Privacy Policy

Section 01

Introduction

This Privacy Policy is issued by Refugios Urbanos Consultoria Imobiliária Ltda (hereinafter "Refugios Urbanos", "we", "us" or "our"), a company duly incorporated under Brazilian law (CNPJ 22.459.301/0001-10), headquartered at Rua Harmonia, 1250, Loja 2, Sumarezinho, São Paulo – SP, Brazil.

We operate the website refugiosurbanos.site (the "Site"), through which we provide institutional information about our real-estate consultancy services. As a company that values the trust of every person who interacts with our business — whether a prospective client, a professional partner, or simply someone browsing our content — we take data privacy seriously and comply with the following applicable legal frameworks:

• Brazil's Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018) and any regulations issued by the Autoridade Nacional de Proteção de Dados (ANPD);
• The General Data Protection Regulation (EU/UK GDPR) to the extent our Site is accessible by individuals in the European Economic Area or the United Kingdom;
• All other applicable local, state, and federal privacy statutes.

By accessing or continuing to use the Site, you acknowledge that you have read and understood this Privacy Policy. If you disagree with any part of it, we respectfully ask that you discontinue use of the Site and contact us at the address below to exercise any rights you may hold.

Section 02

Information We Collect

We collect personal information through a limited number of channels. The nature and volume of data collected depends on how you interact with our Site. We describe each category below in full.

2.1 Information You Provide Directly

When you send us an enquiry by email or WhatsApp — links to which appear on our Contact page — you voluntarily provide us with certain personal information. This may include:

• Full name — so that we can address you properly in any reply;
• Email address — as the primary channel through which we communicate;
• Phone number — if you choose to include it, so we may call or message you;
• Message content — details of your real-estate enquiry, needs, budget range, or any other information you choose to share;
• Any attachments — documents, photographs, or files you send alongside a message.

You are never obligated to provide any of the above. Choosing not to supply certain data (for example, your phone number) simply means we will respond by email only. We do not use this information for any purpose other than responding to your enquiry and, where relevant, following up on a consultancy matter you have initiated.

2.2 Information Collected Automatically

When you visit the Site, our servers and third-party analytics tools automatically record certain technical information about your visit. None of this data identifies you directly by name, but some of it may constitute personal data under applicable law when combined with other information. The automatically collected data includes:

• IP address — your device's internet address, which we retain in an anonymised or pseudonymised form;
• Browser type and version — e.g. Chrome 124, Safari 17, Firefox 126;
• Operating system — e.g. Windows 11, macOS, Android, iOS;
• Referring URL — the page or search engine result that brought you to our Site;
• Pages visited and time on page — which sections of the Site you navigated to and for how long;
• Device screen resolution and language setting — to understand which device types our visitors use;
• Date and time of access — recorded in Coordinated Universal Time (UTC).

This technical data is collected through server logs and through Google Analytics (see Section 4 for details). We use it in aggregate — for example, to understand which pages are most useful, to identify technical errors, and to improve the overall quality of the Site.

2.3 Information We Do Not Collect

We do not collect payment card data, bank account numbers, or any financial information. We do not collect government identification numbers (such as CPF or RG) unless you voluntarily include them in an email message. We do not build advertising profiles, and we do not purchase data about you from third-party brokers.

Section 03

How We Use Your Information

We process personal data only when there is a clear, lawful basis for doing so. Under the LGPD, our bases include legitimate interest, consent, and the execution of pre-contractual steps at the data subject's request. Under the GDPR, the same bases apply — specifically Article 6(1)(a) consent, Article 6(1)(b) contractual necessity, and Article 6(1)(f) legitimate interest. For each use of your data, we identify the applicable basis below.

• Responding to your enquiry — When you contact us, we use your name, email address, phone number, and message content to provide an informed, helpful reply. Lawful basis: pre-contractual steps / legitimate interest.
• Consultancy follow-up — If a conversation progresses toward a formal engagement, we may retain your contact details to follow up on timelines, property viewings, or documentation requirements. Lawful basis: legitimate interest / contractual necessity.
• Site performance & analytics — We use aggregated, anonymised visit data to understand how people use the Site, identify underperforming pages, and plan content improvements. Lawful basis: legitimate interest.
• Security and fraud prevention — Server logs help us detect abnormal access patterns, brute-force attempts, or other threats to the Site's integrity. Lawful basis: legitimate interest.
• Legal compliance — We may process data to comply with a court order, regulatory demand, or other legal obligation. Lawful basis: legal obligation.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects. We do not use your contact information to send unsolicited marketing messages. Any future communication of a commercial nature would only occur with your explicit prior consent.

