Privacy policy
Last updated: 25 October 2026
1. About this policy
This Policy explains how personal data collected through the website setepedras.com (the "Website") and the contacts that follow from it are processed, under Regulation (EU) 2016/679 (General Data Protection Regulation — "GDPR") and Portuguese Law 58/2019 of 8 August.
2. Controller
2.1. Website data and initial sales contacts. The controller is Ethereal Expression Unipessoal Lda., NIF 518662390, registered office at Avenida Condes de São Januário 48, 2770-040 Paço de Arcos, Oeiras, Portugal, office at Avenida Fontes Pereira de Melo, 15, 3.º Esq., 1050-115 Lisboa ("Ethereal Expression", "we", "us"). Ethereal Expression operates the Website and receives enquiries, registrations of interest, brochure requests and viewing requests.
2.2. Developing/selling companies. Each Sete Pedras development is sold by the company that owns the property (the "Developer Company"), named on the project page and in the sale documents — for example PETRASBICA, LDA., NIPC 519 100 662, for Pedra Friso. If, after the initial contact, you move on to reserving a residence, negotiating or signing a promissory purchase and sale agreement (CPCV) or completing the deed, the Developer Company for that development processes your data as a controller, to prepare and perform the contract and to comply with anti-money-laundering, tax and accounting obligations. At that stage you will receive the Developer Company's privacy information, naming that controller and its contact details.
2.3. Relationship between the entities
Independent controllers. Ethereal Expression and the Developer Company are independent controllers, each for its own processing. Ethereal Expression passes the necessary data to the Developer Company when you ask to proceed with a reservation or offer for one of that company's residences.
2.4. Privacy contact: [email protected], or by post to the address above, marked "Data Protection".
2.5. Data protection officer (DPO). Given the nature and scale of the processing (no regular and systematic monitoring of individuals on a large scale and no large-scale processing of special categories of data), we are not required to appoint a DPO (Article 37 GDPR).
3. What data we process, why, and on what legal basis
| # | Activity | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|---|
| 1 | Enquiry (Enquire/Contact form, email, phone) | Name, email, phone (optional), residence of interest, message (optional), date and source page | Reply to your enquiry and follow it up | Steps taken at your request before entering into a contract (Art. 6(1)(b)) and/or our legitimate interest in responding to contacts we receive (Art. 6(1)(f)) |
| 2 | Register interest (pre-launch or "coming soon" projects) | Name, email, phone and country (optional), residence of interest | Tell you about news, prices or availability for the project you selected | Pre-contractual steps at your request (Art. 6(1)(b)); other projects or general communications only with consent (see row 6) |
| 3 | Brochure request (Pedra Friso and others) | Name, email; phone, country/city and residence of interest (optional) | Send the brochure and contact you about that project | Pre-contractual steps at your request (Art. 6(1)(b)) |
| 4 | Arranging and conducting viewings | Name, contact details, date/time, accompanying persons, preferences | Organise the viewing, control access to the property and safety on site | Pre-contractual steps (Art. 6(1)(b)); legitimate interest in the safety of people and property (Art. 6(1)(f)) |
| 5 | Managing the sales relationship (contact history, offers, negotiation) | Data above, meeting notes, preferences, proposed terms | Manage the purchase process | Pre-contractual steps (Art. 6(1)(b)); legitimate interest in managing the sales process (Art. 6(1)(f)) |
| 6 | Marketing communications (news of other projects, invitations) | Name, email, phone, preferences, consent record | Send commercial communications about Sete Pedras | Consent (Art. 6(1)(a)), given through a separate unticked box (Article 13-A, Law 41/2004). Customers: communications about similar products, with an opt-out in every message (Art. 13-A(3)) |
| 7 | Reservation and CPCV (Developer Company) | Identity and tax details, address, marital status and property regime, contact details, details of representatives and attorneys, bank and payment details, deal terms | Prepare, sign and perform the reservation agreement, the CPCV and the deed | Performance of a contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) |
| 8 | Anti-money-laundering and counter-terrorist financing (Law 83/2017) | Copy of identity document, tax number, occupation, employer, nationality, residence, beneficial owner, source of funds and wealth, politically exposed person status, sanctions screening, payment methods | Customer identification and due diligence, record keeping, reporting to the authorities | Legal obligation (Art. 6(1)(c)); public interest (Art. 6(1)(e)) and Art. 10 GDPR for any data on offences, as provided in Law 83/2017 |
| 9 | Tax, accounting and registry obligations | Billing and contract data | Comply with legal obligations (e.g. IMT, stamp duty, accounting, land registry) | Legal obligation (Art. 6(1)(c)) |
| 10 | Website operation and security | IP address, date/time, URL, browser, server logs | Provide the Website, prevent abuse and keep it secure | Legitimate interest (Art. 6(1)(f)) |
| 11 | Cookies and third-party content (e.g. Google Maps) | See Cookie Policy | Load maps and, in future, measure audiences | Consent (Article 5, Law 41/2004 and Art. 6(1)(a)), except strictly necessary cookies |
| 12 | Legal claims and complaints | Data relevant to the case | Handle complaints (including the Complaints Book) and establish, exercise or defend legal claims | Legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
Legitimate interests. Where we rely on legitimate interests, we have balanced them against your rights and expectations. You can object to that processing at any time (section 8) and ask us for information about that balancing.
