed with a password and has a limit on login attempts.
- Form submission is protected against automated submissions.
13. Changes to this policy
This policy may be updated when the way we handle data or the applicable law changes. The date of the latest update is shown at the top of this page.