Legal
Privacy policy
Rhamos Properties collects the personal data you enter in the forms on this site and when you subscribe to the newsletter, uses it to reply and to provide the service you asked for, and does not sell it or pass it to developers. You may access, correct or delete that data at any time.
This page sets out each of those points in detail: what is collected, on what legal basis, for how long, who has access, where it may travel outside Europe, and how to exercise your rights.
Draft
Document in preparation
This policy is a working draft. It describes accurately what the site does today, but it has not yet been reviewed by qualified counsel, and the items still outstanding are marked as such throughout the page. Please do not treat it as final until that review is complete.
Draft version of 13 August 2026.
Who is responsible for your data?
The controller is Rhamos Properties. For anything concerning personal data, the address below is the direct route and it is answered.
| Item | Value |
|---|---|
| Controller | Rhamos Properties |
| Contact for personal data | privacidade@rhamosproperties.com |
| General contact | info@rhamosproperties.com |
| Markets served | Portugal, Spain and Dubai |
Three identifying details are not yet confirmed. They stay unpublished until they are: a wrong registered address in a privacy policy is a compliance defect, not a detail.
- To be confirmedRegistered office and postal address for exercising rights in writing.
- To be confirmedCompany registration number and commercial register entry.
- To be confirmedWhether the activity requires a data protection officer to be appointed and, if so, their contact details.
What data does this site collect?
Only what you enter in the forms, plus the technical records any server produces. This site carries no analytics and no advertising tags, so there is no collection of browsing behaviour.
| Where it is collected | What data | What for |
|---|---|---|
| Buying brief | Name, email, telephone (optional), preferred language, market, objective, budget range, time horizon and any free text you write. | To prepare the written reading you asked for and to carry the next conversation. |
| Valuation request | Name, email, telephone (optional), property type, market, location, area, typology and any notes you add. | To prepare the valuation requested and reply to you. |
| Contact form | Name, email, telephone (optional) and the content of your message. | To answer what you have asked. |
| Newsletter subscription | Email address and chosen language. Nothing else. | To send the note each working day and to record the subscription and its cancellation. |
| Server records | IP address, date and time of the request, page requested and browser type, generated by the hosting provider. | To keep the site available, detect abuse and diagnose technical faults. |
No form on this site asks for a tax number, an identity document or bank details. The items a deed requires are handled away from the site, at the proper moment and by the people entitled to ask for them.
Form content is never written to technical logs or error messages. Failures are reported by status code alone, without the content of the request.
On what legal basis is it processed?
Each purpose has a basis under Article 6 of the General Data Protection Regulation. None of them depends on your authorising something you did not ask for.
| Purpose | Lawful basis | Note |
|---|---|---|
| Answering an enquiry, preparing a brief or preparing a valuation | Steps taken at the request of the data subject prior to entering a contract — Article 6(1)(b) | Without this data the request cannot be answered. |
| Sending the newsletter | Consent — Article 6(1)(a) | Given on subscribing and withdrawable at any time, with one click in any edition. |
| Site security, abuse prevention and fault diagnosis | Legitimate interests — Article 6(1)(f) | Limited to the minimum needed to keep the service available and intact. |
| Retaining documentation required by law | Legal obligation — Article 6(1)(c) | Applies where there is a contractual relationship. The specific periods are being settled with counsel and will be published here. |
For how long is it kept?
The principle is straightforward: data is deleted once the purpose that justified collecting it has ended. What we cannot publish yet is the number of months for each category.
- An enquiry that does not lead to a mandate is kept while the conversation is open and deleted when it is not.
- An enquiry that leads to a mandate becomes part of the client file and follows the periods of the contractual relationship.
- A newsletter address is kept until it is unsubscribed. Unsubscribing takes effect immediately and needs no reason.
- Technical server records are kept for a short period set by the hosting provider.
Publishing a period the firm cannot yet keep to would be publishing an invented figure. These three remain outstanding and will move into a table on this page:
- To be confirmedRetention period for enquiries that did not lead to a mandate.
- To be confirmedRetention period for client files after completion.
- To be confirmedRetention period for technical server records.
Who has access to your data?
As few people as possible, and never anyone who might pay us for it.