Section 04

Cookies & Tracking Technologies

Cookies are small text files placed on your device when you visit a website. They serve a variety of purposes: some are essential for the Site to function correctly; others help us understand how visitors interact with our content so we can improve the experience over time.

4.1 Types of Cookies We Use

Category	Purpose	Duration	Essential?
Strictly Necessary	Enable core Site functions such as page rendering, session integrity, and security headers.	Session	Yes — no consent required
Analytics (Google Analytics 4)	Count page views, session durations, traffic sources, and device types. Data is aggregated and anonymised; IP addresses are truncated before storage.	Up to 13 months	No — requires consent
Advertising (Google Ads)	Measure the effectiveness of our Google Ads campaigns by tracking conversions (i.e., when a visitor arrives via an ad and then contacts us). We do not use remarketing lists or cross-site tracking beyond conversion measurement.	Up to 90 days	No — requires consent
Preference	Store your cookie consent choices so you are not asked again on every visit.	12 months	Yes — functional necessity

4.2 Managing Your Cookie Preferences

When you first visit the Site, a consent banner will appear allowing you to accept all cookies, accept only strictly necessary cookies, or customise your preferences category by category. You may change your preferences at any time by clicking the "Cookie Settings" link in the Site's footer.

You can also manage cookies directly through your browser settings. The following links provide instructions for the most common browsers: Chrome, Firefox, Safari, and Edge all include dedicated privacy controls under their Settings or Preferences menus. Disabling all cookies may affect the functionality of certain Site features.

4.3 Google Analytics & Google Ads

Our Site uses Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have configured this service with IP anonymisation enabled, which means the final octet of every visitor's IP address is zeroed out before the data is stored on Google's servers. We have also disabled all advertising features within Google Analytics (i.e., no remarketing, no interest-category reports, no demographic data sharing with Google).

For Google Ads conversion tracking, data is processed by Google LLC under its standard terms and data processing addendum. The measurement is limited to confirming whether a click on one of our advertisements resulted in a contact action on the Site. No personal identification data is shared with Google for this purpose.

You can opt out of Google Analytics measurement across all websites by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout. You can adjust your Google advertising personalisation settings at adssettings.google.com.

Section 05

Sharing With Third Parties

We do not sell, rent, or trade your personal information. We share it only in the limited circumstances described below, and only with appropriate safeguards in place.

• Service providers and technology partners — We engage carefully vetted companies to provide technical infrastructure, including web hosting, domain management, and analytics. These providers act as data processors on our behalf and are contractually bound to process your data solely on our instructions and in accordance with applicable law. Current providers include Google LLC (analytics and ads), and our website hosting provider. All are bound by data processing agreements aligned with LGPD and GDPR requirements.
• Legal and regulatory authorities — We may be required to disclose personal information in response to a lawful court order, subpoena, regulatory investigation, or request from a competent government authority. In such cases, we will disclose only what is strictly required and will notify you where we are legally permitted to do so.
• Corporate transactions — In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal data held by us may be transferred to the succeeding entity. We will notify affected individuals and honour the commitments made in this Privacy Policy throughout any such transition.
• Protecting rights and safety — We may share information where we believe in good faith that doing so is necessary to prevent fraud, protect the security or integrity of the Site, or safeguard the rights, property, or personal safety of Refugios Urbanos, our clients, or others.

We do not share personal data with real-estate listing platforms, property databases, third-party marketing agencies, or any commercial partner without your explicit prior consent.

Section 06

Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, to comply with our legal obligations, or to resolve disputes. The following table summarises our standard retention periods:

• Email correspondence and enquiry records — Retained for up to 5 years from the date of last contact. This period reflects the statute of limitations applicable to civil obligations under Brazilian law (Article 205, Civil Code) and ensures we can reconstruct the history of a consultancy engagement if needed.
• Analytics data (Google Analytics 4) — We have configured our GA4 property with a data retention period of 13 months, the minimum available. After this period, Google automatically deletes event-level data. Aggregated, non-personal reports are retained indefinitely.
• Google Ads conversion data — Retained for 90 days on Google's systems, in line with the default conversion window for our campaign type.
• Server access logs — Retained for 90 days for security and diagnostic purposes, then automatically overwritten.
• Cookie consent records — Retained for 12 months from the date of your consent, to allow us to demonstrate compliance with our consent obligations.

