Privacy Policy

Last updated: 9 September 2026

This Privacy Policy explains how Carlo International collects, uses, retains, shares and protects the personal data processed through its website, portal and other digital services, hereinafter jointly referred to as the "Platform".

Carlo International undertakes to process personal data lawfully, fairly, transparently and limited to what is necessary for the purposes identified in this Policy, in accordance with the General Data Protection Regulation ("GDPR") and other applicable privacy and personal data protection legislation.

1. Data Controller

For the processing of personal data carried out in connection with the management, operation and provision of the Platform's own services, Carlo Ferreira, who conducts the activity under the trade name Carlo International, acts, as a rule, as data controller.

Data controller: Carlo Ferreira
Trade name: Carlo International
Address: Lisbon, Portugal
Contact email: info@carlointernational.pt

Carlo International provides infrastructure and digital services intended to facilitate interaction between buyers, investors, representatives, estate agencies, agents and external professionals. The Platform does not, by virtue of that fact, act as a real estate agent, and does not negotiate prices, represent buyers or sellers, accept or reject offers, enter into purchase and sale agreements, or receive deposits, down payments or purchase prices.

This commercial characterisation does not affect the determination of responsibilities in matters of data protection, which depends on the purposes and means of each specific processing operation.

In certain situations, other entities that receive data through the Platform, including estate agencies, estate agents, lawyers, credit intermediaries, financial institutions, accountants or other professionals, may act as independent controllers where they autonomously determine the purposes and means of processing the data they receive.

Where an entity processes personal data solely on behalf of and under the instructions of Carlo International, it will act as a processor, subject to the applicable contractual and legal obligations.

Whenever the specific nature of a relationship entails joint controllership, the applicable responsibilities will be established in accordance with the legislation in force.

2. Who This Policy Applies To

This Policy applies to the processing of personal data relating, in particular, to:

buyers and private clients;
investors;
representatives of investors;
representatives of companies or other entities;
estate agencies;
estate agents;
legal support professionals or entities;
financing support professionals or entities;
accounting professionals and other external providers;
business users of the Platform;
persons invited to register on the Platform;
persons identified in connection with requests, representations or cases;
users who contact Carlo International through the website or other official channels.

Where certain persons, such as employees or internal providers, are subject to specific processing not related to normal use of the Platform, they may be covered by a separate privacy notice.

3. Personal Data We May Process

The data processed depends on how the user interacts with the Platform, the type of account, the services requested and the features used.

Not all of the data described in this section is collected in respect of every user.

3.1. Buyers, Investors and Representatives

We may process, in particular:

name;
email address;
telephone number;
tax identification number, where necessary;
country of residence;
nationality, where relevant to the transaction or service requested;
acquisition or investment preferences;
intended geographical location;
type of property or asset sought;
budget or investment range;
properties saved as favourites;
properties and opportunities viewed;
requests for information, contact or viewings;
messages exchanged through the Platform;
reviews or comments submitted;
information voluntarily provided in connection with requests for support, investment or acquisition.

Derived data. When a buyer submits a request relating to a property, the Platform may calculate and retain a classification of the request consisting of a score, a level and, where applicable, information relating to the price of access to the opportunity by an estate agency. The general operation of this classification is described in section 17.

3.2. Access, Identity and Representation Verification

Access to certain areas, features or opportunities of restricted circulation may depend on a verification process.

In that context, the following may be requested, where necessary and proportionate to the specific purpose:

date of birth;
identification document and the elements strictly necessary contained therein;
address and proof of address;
tax identification number and, where necessary, information relating to tax residence;
profession or professional activity;
permanent certificate, commercial register certificate or equivalent corporate documentation;
documents evidencing powers of representation and their period of validity;
Confidentiality Agreement and record of its signature or validation;
declarations as to the accuracy of the information provided;
record of acceptance of the Terms and Conditions;
record of the provision of, or acknowledgement of, this Privacy Policy.

This data may be processed to verify the user's identity, confirm their professional or representative capacity, control access to confidential or restricted information, prevent abusive use and protect the Platform and its users.