01
The people working on your file. At Rhamos a file does not change hands halfway through, which also means fewer people with access to it.02
Technology suppliers acting on our behalf: site hosting, email, the newsletter platform and the client management system. They act as processors, on written instructions only.03
External professionals involved in a transaction at your direction or with your agreement: solicitor, conveyancer, notary, accountant or lender.04
Public authorities, where the law requires it and to the extent it requires it.
We do not sell personal data. We do not pass it to developers, to banks or to intermediaries. The commitment published on «What we do not do» — taking no commission from third parties for referring clients — applies to data in the same way.
The named list of processors will be published on this page once the contracts are signed. Still to be confirmed:
- To be confirmedIdentity and location of the site hosting provider.
- To be confirmedIdentity of the newsletter platform.
- To be confirmedIdentity of the client management system that receives the forms.
Does data leave the European Union?
It can, in one specific case. Rhamos Properties has an office in Dubai, in the United Arab Emirates, which is a third country in relation to the European Economic Area.
Where your enquiry concerns the Dubai market, the data needed to handle it may be accessed from there by the consultant responsible. Enquiries concerning Portugal and Spain are handled in Europe.
The United Arab Emirates is not the subject of an adequacy decision by the European Commission. A transfer there therefore requires appropriate safeguards — ordinarily the standard contractual clauses approved by the Commission — together with an assessment of the impact of the transfer.
The documentation for that safeguard is in preparation. Until it is complete and verifiable, we do not state which mechanism is in force:
- To be confirmedThe transfer instrument adopted between the European operation and the Dubai office.
- To be confirmedDate of signature and scope of the standard contractual clauses.
What rights do you have over your data?
Those the General Data Protection Regulation gives you, without exception and at no cost. Exercising any of them affects neither the relationship nor the service.
| Right | What it means |
|---|---|
| Access | To know what data we hold about you and obtain a copy of it. |
| Rectification | To correct anything wrong and complete anything missing. |
| Erasure | To ask for deletion where there is no longer a basis for keeping it. |
| Restriction | To suspend processing while a challenge of yours is being considered. |
| Portability | To receive, in a common format, the data you gave us, or to have us send it to another organisation. |
| Objection | To object to processing based on legitimate interests, setting out your situation. |
| Withdrawal of consent | To unsubscribe from the newsletter whenever you wish, without affecting the lawfulness of earlier sends. |
| Automated decisions | We take no decisions about you by solely automated means and carry out no profiling. |
To exercise any of these rights, write to the privacy address. We confirm receipt and, where your identity needs verifying, ask only for what is indispensable to do so.
The Regulation sets the response period at one month, extendable by two further months for complex requests. If it is extended, we tell you so and why within the first month.
And if you want to complain?
You may complain to a supervisory authority. You are not required to contact us first, although that is usually the quickest way to settle the matter.
CNPD — Comissão Nacional de Proteção de Dados
The competent supervisory authority in Portugal, for data handled from the Portuguese operation.
Open the CNPD websiteAEPD — Agencia Española de Protección de Datos
The competent supervisory authority in Spain, for residents of Spain or enquiries concerning the Spanish market.
Open the AEPD websiteIf you live in another European Union member state, you may go to the supervisory authority of your country of residence, of your place of work, or of the place where you consider the infringement occurred.
What about cookies?
This site uses no analytics and no advertising cookies. The cookie policy sets out what exists, what does not, and how consent will work if any is ever introduced.
Read the cookie policyMinors
This site is not directed at minors and no form asks for an age. We do not knowingly collect data from minors. If you become aware that a minor has sent us personal data, write to the privacy address and we will delete the record.
How is it protected?
The measures below are in place on the site as published. They are described specifically, because a generic security statement cannot be verified.
- Encrypted connection throughout the site, with no page served outside HTTPS.
- Form content never enters technical logs, error messages or server responses.
- Typefaces and assets served from our own domain: loading a page of this site generates no third-party requests.
- The map on the contact page loads only after you ask for it with a click, so no external resource is called without that action.
- Access to client files restricted to the people working on the matter.
Changes to this policy
This policy carries a version date. When it changes, the date changes and the change is described in this section. Changes affecting the basis for a processing operation, the retention periods or the recipients of the data are notified by email to anyone holding an active newsletter subscription or an open file.
Draft version of 13 August 2026.
Talking about your data
Any request concerning personal data — access, correction, deletion, or a question about this policy — is handled through the address below.
Write to the privacy address