Insights

Legal

Privacy Policy

Last updated: 1 May 2026

1. Data Controller

BESIPA, Lda. (trading as “Soverite”), NIPC 517 929 996, registered at R. Rosa Ramalho, 3114, 2950-580 Palmela, Portugal (“Soverite”, “we”, “us”) is the data controller for personal data collected in connection with our buyer-side property advisory services and the soverite.com platform.

You can contact us regarding any data protection matter at: [email protected]

2. Data We Collect

We collect personal data in the following categories:

  • Identity data: name, date of birth, nationality, passport or NIF number
  • Contact data: email address, phone number, postal address
  • Financial data: acquisition budget, source of funds, tax residence
  • Property preference data: location, property type, intended use, requirements
  • Communication data: correspondence exchanged during the mandate
  • Platform data: login activity, portal usage, document access logs
  • Technical & forensic data: IP address (preferentially via the Cloudflare cf-connecting-ip header), approximate geographic location derived from your IP (country, city, region — provided by Cloudflare or by ipapi.co fallback), browser user-agent string, page referrer, UTM marketing-attribution parameters from the page where you submitted a form, and the IP/user-agent captured at the moment you sign a document. We collect these data items at every form submission, login, OTP request, and document signing.
  • Payment data: billing details processed via Stripe (we do not store card numbers)
  • AML/KYC data: identity verification documents required by law

3. Legal Bases for Processing

We process your personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b) GDPR): to provide our advisory services under the mandate agreement
  • Legal obligation (Art. 6(1)(c) GDPR): to comply with AML/CFT requirements under Law 83/2017 and other applicable Portuguese law
  • Legitimate interests (Art. 6(1)(f) GDPR): to improve our services, prevent fraud, maintain platform security, and communicate about relevant developments. Our legitimate-interest basis specifically covers the collection of IP address, geographic location, browser user-agent, and referrer at every form submission and login — these data items are necessary to prevent automated abuse, detect fraudulent submissions, and protect both you and us during document signing. We balance this interest against the limited intrusiveness of the data collected and the absence of any device-fingerprint-style tracking beyond a single visit.
  • Consent (Art. 6(1)(a) GDPR): for marketing communications and for the explicit GDPR-consent checkbox at lead capture and call-request forms. The moment your consent was given is recorded for audit purposes (Art. 7(1) GDPR — proving when consent was obtained).

4. How We Use Your Data

We use your personal data to:

  • Deliver the property advisory services you have engaged us for
  • Conduct identity verification and source-of-funds checks as required by law
  • Prepare and share property reports, assessments, and mandate documentation
  • Process payments and issue invoices
  • Communicate with you about your mandate and relevant market developments
  • Coordinate with third parties (solicitors, surveyors, notaries) on your behalf
  • Maintain records required by our regulatory obligations
  • Improve and secure our digital platform

5. Data Sharing

We share your personal data only where necessary:

  • Service providers: payment processors (Stripe), email delivery (Resend), document storage (Microsoft SharePoint/OneDrive), accounting software (ERPNext) — each bound by data processing agreements
  • Professional advisors: solicitors, surveyors, and notaries engaged in your transaction — only with your knowledge and as required to complete the acquisition
  • Regulatory authorities: IMPIC, DCIAP, or other competent authorities when required by law

6. International Transfers

Some of our service providers are based outside the European Economic Area. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or adequacy decisions.

7. Retention Periods

We retain personal data for the following periods:

  • Active mandate data: for the duration of the mandate plus 7 years, to meet our legal and contractual obligations
  • AML/KYC records: 7 years from the end of the business relationship, as required by Law 83/2017
  • Enquiry data (no mandate initiated): 24 months from last contact
  • Platform access logs: 12 months on a rolling basis
  • Marketing consent records: until consent is withdrawn plus 3 years

8. Your Rights

Under GDPR, you have the following rights regarding your personal data:

  • Access: request a copy of the personal data we hold about you
  • Rectification: request correction of inaccurate or incomplete data
  • Erasure: request deletion of your data, where we have no legal basis to retain it
  • Restriction: request that we limit how we use your data in certain circumstances
  • Portability: receive your data in a structured, machine-readable format
  • Objection: object to processing based on legitimate interests
  • Withdraw consent: at any time, where processing is based on consent

9. Cookies and Platform Tracking

The soverite.com platform uses strictly necessary session cookies for authentication. We do not deploy advertising cookies or third-party tracking pixels on the client portal.

The public marketing website may use anonymised analytics to measure aggregate visitor behaviour. No personally identifiable information is collected without your consent.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include encryption in transit (TLS), access controls, and regular security reviews.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the CNPD within 72 hours and inform affected individuals without undue delay, as required by GDPR.

11. Recording of Calls

11.1 — Scope. Soverite (BESIPA, Lda., AMI 27281) may record telephone calls held with the client in connection with the provision of its services, including the initial alignment call and all subsequent calls (notably the comprehensive call and any contact throughout the mandate).

11.2 — Purposes. Recordings are used to: (a) ensure the accuracy of the record of the objectives, requirements and instructions communicated verbally by the client; (b) quality control and internal training; (c) evidence of what was agreed between the parties; (d) compliance with legal and regulatory obligations applicable to real-estate mediation (AMI / IMPIC); and (e) the prevention and resolution of disputes.

11.3 — Legal basis. Processing is based on the data subject's consent (GDPR, art. 6(1)(a)), given by accepting these Terms and continuing the call following the prior notice, as well as on Soverite's legitimate interest (art. 6(1)(f)) in the purposes of quality, training, evidence and compliance and, where applicable, on the performance of the contract (art. 6(1)(b)).

11.4 — Prior information. The client is informed of the recording through these Terms and by a verbal notice at the start of each call. All call participants are likewise informed that the call may be recorded.

11.5 — Retention. Recordings are kept only for as long as necessary for the stated purposes, namely for the duration of the mandate and for 5 years thereafter, or for the period required by law, after which they are securely deleted.

11.6 — Security and sharing. Recordings are treated as confidential client information, stored securely and encrypted, with access restricted to authorised staff. They are not shared with third parties save where required by law, by order of a competent authority, or strictly as necessary to provide the contracted services.

11.7 — Objection to recording. The client may object to a call being recorded or withdraw consent to recording at any time. In that case, Soverite may base its record of the contact on contemporaneous notes; where recording is essential to comply with legal obligations or to protect the parties' rights, Soverite may be unable to proceed with the contact by that means.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active clients by email at least 30 days before taking effect. The “Last updated” date at the top of this page indicates when the most recent changes were made.

BESIPA, Lda. · Trading as Soverite · NIPC 517 929 996
Registered in Portugal · AMI 27281 · IMPIC Regulated
[email protected]