Investors may be required to complete the applicable verification steps, including signing a Confidentiality Agreement, before accessing certain opportunities of restricted circulation.

Representatives of investors may be required to demonstrate the existence and validity of their powers of representation.

Estate agencies may be required to submit information or documentation for the validation of their AMI licence before the corresponding professional features are activated.

Carlo International will seek to limit the documentation requested to what is actually necessary for the specific purpose.

3.3. Legally Required Identification, Risk and Due Diligence

Where, and only to the extent that, Carlo International is subject to legal obligations of identification, due diligence, prevention of money laundering, terrorist financing or other equivalent obligations in relation to a given relationship or transaction, the data and documents legally necessary for that purpose may be processed.

Depending on the circumstances, this may include:

identification elements;
identification documents;
address;
tax residence;
profession or activity;
corporate information;
identification of representatives or beneficial owners;
information on powers of representation;
information or documentation relating to the source of funds, where legally required or justified by the applicable risk assessment;
other elements required by applicable legislation.

Where applicable, a transaction may also be associated with a geographical risk classification relating to the relevant country, namely low, medium or high risk. The history of the classifications used for compliance purposes may be retained so as to allow demonstration of which classification applied at the time a given analysis or decision was made.

The collection of documentation for compliance with legal obligations is distinct from commercial verification or from control of access to certain Platform features.

Where those obligations fall to an estate agency, financial institution, lawyer, credit intermediary or other independent entity, that entity may request the necessary documentation directly and act as controller of the corresponding processing.

Users should not send documents or information that are not necessary for the purpose in question.

3.4. Estate Agencies and Estate Agents

In relation to estate agencies and agents, the following may be processed:

company name or business name;
names of representatives and agents;
professional contact details;
tax identification number;
AMI licence number and information on its validity, where applicable;
documentation necessary for validation of the professional account;
properties or opportunities published;
agents and users associated with the account;
information relating to the plan contracted;
credit balance and movements;
subscription history;
billing and payment information;
history of opportunities or requests assigned;
communications made through the Platform;
relevant records relating to use of the account.

Credits constitute a means of payment or of access to the Platform's own digital services, including, where applicable, access to opportunities. They do not constitute a real estate brokerage commission.

3.5. Legal Support, Financing Support and Other Professional Services

When a user requests legal support, financing support or another professional service through the Platform, the following may be processed:

identity and contact details;
type and description of the request;
messages exchanged;
information relating to the property or transaction;
documentation submitted by the user;
documentation included in collaboration areas or deal rooms;
stages, deadlines and tasks associated with the case;
meetings or contacts scheduled;
other elements necessary for the routing or administrative follow-up of the request.

The documentation associated with these requests may occasionally contain special categories of personal data or other particularly sensitive information.

Carlo International does not request special categories of data for purposes for which such data is not necessary.

Users should avoid sending sensitive information that is not strictly necessary.

Wherever possible, sensitive documentation that is required only by the responsible professional should be transmitted directly to that professional or made available through restricted access mechanisms.

Where it is essential for Carlo International to process special categories of personal data, such processing will only be carried out where, in addition to an applicable lawful basis, a specific condition permitting the processing of those categories of data under applicable legislation exists.

Where a professional directly undertakes the provision of services to the user and autonomously determines how data is processed in that professional relationship, they will act as an independent controller.

The professional relationship is established directly between the user and the professional concerned. Carlo International does not provide legal services and does not carry out credit intermediation activity.

3.6. Reports and Incident Notifications

The Platform may allow the reporting of conduct allegedly contrary to the Terms and Conditions, or of other situations warranting review.

In that context, the following may be processed:

identity and contact details of the person making the report;
identity of the person or entity concerned;
description, reason and context of the report;
documents or evidence submitted;
messages exchanged;
internal notes;
steps taken;
decision adopted;
date of the various stages of the process.

Carlo International will limit disclosure of the identity of the person making a report or notification to situations where this is necessary or legally required.

The person concerned may be informed of the relevant facts so as to allow them to respond, without prejudice to legally permissible limitations intended to protect the rights of third parties, investigations, fraud prevention or other relevant legitimate interests.