When personal data is no longer required and its retention period has expired, we securely delete or irreversibly anonymise it. Where complete deletion is technically impractical (for example, in certain backup systems), we ensure the data is isolated and protected from any further processing until routine deletion cycles can be completed.

Section 07

Data Security

We implement a layered set of technical and organisational measures designed to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. While no system can guarantee absolute security, the measures we have in place represent industry-standard practices appropriate to the risk level of the data we process.

• HTTPS / TLS encryption — All traffic between your browser and the Site is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained with automatic renewal to prevent lapses.
• Access controls — Access to systems that hold personal data is restricted to authorised personnel on a strict need-to-know basis. Credentials are protected with strong password policies and, where possible, multi-factor authentication.
• Hosting environment — The Site is hosted on infrastructure that applies physical, network, and application-level security controls, including firewall protection and DDoS mitigation.
• Email security — Email accounts used for business correspondence are protected by two-factor authentication and are subject to spam and malware filtering.
• Data minimisation — We deliberately limit the personal data we collect and store. Reducing the volume of data held is itself a security measure.
• Incident response — In the event of a security incident that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (ANPD) within 72 hours of becoming aware of the breach, and will inform affected individuals without undue delay, as required by law.

If you believe your personal data has been compromised or if you detect any suspicious activity related to your interaction with our Site, please contact us immediately at contato@refugiosurbanos.site.

Section 08

Your Rights

Depending on your country of residence, you hold a set of meaningful rights over the personal data we hold about you. We take these rights seriously and are committed to responding to valid requests within the legal timeframes — generally 15 business days under the LGPD, and 30 calendar days under the GDPR (extendable to 60 days in complex cases, with notice to you).

How to Exercise Your Rights

To exercise any of the above rights, please contact us in writing at contato@refugiosurbanos.site with the subject line "Data Privacy Request". Please include your full name, a description of your request, and, where applicable, the email address you used to contact us previously (so we can locate any records). We may ask you to verify your identity before processing the request — this is a safeguard to prevent unauthorised disclosure of data about you to a third party. We will not charge a fee for reasonable requests.

Section 09

Children's Privacy

The Site and our real-estate consultancy services are directed exclusively at adults. We do not knowingly collect, process, or retain personal data from children under the age of 18. In Brazil, the LGPD establishes specific requirements for processing data of children (under 12) and adolescents (12–18), including the requirement for verifiable parental or guardian consent.

If we become aware that we have inadvertently received personal data from a person under the age of 18, we will delete that data as promptly as possible. If you are a parent or guardian and believe your child has submitted information to us through this Site, please contact us immediately at contato@refugiosurbanos.site so that we can take appropriate action.

Section 10

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer, applicable law, or regulatory guidance. When we make changes, we will update the "Last updated" date at the top of this page and, where the changes are material, display a notice on the Site for a reasonable period after publication.

We encourage you to review this Privacy Policy periodically. Material changes — those that significantly affect how we collect, use, or share your personal information — will be communicated more prominently, such as through a banner displayed when you next visit the Site. If we have your email address on file and the changes affect the basis on which we process your data, we will endeavour to notify you directly.

Your continued use of the Site following the posting of an updated Privacy Policy constitutes acceptance of the changes. If you do not agree to the revised policy, you should discontinue use of the Site and, if applicable, exercise your right to request deletion of your data.

Section 11

Contact Us

All privacy-related queries, requests, and complaints should be directed to us at the contact details below. We are committed to responding promptly and to resolving any concerns you raise in a fair and transparent manner. If your query relates to a data subject right request (see Section 8), please use the subject line "Data Privacy Request" to ensure it reaches the right member of our team without delay.

We aim to acknowledge all privacy-related correspondence within 2 business days and to resolve substantive requests within the statutory deadlines set out in Section 8. If you are not satisfied with our response, you retain the right to escalate your complaint to the ANPD or to your local data protection authority, as appropriate.