Privacy Policy

Last updated: April 2026

1. Data Controller

The data controller responsible for your personal data is GritEstates, Rua do Souto 42, 4700-215 Braga, Portugal ("we", "us", or "our"). For all data protection enquiries, please contact us at sales@gritestates.com.

2. Data We Collect

We collect personal data that you voluntarily provide through our contact form: your name, email address, and any message you choose to send. We also collect anonymised technical data automatically when you visit our website, including your IP address (truncated), browser type, pages visited, and time of access. We do not collect sensitive categories of personal data (Art. 9 GDPR / Art. 5 Lei n.º 58/2019) such as health records, financial details, or government identification numbers through this website.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 of the GDPR and the corresponding provisions of Portuguese Lei n.º 58/2019:

  • Contractual necessity (Art. 6(1)(b) GDPR): Processing your enquiry and responding to your contact form submissions.
  • Legitimate interests (Art. 6(1)(f) GDPR): Analysing anonymised website usage to improve our services, provided such interests are not overridden by your rights and freedoms.
  • Legal obligation (Art. 6(1)(c) GDPR): Retaining records as required by Portuguese commercial and tax law.
  • Consent (Art. 6(1)(a) GDPR): Placing non-essential analytics cookies, where your prior consent has been obtained.

4. How We Use Your Data

We use your personal data solely to respond to your enquiries and provide the information or services you have requested; to improve our website and user experience based on aggregated usage patterns; and to fulfil applicable legal obligations. We do not sell, rent, or share your personal data with third parties for marketing purposes. Where we engage third-party service providers (e.g. hosting or analytics), they process data only on our instructions and under contractual data processing agreements (Art. 28 GDPR).

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Contact form submissions are retained for a maximum of 24 months unless an ongoing business relationship exists. Technical log data is anonymised or deleted within 90 days. Where legal retention obligations apply, including commercial correspondence under Portuguese law, data may be retained for up to 10 years.

6. Data Storage and International Transfers

Your personal data is stored on secure servers located within the European Union. Data is encrypted both in transit (TLS 1.3) and at rest. Where we transfer data to processors located outside the European Economic Area, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent safeguards to ensure your data is protected to the same standard.

7. Your Rights

Under the GDPR (Chapter III) and Portuguese Lei n.º 58/2019, you have the following rights regarding your personal data:

  • Access (Art. 15 GDPR): Request a copy of the personal data we hold about you.
  • Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data.
  • Erasure (Art. 17 GDPR): Request deletion of your data ("right to be forgotten") where no legal obligation requires retention.
  • Restriction (Art. 18 GDPR): Request that we restrict processing in certain circumstances.
  • Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format.
  • Objection (Art. 21 GDPR): Object to processing based on legitimate interests.
  • Withdraw consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at sales@gritestates.com. We will respond within 30 days (GDPR Art. 12).

8. Cookies and ePrivacy

In compliance with the EU ePrivacy Directive (2002/58/EC) and Portuguese Lei n.º 41/2004 (as amended by Lei n.º 46/2012), our website uses:

  • Essential cookies: Strictly necessary for the website to function. These cannot be disabled and do not require your consent.
  • Analytics cookies: Optional cookies that help us understand visitor behaviour in aggregated, anonymised form. These are only set with your explicit prior consent.

We do not use advertising, retargeting, or cross-site tracking cookies. You may manage or withdraw your cookie consent at any time through your browser settings.

9. Supervisory Authorities

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the relevant supervisory authority:

  • Portugal, CNPD: Comissão Nacional de Proteção de Dados, Rua de São Bento n.º 148-3º, 1200-821 Lisboa. www.cnpd.pt

We encourage you to contact us first at sales@gritestates.com so that we may resolve any concerns directly.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. The "last updated" date at the top of this page indicates when the most recent revisions were made. Where changes are material, we will take reasonable steps to inform you. Continued use of our website following any update constitutes acceptance of the revised policy.