Users should not include in these reports special categories of data, information on convictions or offences, or other particularly sensitive data, except where such elements are strictly necessary and their processing is legally permissible.

3.7. Invitations and Access Requests

Certain account types or areas of the Platform may operate by invitation.

In that context, the following may be processed prior to registration:

name;
email address;
identity of the person or entity that issued the invitation;
type of access requested;
status of the invitation;
date of issue;
date of use or expiry.

Where the data is provided by another person or entity, the invited person will be informed, in accordance with applicable rules, that their data has been received for the purposes of managing the invitation, and of its source.

Data relating to unused invitations will be retained only for the period necessary for the management, security and demonstration of the invitation process.

3.8. Billing and Payment Data

Where there are subscriptions, purchases of credits or other paid services, we may process:

client identification;
tax identification number;
billing address;
plan contracted;
credits purchased;
amounts invoiced;
billing documents;
status and history of payments;
transaction references and identifiers.

Payments may be processed through external payment service providers.

Where card details or other payment elements are entered directly in the payment provider's environment, that data is processed by the provider and is not retained by Carlo International, without prejudice to the information necessary for identification, confirmation or reconciliation of the transaction.

3.9. Technical, Security and Usage Data

During use of the Platform, the following may be processed:

IP address;
date and time of access;
device type;
operating system;
browser;
session information;
record of sessions started and ended;
language preference;
technical identifiers;
application errors;
failed authentication attempts;
unauthorised access attempts;
security events.

Usage log. The Platform may record the pages, features, properties and opportunities viewed by authenticated users, together with the date and time of the visit.

This information may be used for the operation of the account, continuity of the experience, security, usage statistics, understanding of demand and improvement of the Platform.

Where indicators are presented to business users about the interest in their properties or opportunities, we will seek to use aggregated information or to limit individual information to what is necessary for the feature concerned.

Activity log. Relevant operations carried out through the Platform, including approvals, rejections, status changes, payments, permission changes and access to documentation, may be recorded with identification of the responsible user and, where applicable, the IP address used, for the purposes of security, audit, evidence, fraud prevention and compliance with legal obligations.

Message audit. Records may be retained in order to demonstrate who sent or accessed certain communications through the Platform. These audit records need not necessarily include the content of the message.

4. How We Collect Data

Personal data may be collected:

directly from the data subject during registration;
through completion or updating of the profile;
through forms;
through the submission of documentation;
when a request for information, contact or a viewing is submitted;
when messages are sent through the Platform;
when professional support is requested;
when a subscription is taken out or a service or credits are purchased;
during contacts with Carlo International;
automatically, through use of the Platform;
through the person or entity issuing an invitation;
through representatives;
through estate agencies, agents or other professionals;
through official or professional sources, where such consultation is necessary, lawful and appropriate to the intended purpose.

Where data is not collected directly from the data subject, Carlo International will provide the legally required information within a reasonable period and, as a rule, at the latest within one month of obtaining the data.

If the data is used to contact the data subject directly, the information will be provided, where applicable, at the latest at the time of the first communication.

If disclosure of the data to another recipient is envisaged, the information will be provided, where applicable, at the latest at the time of the first disclosure.

These rules apply without prejudice to the exceptions provided for in applicable legislation.

5. What We Use the Data For

5.1. Account Management and Operation of the Platform

We may use the data to:

create and authenticate accounts;
validate registrations;
verify identity, representation or declared qualifications;
manage profiles, users and permissions;
control access to restricted areas;
make Platform features available;
provide technical and operational support;
manage service-related communications.

5.2. Property Acquisition and Investment

We may use the data to:

understand the buyer's or investor's criteria and preferences;
organise requests and opportunities;
classify submitted requests according to the answers provided by the user themselves;
present compatible properties or opportunities;
facilitate requested contacts;
process requests for information or viewings;
route a request to another estate agency where the user has specifically consented to that alternative routing;
administratively follow up cases initiated through the Platform.

5.3. Professional Services

We may use the data to:

receive and organise requests for legal support, financing or other professional services;
route requests to the appropriate professional or entity when requested;
facilitate communications;
manage tasks, deadlines or administrative stages of the case;
allow the request to be followed through the Platform.

