Privacy Policy

Porameta Developments Unipessoal Lda ("Porameta", "we", "us", "our") operates the Porameta platform at porameta.com — a premium, agent-exclusive B2B commercial real estate marketplace for Portugal. We are the data controller for personal data collected through this Platform. We prioritize the protection of your professional and personal data. For any privacy-related enquiries, please contact us via the Contact page on this Platform.

We collect personal data in the following categories: • Account information: full name, professional email address, phone number, password (hashed), brokerage details, and role (buyer or agent). • Verification data: IMPIC AMI Licence numbers (for agents) and KYC/AML identity verification data, including AI-assisted document review via Google Gemini for the DeepCheck listing-verification flow. • Agent-specific data: company name, AMI licence number, company NIF, personal NIF, office address, years of experience, areas served, and specialisations. • Buyer-specific data: buyer type (individual, corporate, institutional, business owner), investment profile, funding status, and (for Tier 2 verification) identity documents and company NIF. • Listing data: property/business details, photos, documents, and pricing submitted by agents. • Payment information: billing details securely handled by Stripe. We do not store full credit card numbers on our servers. • Communication data: messages, inquiries, NDA signatures, viewing request details, and contact form submissions routed through our platform or our Meta WhatsApp Business API integration. • Usage data: pages visited, listings viewed, search filters used, and actions taken on the Platform (collected via server-side logs). • Technical data: IP address, browser type, device information, and session identifiers.

We use your data strictly to facilitate B2B commercial real estate connections. Specifically: • To create and manage your account and authenticate you on the Platform. • To verify your legal right to practice real estate in Portugal (AMI licence verification). • To connect buyers with agents and facilitate inquiries, viewing requests, and messaging. • To route investor leads directly to the relevant agent via inbox or WhatsApp. • To process subscription payments and generate invoices. • To maintain the safety, security, and integrity of the platform by monitoring for fraudulent listings. • To send transactional emails (account confirmation, OTP codes, inquiry notifications, viewing confirmations, verification results). • To send saved-search digest alerts (if you have enabled notifications for saved searches). • To comply with legal obligations under Portuguese and EU law, including AML requirements.

We process your personal data on the following legal bases under the GDPR: • Contract performance: processing necessary to provide the services you have signed up for (account creation, listings, messaging). • Legitimate interests: platform security, fraud prevention, and improving our services. • Legal obligation: compliance with Portuguese law, anti-money laundering obligations, and tax reporting requirements. • Consent: GDPR consent collected at registration for marketing communications and optional data uses. You may withdraw consent at any time via your account settings.

We use essential cookies required for the Platform to function (session management, authentication tokens). We do not use third-party advertising or tracking cookies. You can control cookie preferences at any time using the Cookie Settings link in the footer. See our full Cookie Policy at /cookies for details of every cookie we set.

We do not sell your personal data to third parties. We only share necessary data with trusted service providers to operate the Platform: • Stripe: For secure payment processing and subscription management. • Google Gemini API: For AI-assisted review of documents submitted to the DeepCheck listing-verification flow. Documents are sent on a per-submission basis and are not used by Google to train models. • Meta (WhatsApp Business API): To deliver real-time property leads to agents. • AWS: Cloud hosting, S3 document storage, and RDS database — all contractually bound to protect your data. • Brevo: Transactional email delivery. • Twilio: Optional SMS OTP verification. • Between buyers and agents: When a buyer sends an inquiry or schedules a viewing, the agent receives the buyer's name, message, and contact details, and vice versa. If you are an investor, your contact information and signed NDAs will be shared with the specific agent you are inquiring with. • Legal requirements: We may disclose data when required by law, court order, or regulatory authority in Portugal or the EU. • Business transfer: If Porameta Developments Unipessoal Lda is acquired or merged, your data may be transferred as part of that transaction, subject to equivalent privacy protections.

Our infrastructure (AWS) may process data in regions within the EU/EEA (Ireland region). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions) in compliance with GDPR Chapter V.

