Legal
Privacy policy
Rhamos Properties collects the personal data you enter in the forms on this site and when you subscribe to the newsletter, uses it to reply and to provide the service you asked for, and does not sell it or pass it to developers. You may access, correct or delete that data at any time.
This page sets out each of those points in detail: what is collected, on what legal basis, for how long, who has access, where it may travel outside Europe, and how to exercise your rights.
Who is responsible for your data?
The controller is Realchain, S.A., which operates this site under the brand «Rhamos Properties». For anything concerning personal data, the address below is the direct route and it is answered.
| Item | Value |
|---|---|
| Controller | Realchain, S.A. |
| Registration | Pessoa coletiva e matrícula n.º 516852574 |
| Registered office | Avenida da Liberdade, n.º 110, 1269-046 Lisboa, Portugal |
| Brand | Rhamos Properties |
| Contact for personal data | privacidade@rhamosproperties.com |
| General contact | info@rhamosproperties.com |
| Markets served | Portugal, Spain and Dubai |
No data protection officer has been appointed, because the firm's activity does not meet the criteria of Article 37 of the GDPR, which reserves mandatory appointment for public authorities, for regular and systematic monitoring of data subjects on a large scale and for large-scale processing of special categories of data — and this advisory activity, run by a small team, involves no profiling and no monitoring. The point of contact for all personal-data matters is the privacy address, privacidade@rhamosproperties.com.
What data does this site collect?
Only what you enter in the forms, including the CV you attach in the application form on the careers page, plus the technical records any server produces. This site carries no analytics and no advertising tags, so there is no collection of browsing behaviour.
| Where it is collected | What data | What for |
|---|---|---|
| Buying brief | Name, email, telephone (optional), preferred language, market, objective, budget range, time horizon and any free text you write. | To prepare the written reading you asked for and to carry the next conversation. |
| Request for an opinion of value | Name, email, telephone (optional), property type, market, location, area, typology and any notes you add. | To prepare the opinion of value requested and reply to you. |
| Contact form | Name, email, telephone (optional) and the content of your message. | To answer what you have asked. |
| Newsletter subscription | Email address and chosen language. Nothing else. | To send the note each working day and to record the subscription and its cancellation. |
| Application form | Name, email, telephone (optional), the position chosen, the answers to the vacancy's questions, a free note if you write one, and the CV you attach. On the vacancies that allow it, a summary of your career written by you instead of the CV. | To assess the application in the recruitment process it answers. |
| Server records | IP address, date and time of the request, page requested and browser type, generated by the hosting provider. | To keep the site available, detect abuse and diagnose technical faults. |
No form on this site asks for a tax number, an identity document or bank details. The items a deed requires are handled away from the site, at the proper moment and by the people entitled to ask for them.
Form content is never written to technical logs or error messages. Failures are reported by status code alone, without the content of the request.
On what legal basis is it processed?
Each purpose has a basis under Article 6 of the General Data Protection Regulation. None of them depends on your authorising something you did not ask for.
| Purpose | Lawful basis | Note |
|---|---|---|
| Answering an enquiry, preparing a brief or preparing an opinion of value | Steps taken at the request of the data subject prior to entering a contract — Article 6(1)(b) | Without this data the request cannot be answered. |
| Assessing a job application | Steps taken at the request of the data subject prior to entering a contract — Article 6(1)(b) | The CV is kept for future openings only if the applicant asks for it, on the basis of consent — Article 6(1)(a) — withdrawable at any time. |
| Sending the newsletter | Consent — Article 6(1)(a) | Given on subscribing and withdrawable at any time, with one click in any edition. |
| Site security, abuse prevention and fault diagnosis | Legitimate interests — Article 6(1)(f) | Limited to the minimum needed to keep the service available and intact. |
| Retaining documentation required by law | Legal obligation — Article 6(1)(c) | Applies where there is a contractual relationship; the periods are those set by the law imposing each obligation. |
For how long is it kept?
The principle is straightforward: data is deleted once the purpose that justified collecting it has ended. The rules below are the ones in force.
- An enquiry that does not lead to a contractual relationship is kept while the conversation is open and deleted when it is not.
- An enquiry that leads to a contractual relationship becomes part of the client file and follows the periods of that relationship.
- A job application is kept for the duration of the recruitment process it answers and deleted at its end. The CV is kept for future openings only if the applicant asks for it when sending, an authorisation offered only when a file is attached, and deleted as soon as they request it.
- A newsletter address is kept until it is unsubscribed. Unsubscribing takes effect immediately and needs no reason.
- Technical server records are kept for a short period set by the hosting provider.
These rules apply today without fixed periods in months per category: the firm deletes data when the purpose ends, as described. When it sets specific periods — for enquiries without a contractual relationship, for client files after completion and for technical server records — this policy will publish them in a table in this section and the version date will change.