5.4. Management of Professional Accounts

We may use the data to:

validate professional accounts;
verify professional documentation;
manage properties and opportunities;
manage agents, users and representations;
administer plans, subscriptions and credits;
assign requests or opportunities;
manage contracted features.

5.5. Reports, Security and Prevention of Abuse

We may use the data to:

review reports or complaints;
allow the exercise of the right to be heard where applicable;
investigate abusive use;
prevent fraud;
protect accounts and systems;
identify and respond to incidents;
preserve the integrity and technical stability of the Platform;
exercise or defend the rights of Carlo International or of third parties.

5.6. Billing and Legal Obligations

We may use the data to:

process and reconcile payments;
issue billing documents;
maintain accounting records;
comply with tax obligations;
comply with legal or regulatory identification and due diligence obligations where these are in fact applicable to Carlo International;
respond to valid requests from competent authorities;
comply with judicial or administrative decisions.

5.7. Statistics and Service Improvement

We may use information about the use of the Platform to:

produce statistics;
understand demand patterns;
identify operational problems;
improve features;
measure technical performance;
produce aggregated indicators for business users.

Wherever appropriate, this processing will be carried out with aggregated, pseudonymised or anonymised data.

5.8. Optional Communications and Marketing

Where permitted by applicable legislation, we may send communications about Carlo International's services, features, content or opportunities.

Where consent is required, such communications will only be sent once it has been obtained.

The data subject may cancel marketing communications at any time through the mechanisms provided in the communication itself or by contacting Carlo International.

6. Legal Bases for Processing

Carlo International only processes personal data where there is a legal basis appropriate to the specific purpose.

6.1. Performance of a Contract or Pre-Contractual Steps

This basis may be used where the processing is objectively necessary to:

create and manage a requested account;
make contracted features available;
process a request submitted by the user themselves;
manage subscriptions or credits;
facilitate a specifically requested contact;
organise the provision of a requested professional service;
perform other features that form a necessary part of the service requested by the data subject.

The existence of a clause in the Terms and Conditions does not, in itself, make a processing operation necessary for the performance of the contract.

6.2. Compliance with Legal Obligations

Processing may be based on compliance with legal obligations where it is necessary for:

billing and accounting;
tax obligations;
data security and protection where applicable legal obligations arise;
compliance with legally valid decisions or requests;
regulatory obligations;
identification and due diligence obligations that are legally applicable to Carlo International;
prevention of money laundering or terrorist financing, only where Carlo International is subject to those obligations in relation to the specific relationship or transaction.

6.3. Legitimate Interest

Certain processing may be based on the legitimate interest of Carlo International or of third parties where that interest is not overridden by the fundamental interests, rights and freedoms of the data subjects.

These interests may include:

security of the Platform;
prevention of fraud and abusive use;
protection of confidential information;
access control;
verification of certain professional qualifications;
investigation of incidents;
review of reports;
management and defence of complaints;
maintenance of audit records;
technical improvement of the Platform;
production of internal statistics;
protection and exercise of rights;
efficient management of relationships with business users;
classification and organisation of requests, where that activity is not objectively necessary for the performance of a contract and reliance on legitimate interest has previously been considered appropriate;
management of the commercial conditions for making opportunities available to business users.

Where processing is based on legitimate interest, Carlo International must assess the purpose, necessity, proportionality, reasonable expectations of the data subjects and potential impact on their rights and freedoms.

6.4. Consent

Processing may be based on consent where this is the appropriate basis, in particular for:

alternative routing of a request to other estate agencies or professionals where that disclosure is optional;
non-essential cookies and technologies;
certain marketing communications;
optional features that legally depend on consent.

Where processing is based on consent, this may be withdrawn at any time, with effect for the future and without affecting the lawfulness of processing carried out before withdrawal.

Refusal of consent for an optional purpose should not prevent access to features that do not depend on that processing.

6.5. Mandatory and Optional Data

Certain data may be necessary to create an account, process a request, issue tax documentation, validate access or comply with a legal obligation.