We retain your personal data for as long as your account is active or as needed to provide services. Specifically: • Account data: retained for the duration of the account plus 7 years after closure to comply with Portuguese accounting and legal obligations. • Inquiry and messaging data: retained for 3 years after the last communication. • Payment records: retained for 7 years as required by Portuguese tax law. • Identity verification documents (Tier 2 buyer / KYC/AML): retained for 5 years after submission. • Server logs: retained for 90 days. You may request deletion of your account and associated data at any time (see Section 10).

We implement industry-standard security measures including: HTTPS encryption for all data in transit, bcrypt password hashing, AWS S3 server-side encryption for stored documents, presigned URLs (1-hour expiry) for secure document access, JWT-based authentication with HTTP-only cookies, IP-based rate limiting on sensitive endpoints, and Content Security Policy (CSP) headers. Despite these measures, no system is completely secure. We encourage you to use a strong unique password and to notify us immediately if you suspect unauthorised access to your account.

Under the General Data Protection Regulation (GDPR), users within the European Union have the right to: • Right of access: request a copy of the personal data we hold about you. • Right to rectification: request correction of inaccurate or incomplete data. • Right to erasure ("right to be forgotten"): request deletion of your data where there is no overriding legal basis for us to retain it, provided it does not conflict with our legal obligations to maintain transaction or AML records. • Right to restrict processing: request that we limit how we use your data in certain circumstances. • Right to data portability: receive your data in a structured, machine-readable format. • Right to object: object to processing based on legitimate interests. • Right to withdraw consent: withdraw any consent you have given at any time without affecting the lawfulness of prior processing. • Right to delete your account: you may delete your account at any time via your account settings. Upon deletion, your personal data will be removed subject to the retention periods above. To exercise any of these rights, please contact our team via the Contact page on this Platform. We will respond within 30 days. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) — the Portuguese data protection authority — at cnpd.pt.

You can delete your Porameta account and associated personal data at any time. Two options: Option A — In-app (recommended, fastest): 1. Sign in at porameta.com/login. 2. Open Settings: agents go to /dashboard/seller-agent/settings, buyers go to /dashboard/buyer/settings. 3. Scroll to the "Delete Account" section at the bottom of the page. 4. Confirm with your password (or, for Google sign-in users, by re-typing your email address) and click Delete Account. 5. Your account is removed immediately. A confirmation email is sent to the address on file. Option B — By request (if you cannot sign in): 1. Visit porameta.com/contact. 2. Submit a deletion request with the email address tied to your account and the subject line "Data Deletion Request". 3. Our team will verify your identity and process the request within 30 days, as required by GDPR. What gets deleted: your profile, listings you own, inquiries and replies you sent or received, viewing requests, saved listings and searches, verification submissions, uploaded photos and documents (including ID documents), avatar image, and authentication sessions. What is retained (and why): payment records (7 years — Portuguese tax law), AML/KYC verification logs (5 years — anti-money-laundering law), and anonymised server logs (90 days). See Section 8 for full retention details. WhatsApp messages: if you previously communicated with us or with an agent over WhatsApp Business API, message content is held by Meta on its own infrastructure under Meta's terms. You can request Meta-side deletion via Meta's data tools at facebook.com/help/whatsapp. Deletion of your Porameta account stops any further WhatsApp messages from us.

The Platform is intended for business users and is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us via the Contact page and we will delete it promptly.

The Platform may contain links to third-party websites (e.g., listing agent websites, LinkedIn). We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal data.

We may update this Privacy Policy from time to time. We will notify registered users of material changes via in-platform notification and update the "last updated" date at the top of this page. Continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

For any privacy-related enquiries, data subject requests, or complaints, please contact our administrative team via the Contact page on this Platform. You may also contact the Portuguese data protection authority (CNPD) at cnpd.pt.

If you provide your mobile number and tick the SMS consent box during registration (or text START / JOIN to our number), you opt in to receive recurring text messages from Porameta Developments about your agent account, listings, and platform updates. Message and data rates may apply, and message frequency varies. Reply STOP, CANCEL, END, QUIT, UNSUBSCRIBE, or REVOKE at any time to opt out, and HELP for help. No mobile information collected as part of the SMS opt-in (your phone number and the consent itself) is sold, rented, or shared with any third parties or affiliates for their marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties. We share your number only with our SMS delivery provider (Twilio) strictly to send the messages you have requested, and where required by law.