Who has access to your data?
As few people as possible, and never anyone who might pay us for it.
01
The people working on your file. At Rhamos a file does not change hands halfway through, which also means fewer people with access to it.02
Technology suppliers acting on our behalf: the site hosting, which generates the technical records described above, the team's email and the sending platform Resend, which delivers the form messages and manages newsletter subscriptions. They act as processors, on written instructions only.03
The licensed real-estate brokerage that carries out the intermediation — DNZ — Mediação Imobiliária, Lda, AMI 10786 — and the management system of its network, when an enquiry progresses to a brokerage activity.04
External professionals involved in a transaction at your direction or with your agreement: solicitor, conveyancer, notary, accountant or lender.05
Public authorities, where the law requires it and to the extent it requires it.
We do not sell personal data. We do not pass it to developers, to banks or to intermediaries for their own commercial purposes: whoever has access to your data has it only to handle your request.
The forms on this site are today delivered to the team by email, through the sending platform Resend; there is no client management system. If one is ever adopted — or if any new processor starts handling personal data on our behalf — this policy is updated, with the corresponding identification and a new version date, before it enters service.
Does data leave the European Union?
It can, in two specific cases. The first is the Dubai office: Rhamos Properties has an office in Dubai, in the United Arab Emirates, which is a third country in relation to the European Economic Area. Where your enquiry concerns the Dubai market, the data needed to handle it may be accessed from there by the consultant responsible; enquiries concerning Portugal and Spain are handled in Europe.
The United Arab Emirates is not the subject of an adequacy decision by the European Commission. A transfer there therefore requires appropriate safeguards — ordinarily the standard contractual clauses approved by the Commission — together with an assessment of the impact of the transfer. When the instrument adopted between the European operation and the Dubai office is signed, this section will identify it, with its date of signature and its scope, and the version date of this policy will change.
The second case is the sending platform Resend, which delivers the form and newsletter messages: its dispatch servers are in the European Union; its account data is held in the United States.
What rights do you have over your data?
Those the General Data Protection Regulation gives you, without exception and at no cost. Exercising any of them affects neither the relationship nor the service.
| Right | What it means |
|---|---|
| Access | To know what data we hold about you and obtain a copy of it. |
| Rectification | To correct anything wrong and complete anything missing. |
| Erasure | To ask for deletion where there is no longer a basis for keeping it. |
| Restriction | To suspend processing while a challenge of yours is being considered. |
| Portability | To receive, in a common format, the data you gave us, or to have us send it to another organisation. |
| Objection | To object to processing based on legitimate interests, setting out your situation. |
| Withdrawal of consent | To unsubscribe from the newsletter whenever you wish, without affecting the lawfulness of earlier sends. |
| Automated decisions | We take no decisions about you by solely automated means and carry out no profiling. |
To exercise any of these rights, write to the privacy address. We confirm receipt and, where your identity needs verifying, ask only for what is indispensable to do so.
The Regulation sets the response period at one month, extendable by two further months for complex requests. If it is extended, we tell you so and why within the first month.
And if you want to complain?
You may complain to a supervisory authority. You are not required to contact us first, although that is usually the quickest way to settle the matter.
CNPD — Comissão Nacional de Proteção de Dados
The competent supervisory authority in Portugal, for data handled from the Portuguese operation.
Open the CNPD websiteAEPD — Agencia Española de Protección de Datos
The competent supervisory authority in Spain, for residents of Spain or enquiries concerning the Spanish market.
Open the AEPD websiteIf you live in another European Union member state, you may go to the supervisory authority of your country of residence, of your place of work, or of the place where you consider the infringement occurred.
What about cookies?
This site sets no cookies — first-party or third-party, analytics or advertising. The cookie policy sets out what exists, what does not, and how consent will work if any is ever introduced.
Read the cookie policyMinors
This site is not directed at minors and no form asks for an age. We do not knowingly collect data from minors. If you become aware that a minor has sent us personal data, write to the privacy address and we will delete the record.
How is it protected?
The measures below are in place on the site as published. They are described specifically, because a generic security statement cannot be verified.
- Encrypted connection throughout the site, with no page served outside HTTPS.
- Form content never enters technical logs, error messages or server responses.
- Typefaces and assets served from our own domain: loading a page of this site generates no third-party requests.
- No third-party maps, videos or widgets are embedded on any page; if a map is ever embedded on the contact page, it will load only after a click from the visitor.
- Access to client files restricted to the people working on the matter.
Changes to this policy
This policy carries a version date. When it changes, the date changes and the change is described in this section. Changes affecting the basis for a processing operation, the retention periods or the recipients of the data are notified by email to anyone holding an active newsletter subscription or an open file.
Version of 20 August 2026.
Talking about your data
Any request concerning personal data — access, correction, deletion, or a question about this policy — is handled through the address below.
Write to the privacy address