Where a data item is mandatory, this will be indicated at the time of collection wherever appropriate.

A lack of necessary data may prevent, depending on the case:

the creation or validation of an account;
the processing of a request;
the conclusion or performance of a subscription;
the issue of mandatory documentation;
access to a given restricted area or opportunity;
the completion of a legally required verification.

Data intended exclusively for optional features will not be treated as mandatory for other purposes.

7. Sharing of Personal Data

Personal data will only be shared where this is necessary for a legitimate purpose, requested by the user, authorised by consent where that is the applicable basis, necessary for the provision of the services, permitted by another appropriate legal basis or required by law.

Carlo International does not commercialise personal data as a standalone product for free use by third parties for their own marketing purposes.

7.1. Estate Agencies and Agents

When a buyer submits a request for information, contact or a viewing relating to a given property, the data necessary to follow up the request may be transmitted to the estate agency or agent responsible for that property.

That entity will use the data to follow up the request made by the user themselves.

Alternative routing of requests. Where the estate agency initially responsible does not follow up the request, it may only be routed to the Platform's alternative mechanism where the buyer has consented to that routing.

In that case:

a description of the opportunity may initially be presented to eligible estate agencies without disclosure of the buyer's direct contact details;
direct contact details will be made available only to the entity that acquires or takes up access to the opportunity in accordance with the Platform's rules;
following exclusive assignment, the opportunity ceases to be available to other entities through that mechanism;
the entity obtaining access may only use the data to follow up the request in question;
the data may not be used, on the basis of that access, for unrelated commercial communications or other incompatible purposes.

The price borne by an estate agency through credits or another Platform mechanism corresponds to access to a digital opportunity made available by Carlo International.

That access price is payable irrespective of the subsequent completion of any transaction and does not constitute a real estate brokerage commission.

From the moment an estate agency or agent receives the data and autonomously determines how it uses it to provide its own services, it may act as an independent controller.

7.2. Legal, Financial and Other Specialist Professionals

Where the user requests legal support, financing or another professional service, the necessary data may be transmitted to the selected professional or entity in order to review or follow up the request.

Those professionals are not authorised, by virtue of their relationship with the Platform, to use the data received to initiate commercial communications unrelated to the request submitted.

The professional relationship is established directly between the user and the professional.

Where they autonomously determine the purposes and means of processing within that relationship, they will act as independent controllers.

7.3. Service Providers

Carlo International may use external providers for functions such as:

hosting and technological infrastructure;
storage;
development and maintenance;
information security;
email services;
communications;
authentication;
payment processing;
billing;
accounting support;
analytics;
consent management;
operational support.

Where those entities act as processors, they may only process the data in accordance with Carlo International's instructions and will be subject to the applicable contractual and legal obligations.

7.4. Public Authorities

Data may be communicated to courts, judicial authorities, law enforcement authorities, tax authorities, regulatory authorities, administrative authorities or other competent public bodies where there is a legal obligation, judicial or administrative decision, legally valid request or other applicable legal basis.

7.5. Advisers and Professionals

Where necessary for the protection of the rights or the management of the activities of Carlo International, certain data may be made available to lawyers, accountants, auditors, insurers, consultants or other professionals subject to legal or contractual confidentiality obligations.

7.6. Corporate Transactions

In the event of a reorganisation, investment, acquisition, merger, transfer of business or assets or other corporate transaction, certain data may be made available to potential acquirers, investors or their advisers to the extent strictly necessary for the analysis and execution of the transaction, subject to appropriate confidentiality and data protection obligations.

8. International Data Transfers

Wherever possible and appropriate to the services used, Carlo International will seek to use providers that process personal data within the European Economic Area ("EEA").

Certain technology providers may, however, process personal data or allow access from countries located outside the EEA.

Whenever there is an international transfer of personal data, Carlo International will verify the existence of a legally adequate mechanism, as applicable, including:

an adequacy decision adopted by the European Commission;
standard contractual clauses approved by the European Commission;
binding corporate rules, where relevant;
other legally permitted safeguards or derogations.

Where necessary, supplementary measures will be assessed having regard to the nature of the data, the provider, the destination country and the risks identified.

