PRIVACY POLICY

1. Data controller

The personal data collected through [WEBSITE URL] (the "Website") and in connection with Lugan, a residential development on the Douro riverfront in Afurada, Vila Nova de Gaia (the "Project"), is processed by two joint controllers with equal responsibility: [VELOCITY LEGAL NAME] (Velocity Investments), tax number [VELOCITY NIPC], with registered office at [VELOCITY REGISTERED OFFICE], and [MCAETANO LEGAL NAME] (Grupo MCaetano), tax number [MCAETANO NIPC], with registered office at [MCAETANO REGISTERED OFFICE] (together, "we", "us" or "our").
Both companies jointly determine the purposes and means of processing for the marketing and sale of the Project, under an arrangement made in accordance with Article 26 of the GDPR. The essential terms of that arrangement are available on request. Your data may be shared between both companies for the purposes described in this policy. You may exercise your rights with either of us, and each of us will ensure that your request is handled.
Contacts: Velocity Investments, info@velocity-investments.com, +351 912 606 501. Grupo MCaetano, geral@grupomcaetano.com, +351 226 109 039.
[If applicable: Sales of the Project are handled by [MEDIATOR NAME], a real estate agency holding AMI licence no. [AMI NO.]. Where [MEDIATOR NAME] processes your data for its own purposes, it acts as an independent controller.]
This Privacy Policy is issued under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Law 58/2019 of 8 August.

2. Personal data we collect

We collect only the data needed for the purposes described in this policy. Depending on how you interact with us, this may include the following.
Identification and contact data: name, email address and telephone number provided through the contact form, by email or by telephone, together with your country of residence and preferred language where you share them.
Data about your interest: the residences or buildings of interest (The Riverfront or The Hillside), budget range, intended use, preferred visit dates and the content of your messages.
Pre-contractual and contractual data: identification document details, tax number, address, marital status and property regime, and information on financing, where you move forward with a reservation or purchase.
Anti-money laundering data: information on identity, beneficial ownership, source of funds and politically exposed person status, as required by Law 83/2017 of 18 August.
Technical and browsing data: IP address, device and browser type, pages visited and data collected through cookies, as described in our Cookie Policy.
We do not ask for special categories of data, such as health data or religious beliefs. Please do not include them in the message field.

3. Purposes and legal bases

Answering contact form submissions and requests for information, brochures or price lists. Legal basis: steps taken at your request prior to a contract (Art. 6(1)(b) GDPR) or our legitimate interest in replying (Art. 6(1)(f) GDPR).
Scheduling and managing visits to the sales office, show apartment or site. Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR).
Preparing and executing reservation agreements, promissory purchase and sale agreements and deeds. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Customer due diligence and reporting under anti-money laundering law. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Tax, accounting and other legal obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Sending news, launches and marketing communications about Lugan [and other projects by Velocity and MCaetano]. Legal basis: consent (Art. 6(1)(a) GDPR).
Website analytics and advertising measurement. Legal basis: consent (Art. 6(1)(a) GDPR), see our Cookie Policy.
Website security, fraud prevention and the establishment, exercise or defence of legal claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. Providing the data needed for contracts or legal obligations is mandatory; without it we cannot proceed with a reservation or purchase.

4. Who we share your data with

We do not sell your personal data. We may share it with the following recipients.
Service providers acting on our behalf (processors), including Framer, which hosts the Website and receives contact form submissions, and [CRM / EMAIL / ANALYTICS PROVIDERS], all bound by contracts under Article 28 of the GDPR.
[MEDIATOR NAME], architects, lawyers, notaries, banks and other professionals involved in the sale, where necessary.
Public authorities, courts and supervisory bodies, where required by law.

5. International transfers

Your data is stored mainly within the European Economic Area. Some providers, including website hosting and analytics services, may process data outside the EEA. In those cases we ensure an adequate level of protection through an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or Standard Contractual Clauses. You may request a copy of the relevant safeguards from either of us, using the contacts in section 1.

6. How long we keep your data

Enquiries and leads with no further contact: [24 months] from the last interaction.
Marketing consent: until consent is withdrawn, or [24 months] without interaction.
Contractual data: for the duration of the contract and the applicable limitation periods, including the legal warranty period for the property.
Anti-money laundering records: 7 years, as required by Law 83/2017.
Tax and accounting records: 10 years, as required by Portuguese tax law.
At the end of these periods, data is securely deleted or anonymised.

7. Your rights

Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict or object to its processing, and to data portability. You may object at any time to direct marketing and withdraw consent at any time.
To exercise your rights, contact either of us: Velocity Investments at info@velocity-investments.com, or Grupo MCaetano at geral@grupomcaetano.com. We will reply within one month, which may be extended by two further months for complex requests. We may ask you to confirm your identity.
You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or with the supervisory authority of your EU country of residence.

8. Automated decisions

We do not take decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.

9. Minors

The Website is not intended for persons under 18. We do not knowingly collect data from minors.

10. Security

We apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encrypted connections, access controls and confidentiality obligations for staff and providers.

11. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top shows the latest version. Where changes are significant, we will inform you through the Website or by email.