Privacy policy.

1. Controller and contact.

The controller is CARISMA ELEGANTE UNIPESSOAL LDA, NIPC 519331575, registered at Rua Virgílio Correia, n.º 17 B, 1600-203 Lisboa, trading as RIDIUM Imobiliária. For privacy questions or rights requests, email [email protected] or write to the registered office. No legal wording is needed.

2. Scope and current operation.

This notice covers the website and enquiries initiated through it. Forms are local tests, receive fictitious data only and send no emails. There is no live public enquiry collection in this version.

Providers, access, processing locations and safeguards will be verified and this information updated before activation. An eventual agency relationship has its own obligations and notices at the appropriate stage.

3. Data, purposes and lawful bases.

Sale or estimate requests: name, email, mobile number, approximate area and property type are required; a message is optional. In an active service, these support an email response, a mobile contact for follow-up, understanding the request and pre-contractual steps requested by you — GDPR Article 6(1)(b). The form cannot be processed without mandatory fields; no civil or banking identification is needed here.

The chosen form language is recorded with the enquiry to help respond appropriately. This does not subscribe you to marketing.

Other enquiries: content and contacts are used to reply under the legitimate interest of managing communications, balanced against your rights — Article 6(1)(f). Rights requests and legal duties rely on the relevant obligation — Article 6(1)(c).

Security: technical data needed for communications and abuse prevention, such as an IP address, protect the service under that legitimate interest. Test limits are temporary in memory, not advertising or profiling. See the cookie policy.

4. Marketing and automated decisions.

Enquiries do not enrol visitors in newsletters or marketing. There is no behavioural advertising, scoring, solely automated decision with legal or similarly significant effects, or automatic valuation calculator.

If an optional purpose requires consent in future, it will be explained and requested separately. Withdrawal will not affect earlier processing or the service enquiry response.

5. Access, providers and disclosures.

Fictitious test enquiries remain in the local database; private access is for RIDIUM’s owner only. They are not sent to CASAFARI and contacts are not sold.

Future public hosting/API on DigitalOcean, data/authentication on Supabase and email on Zoho are planned, not currently connected recipients of form tests. An email you voluntarily send to [email protected] is handled through the professional Zoho mailbox.

Where applicable, strictly necessary disclosures may be made to providers subject to data protection duties and legally competent entities. Actual arrangements and processors will be checked before activation.

6. Location and international transfers.

Form tests are local. The future EU database region is not yet selected. Other service locations, support access and subprocessors must also be assessed: an EU region alone does not establish the absence of transfers outside the EEA.

Transfers subject to GDPR Chapter V require an appropriate basis and safeguards, with the relevant information provided. Destinations, adequacy decisions or other safeguards will be confirmed before the dependent processing is activated. You may request further information using the privacy contact.

7. Retention.

For a real sale enquiry, data are kept while needed to respond and follow up on the steps requested. Once closed, only information needed for a legal obligation or the establishment, exercise or defence of rights may be retained for the applicable period, with restricted access. Retention does not authorise continued marketing.

Periods depend on purpose and circumstances; an agency contract’s or identity document’s retention period does not automatically apply to every enquiry. If a contract is made, the notice for that relationship will identify the relevant duties and periods.

Operational deletion, exports and backups will be validated before real data. Fictitious tests are not commercial records. Cookie choice lasts up to 180 days; private session limits appear in the cookie policy.

8. Rights and complaints.

Subject to the legal conditions, you may request access, rectification, erasure, restriction and portability and object to processing, particularly on legitimate interests grounds. Rights do not override legal retention duties or third-party rights.

Email [email protected]. The usual response period is one month; a legally permitted extension will be explained within that period. Additional identification is requested only where necessary and proportionate.

You can complain to the Portuguese data protection authority — CNPD, without prejudice to other remedies. See CNPD information on rights.

9. Security, links and changes.

Restricted access, validation and data minimisation form part of preparation; no system is risk-free. Report security concerns by email without sending credentials or other people’s data. External links do not load those websites automatically; their policies apply when visited.

This notice will be revised when purposes or operation change, with a date and further communication where required. Framework: Regulation (EU) 2016/679 and Portuguese Law 58/2019.