Information on the main providers actually used, the relevant countries and the applicable mechanisms must be kept up to date in internal records and, where necessary to ensure transparency, made available through the Platform or on request.

The data subject may request additional information, including information on the safeguards applicable to a transfer concerning them, at info@carlointernational.pt.

9. Retention Period

Personal data is retained only for the period necessary for the purposes for which it was collected and for as long as there is a legal basis permitting or requiring its retention.

The periods depend, in particular, on:

the duration of the relationship with the user;
the existence of an active account;
the nature of the service;
the applicable legal obligations;
the need to prevent fraud;
the need to demonstrate operations or verifications carried out;
the existence of complaints or disputes;
the periods applicable to the exercise or defence of rights.

In general terms:

the data necessary for the operation of the account is retained for as long as the account remains active and, after closure, for the period necessary to comply with obligations or defend rights;
records of pages, properties, opportunities and features viewed are automatically deleted after 12 months;
the general activity log is automatically deleted after 12 months, without prejudice to the compliance operations excluded from that clean-up;
the technical records of the email sending queue covered by the automatic retention policy are deleted after 12 months;
session records, including IP address, device, operating system and browser, are automatically deleted after 180 days;
certain operations relevant for compliance purposes, including approvals, rejections, suspensions, blocks, status changes, certain plan or credit changes and relevant access to identity documentation, are not covered by the automatic 12-month deletion and are retained for as long as a legal basis and the need to demonstrate the lawfulness, security or correctness of the operations carried out subsist;
audit records relating to who sent or read messages, where they do not include the content of the communications, are retained for as long as they are necessary to demonstrate legitimate access to correspondence or to respond to legally relevant requests;
data relating to unused invitations will be deleted or anonymised when it is no longer necessary for the management and security of the process;
requests, communications and their records may be retained for the period necessary for their follow-up and, thereafter, for as long as they are necessary to demonstrate the service provided or to defend rights;
billing, accounting and tax data will be retained for the legally required periods;
records of identity, representation or access verifications may be retained for as long as they are necessary to demonstrate the performance and outcome of those verifications;
where Carlo International is in fact subject to retention duties arising from money laundering and terrorist financing prevention legislation, the data and documents covered will be retained for the legally applicable period, which, in the cases covered by the Portuguese regime applicable to obliged entities, is as a rule seven years;
data processed through cookies or similar technologies is retained for the periods identified in the Cookie Policy or in the consent management tool.

The exclusion of certain records from an automatic deletion routine does not mean that those records are retained indefinitely without justification. The need for retention must continue to be assessed in accordance with the applicable purpose and legal basis.

Where data ceases to be necessary and there is no basis for its retention, it will be deleted, anonymised or irreversibly aggregated, as appropriate.

10. Account Closure and Deletion of Data

The user may request closure of their account at any time.

Closure of the account does not necessarily entail immediate deletion of all personal data.

Certain data may continue to be retained where this is necessary for:

compliance with legal obligations;
billing and accounting;
compliance with legally applicable identification or due diligence obligations;
prevention or investigation of fraud;
management of complaints;
documentation of operations carried out;
protection of the rights of third parties;
the establishment, exercise or defence of rights in judicial, administrative or extrajudicial proceedings.

The removal of certain items through the Platform's internal features may involve a soft-deletion stage before definitive removal, where this is compatible with the purpose and the rights of the data subject.

Requests to exercise the right to erasure will, however, be reviewed in accordance with the specific requirements of that right and not merely in accordance with the visual or technical status of content on the Platform.

Data that does not need to be retained will be deleted or anonymised in accordance with the applicable retention procedures.

