Privacy Policy

This page explains how personal data is handled in the context of the website of the Living Canedo development, describing how the site actually works.

This page is an English translation of the Portuguese original, provided for convenience. In the event of any divergence between the two texts, the Portuguese version is the binding one and prevails. You can read it here: Política de Privacidade.

1. Who the controller is

The controller of personal data is Impacto Monumental, Unipessoal Lda, which carries on the business of real estate mediation under the Douven brand.

Sociedade Unipessoal (a Portuguese single-shareholder private limited company), with registered office at Rua de Gassamar, n.º 651, 4415-822 Vila Nova de Gaia, Porto, single registration and legal person number (número único de matrícula e de pessoa coletiva) 518624960 and share capital of € 10.000,00.

The contact details published on this site are as follows:

2. What this policy applies to

This policy applies to the Living Canedo website and to the contacts that arise from it. It does not apply to third-party websites, applications or services the site links to (namely WhatsApp, your email program and your telephone application), nor to any processing Google carries out on the data it receives if you allow the map described in point 3.5: these are operated by other entities and governed by those entities' privacy policies.

3. What data is processed

3.1. Through the site: none

As at the date this policy was last updated, the site does not collect personal data. It has no contact form, no members' area and no user registration, no newsletter subscription, and it installs no cookies of its own. At no point does the site ask you for your name, your telephone number, your email address or any other data of yours.

3.2. When you contact us directly

The site converts through direct contact: the "Book a Viewing" button opens a WhatsApp conversation with Douven, with an introductory message already written (which is only sent if and when the user sends it), and the telephone and email contacts open the applications on the user's own device. The site neither mediates nor stores those communications.

If you contact us by one of those means, we then process the data you provide in the communication: normally your name, your telephone number or your email address, and the content of the message, as well as any information that turns out to be necessary in order to follow up on the request (for example, the typology you are looking for or the date of a viewing).

3.3. Measuring the site's audience

The site uses Vercel Web Analytics, an audience measurement tool that does not use cookies. It serves to know, in aggregate, which pages are viewed and how often. The controller does not use this information for advertising, to personalise the content shown to you, or to identify you individually. The Cookies and Storage page describes this point in detail.

On the provider's side, Vercel Inc., the privacy documentation published for this tool (vercel.com/docs/analytics/privacy-policy) describes the following: no cookies are used; the visitor is identified by a code ("hash") derived from the request received; and the visitor's session is not kept permanently, being automatically discarded after 24 hours.

Each data point may retain the date and time of the event, the URL, the page's dynamic path, the origin of the visit ("referrer"), the filtered query parameters, the geographic location (country, region and city), the device's operating system and its version, the browser and its version, the device type and the script version. The information is aggregated and does not make it possible to reconstruct a browsing path across sites or to identify the visitor personally.

3.4. Technical access logs

As happens with any website, the server hosting it may log technical data about each request, for example the IP address, the date and time, the page requested and the browser type. This processing is carried out by the hosting provider, identified in the list of processors referred to in point 6.

3.5. The Google map, only if you allow it

The Contact section can show a Google map with the location of the development. That map is third-party content and is only loaded after you have allowed it: until you do, and if you decline, the site makes no request whatsoever to Google's servers and no data of yours reaches them by this route. The Cookies and Storage page, point 5, describes the mechanism, how to accept or decline, and how to withdraw permission at any time.

If you allow it, your browser then requests the map directly from Google. In that communication, Google receives elements that are personal data — namely your IP address, the address of the page the map is embedded in and information about your browser — and it may set cookies on your device, as described on the Cookies and Storage page. The controller does not receive, does not keep and has no access to any of this: the communication is between your browser and Google.

The record of your permission (or of your refusal) is kept in your browser only, is not sent to any server, and is not an identifier.