Mandatory data. Fields not marked “(optional)” are needed to answer your request; without them we cannot follow it up. At the reservation/CPCV stage, the data required by Law 83/2017 is mandatory by law; if it is not provided, the transaction cannot proceed.
Sources. We collect data directly from you. We may also receive it from licensed real-estate agents or advisers acting for you, and from public or screening sources used for Law 83/2017 purposes (e.g. sanctions lists, the Central Register of Beneficial Owners).
Automated decisions. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
Third-party data. If you give us another person's data (e.g. a spouse, co-buyer or representative), please make this Policy available to them first.
4. Recipients
We share your data only as necessary with:
a) Processors (providing services on our behalf under a contract meeting Article 28 GDPR):
| Service | Provider | Location / safeguards |
|---|---|---|
| Website hosting | Cloudflare, Inc. | USA, EU-US Data Privacy Framework and standard contractual clauses |
| Form handling | Cloudflare, Inc. and Resend | USA, EU-US Data Privacy Framework and standard contractual clauses |
| Business email | Email service provider | EU or USA, standard contractual clauses |
| CRM / contact management | CRM service provider | EU or USA, standard contractual clauses |
| Accounting, IT, legal support | Accountants, IT and legal advisers | EU |
b) Other recipients, acting as independent controllers as described in section 2.3:
- the Developer Company for the development you are interested in (section 2.2);
- other Sveikata Capital group companies, only where needed to manage the sale;
- lawyers, solicitors, notaries and registry offices preparing or formalising the reservation, CPCV and deed;
- banks and credit institutions involved in payment or financing, at your request or with your knowledge;
- public authorities where required by law (e.g. the Tax Authority, the Financial Intelligence Unit, the Public Prosecutor's Office, IMPIC, the courts).
We do not sell your personal data.
5. International transfers
Some providers may be established or process data outside the European Economic Area, notably in the United States (Cloudflare, Inc., Resend and Google LLC). In that case the transfer relies on a European Commission adequacy decision — including the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) where the recipient is certified — or on the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), with supplementary measures where needed. You can ask for a copy of the relevant safeguards at [email protected].
6. Retention
| Data | Period |
|---|---|
| Enquiries, registrations of interest, brochure and viewing requests that do not lead to a reservation | 24 months after the last contact, unless you ask us to delete them earlier |
| Marketing based on consent | Until you withdraw consent or after 24 months without interaction; records of consent and withdrawal kept as long as needed as evidence |
| Suppression list (so we do not contact you again) | As long as needed to respect your objection |
| Reservation, CPCV and deed | Term of the contract and thereafter until the applicable limitation and warranty periods expire (including the legal warranty period for the property) |
| Tax and accounting records | 10 years (Article 123, Corporate Income Tax Code) |
| Anti-money-laundering records | 7 years after the end of the business relationship or occasional transaction (Article 51, Law 83/2017), unless extended by law |
| Server logs | Kept by our hosting provider for a short period under its own retention rules, unless there is a security incident |
| Cookies | See Cookie Policy |
| Complaints and disputes | Until final resolution and the end of the applicable limitation period |
After these periods, data is deleted or anonymised.
7. Security
We apply technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access control and logging, strong authentication on email and CRM accounts, need-to-know access, processor contracts and data-breach procedures. No system is completely secure: please do not send copies of identity documents by form or unencrypted email until we give you a secure channel.
8. Your rights
Under Articles 15 to 22 GDPR you have the right to access your data; to rectification; to erasure; to restriction of processing; to data portability (where processing is based on consent or contract and carried out by automated means); to object to processing based on legitimate interests and, at any time and without giving reasons, to processing for direct marketing; and to withdraw consent at any time, without affecting the lawfulness of earlier processing.
To exercise your rights, contact [email protected]. We will reply within one month, extendable by two further months for complex requests, in which case we will tell you why. We may ask for information to confirm your identity. Exercising your rights is free of charge unless requests are manifestly unfounded or excessive. Some rights are limited by law (for example, we cannot erase data that Law 83/2017 requires us to keep, or tell you about reports made to the authorities under that law).
You can unsubscribe from marketing using the link in every message.
9. Complaints to the supervisory authority
You have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa; www.cnpd.pt — or with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement. We would appreciate the chance to resolve your concern first.
10. Minors
The Website is intended for people aged 18 or over. We do not knowingly collect data from minors. If we learn that we have collected a minor's data without the authorisation of their legal representatives, we will delete it.
11. Changes
We may update this Policy. The version in force will be published on this page with its update date and, if the changes are significant, we will tell you by appropriate means.