11. Rights of Data Subjects

Under applicable legislation and depending on the circumstances, the data subject may exercise the following rights:

Right of access - to obtain confirmation as to the processing of their data and access the legally prescribed information;
Right to rectification - to request the correction of inaccurate data or the updating of incomplete data;
Right to erasure - to request the deletion of data where the legal requirements are met;
Right to restriction of processing - to request that certain processing be temporarily restricted in the situations provided for by law;
Right to object - to object to certain processing based on legitimate interest, having regard to the circumstances of the case;
Right to object to direct marketing - to object at any time to the processing of their data for direct marketing purposes;
Right to data portability - to receive certain data in a structured, commonly used and machine-readable format and, where applicable, to request its transmission to another controller;
Right to withdraw consent - where a given processing operation is based on consent;
Right not to be subject to certain solely automated decisions - where the applicable legal requirements are met;
Right to lodge a complaint - with the competent supervisory authority.

In Portugal, the competent supervisory authority is the Comissão Nacional de Proteção de Dados ("CNPD").

Rights may be exercised at info@carlointernational.pt.

Carlo International may request additional information strictly necessary to confirm the identity of the applicant before acting on a request.

The exercise of rights is free of charge, save in the exceptional situations provided for in applicable legislation.

Certain rights are not absolute and may be subject to legal limitations, in particular where retention of the data is necessary for compliance with legal obligations or for the establishment, exercise or defence of rights.

12. Cookies and Similar Technologies

The Platform uses cookies and similar technologies to enable its operation and, subject to consent where necessary, to improve the user experience, measure use of the service or evaluate campaigns.

Cookies and similar technologies may be organised into the following categories.

Necessary

These are essential to the operation of the Platform and may be used, in particular, to:

maintain authenticated sessions;
ensure security;
prevent fraud;
manage strictly necessary preferences;
store the consent choice;
ensure features requested by the user.

These cookies do not depend on consent where they are strictly necessary for the provision of the service requested.

Preferences

These allow certain user choices that are not strictly necessary to be stored, so as to personalise the user experience.

Where legally required, they will only be activated after consent.

Analytics

These allow us to understand how the Platform is used, measure performance and identify opportunities for improvement.

Where they depend on the storage of, or access to, information on the device and are not strictly necessary, they will only be used after consent.

Advertising

Technologies from advertising or measurement partners may be used to evaluate campaigns, attribute conversions, cap or optimise advertising, build audiences or measure performance, where permitted.

Non-essential advertising technologies will only be activated once appropriate consent has been obtained.

The Cookie Policy or the consent management tool will identify the providers actually used, their purposes, categories and duration periods.

On the first visit, the user may accept non-essential cookies, reject them or select the categories they wish to authorise.

It must be possible to reject non-essential cookies without preventing access to Platform features that do not legitimately depend on those cookies.

Consent may be changed or withdrawn at any time, with effect for the future, through the cookie management feature available on the Platform.

13. Data Security

Carlo International adopts technical and organisational measures intended to protect personal data against unauthorised access, loss, destruction, improper alteration, unauthorised disclosure, abusive use and other unlawful or accidental processing.

The measures may include, depending on the risk and the feature:

access control by account type and role;
authentication;
limitation of permissions;
segregation of areas and processes;
logging of relevant operations;
temporary blocking after failed authentication attempts;
restriction of access to documents;
backup mechanisms;
protection of communications;
monitoring of security events;
incident response procedures.

Internal access to personal data is limited to those persons who need that information for the performance of their duties.

Particularly sensitive access, permissions and operations may be subject to audit logging.

Despite the measures adopted, no technological system can guarantee absolute security.

14. Personal Data Breaches

Carlo International maintains procedures for the detection, analysis and management of potential incidents relating to personal data.

Where a personal data breach is subject to a notification obligation under applicable legislation, the legally required communications will be made to the competent supervisory authority and, where applicable, to the affected data subjects.

Incidents and the corresponding analysis, containment and response measures will be documented in accordance with applicable rules.

15. Data Relating to Other People

Where a user provides the Platform with personal data relating to another person, including by issuing an invitation, appointing a representative, identifying a contact, adding an agent, attaching documentation, submitting a report or providing corporate documentation, they must ensure that they are entitled to communicate that data and that the communication is appropriate to the intended purpose.

Third-party data that is not necessary should not be provided.

The existence of this obligation on the user does not affect Carlo International's own duties to inform data subjects where it receives personal data that has not been collected directly from them.

16. Links, Integrations and Third-Party Services

The Platform may contain links to, or integrations with, external websites, applications or services.

Where the user accesses a third-party service directly, that third party may process personal data in accordance with its own terms and privacy policy.

Carlo International does not control the privacy practices of entities acting autonomously as controllers.

We recommend that users consult the privacy policies of the external services used.

17. Automated Decisions and Profiling

The Platform may use rules, filters, search criteria, automatic matching or information organisation mechanisms intended to present properties or opportunities potentially compatible with the preferences indicated by users.

Classification of requests

When a buyer submits a request relating to a property, the Platform automatically calculates a classification of the request based on the answers given by the buyer themselves.

Seven criteria are taken into account:

the timeframe within which they intend to complete the purchase;
the coverage of the stated budget in relation to the value of the property;
whether they need or already have financing;
whether they wish to schedule a viewing;
whether they are in Portugal;
whether they have provided a telephone number;
whether they are contacting only through this Platform or also other estate agencies.

The resulting score ranges from 0 to 100.

On the basis of that score, the request is organised into one of the following levels:

Contact;
Lead;
Qualified lead;
Hot lead.

There is also a rule that overrides the score: where the buyer does not provide a telephone number, the request is always classified as Contact, regardless of the points obtained under the other criteria. This rule exists because, without a means of contacting the person, the opportunity is not usable by an estate agency.

The Contact level is not made available to estate agencies through the commercial mechanisms for access to opportunities.

At the other levels, the classification may influence how the opportunity is presented and the access price borne by an estate agency in accordance with the Platform's commercial rules.

The access price constitutes a price for a digital service of the Platform. It does not correspond to a commission on the transaction, does not depend on the closing of the deal and does not determine the price that buyer and seller may agree between themselves.

The classification relates to the request and to the circumstances declared by the buyer themselves.

It does not constitute an assessment of creditworthiness, standing, legal capacity or personal merit.

The classification does not:

accept or reject any purchase offer;
determine the purchase price of a property;
conclude any contract;
prevent the buyer from contacting estate agencies, agents or other professionals directly;
determine whether a financial institution will grant or refuse financing.

The general logic of the mechanism rests on the seven criteria identified above and on the rule relating to the telephone number. The data subject may request information on how the answers given in a specific request contributed to the classification assigned to them, without prejudice to the protection of third-party rights and of information that may constitute a trade secret to the extent legally permissible.

The data subject may also contest the classification assigned to a request at info@carlointernational.pt.

On the basis of the operation currently envisaged, this mechanism is intended for the classification, organisation and making available of requests and not for the adoption of decisions intended to produce, in themselves, legal effects concerning the data subject or similarly significant effects.

This assessment must be reviewed whenever the criteria, consequences, purposes or degree of automation of the mechanism are changed.

Should solely automated decision-making processes subject to the specific regime provided for in the GDPR be implemented, data subjects will receive the legally required information and safeguards, including, where applicable, appropriate mechanisms for human intervention and contestation.

18. Changes to the Privacy Policy

Carlo International may update this Policy whenever necessary, in particular to reflect:

legislative or regulatory changes;
decisions or guidance from the competent authorities;
new features;
technological changes;
new providers;
modifications to the services;
changes in how personal data is processed.

The most recent version will be available on the Platform and will identify the date of the last update.

Where a change is materially relevant to data subjects, additional information or communication mechanisms may be adopted where appropriate or legally required.

Material changes to the purposes, legal bases, recipients, profiling mechanisms or use of data will be assessed before being implemented.

19. Language Versions

This Policy may be made available in Portuguese, English, German, French, Italian and Spanish.

The versions intended for users must substantially reflect the same information about the personal data processing actually carried out.

In the event of a divergence in interpretation between versions, the Portuguese-language version will prevail, without prejudice to the rights that applicable legislation confers on the data subject in relation to the information actually provided to them in another language.

20. Contact

For questions relating to this Privacy Policy, to the processing of personal data or to the exercise of rights, you may contact:

Carlo International
Data controller: Carlo Ferreira
Address: Lisbon, Portugal
Email: info@carlointernational.pt

You may also use the official contact page available on the Platform.