4. Purposes and legal bases

• Responding to requests for information and arranging viewings: pre-contractual steps taken at the data subject's request and, where applicable, performance of the contract: Article 6(1)(b) of Regulation (EU) 2016/679 (GDPR).
• Measuring the site's audience in aggregate: the controller's legitimate interest in knowing how the site performs and in improving the information it publishes on it: Article 6(1)(f) GDPR.
• Showing the location map, if you allow it: the data subject's consent, given beforehand and withdrawable at any time: Article 6(1)(a) GDPR and, as regards the storage of information on your device, Lei n.º 41/2004, de 18 de agosto (the Portuguese statute on privacy in electronic communications), as currently in force. Without that consent, the map is not loaded.
• Complying with legal obligations: namely those arising from Lei n.º 15/2013, de 8 de fevereiro, the Portuguese statute governing the practice of real estate mediation, and the accounting and tax obligations arising from general law: Article 6(1)(c) GDPR.

No automated individual decision-making, including profiling, within the meaning of Article 22 GDPR, is carried out.

5. How long data is kept

Data is kept only for the period necessary for the purposes for which it was collected and for such legal periods as may apply, after which it is erased or anonymised.

As it is not possible to fix in advance a single period for all the processing described, these are the criteria that determine, in each case, how long data is kept, as Article 13(2)(a) GDPR permits.

6. Recipients and processors

Personal data is neither sold nor transferred to third parties for those third parties' own marketing purposes.

Data may be accessed by the service providers that process it on the controller's behalf (processors, within the meaning of Article 4(8) GDPR), namely the site's hosting provider and the provider of the audience measurement tool referred to in point 3.3, as well as by the public authorities to whom data must be disclosed under a legal requirement.

The only processor that processes data through this site is Vercel Inc., a company incorporated in the state of Delaware, United States of America, which provides three services: hosting the site, storing the floor plans in PDF (Vercel Blob) and the audience measurement referred to in point 3.3 (Vercel Web Analytics). The list of the providers Vercel itself uses is published by Vercel at security.vercel.com.

There is a second third party, and only with your prior permission: Google, which provides the map described in point 3.5. Under the terms of service published by Google (policies.google.com/terms), the entity that provides these services to users in the European Economic Area and Switzerland is Google Ireland Limited, with registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Google does not process data here on the controller's behalf, as a processor does: if you allow the map, it is your browser that communicates directly with Google, which processes the data so received under its own policies (policies.google.com/privacy), over which the controller has no control and whose retention periods are not for the controller to state.

No other provider processes data through this site: until you allow the map, the published site makes no request whatsoever to third-party servers.

7. International data transfers

Vercel Inc. is established in the United States of America, so the processing referred to in point 6 involves transferring personal data outside the European Economic Area. Vercel's data processing agreement (vercel.com/legal/dpa) incorporates the standard contractual clauses approved by the European Commission for transfers originating in the European Economic Area, the United Kingdom and Switzerland, which are the safeguard applicable to these transfers.

As regards Google: Google Ireland Limited is established in Ireland, therefore within the European Economic Area, but Google also processes data outside it. Unlike the position with Vercel, the controller is not party to any processing agreement with Google that would allow it to state which safeguard applies to a particular transfer: Google itself publishes that it relies, depending on the case, on adequacy decisions, on the EU-U.S. Data Privacy Framework and on the standard contractual clauses (policies.google.com/privacy/frameworks), and that is the information available. What is entirely in your hands is the decision everything here depends on: without your permission, the map is not loaded and no transfer occurs by this route.

8. Your rights

As a data subject, you have the following rights:

• Access: to know whether your data is being processed and, if so, to obtain a copy of it and information about the processing.
• Rectification: to ask for inaccurate data to be corrected or incomplete data to be completed.
• Erasure: to ask for your data to be deleted, in the situations provided for in the GDPR.
• Restriction of processing: to ask for processing to be suspended, namely while the accuracy of the data is being verified or an objection is being considered.
• Portability: to receive the data you provided to us in a structured, commonly used and machine-readable format, or to ask for it to be transmitted to another controller.
• Objection: to object, on grounds relating to your particular situation, to processing based on legitimate interests.

Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out up to that moment.

9. How to exercise your rights

You may exercise any of these rights in writing, through the email address published on the site, which is also the channel for data protection matters: mario@douven.pt. Alternatively, by letter to the address given in point 1.

You may be asked for additional information to confirm your identity, where there is reasonable doubt as to who is making the request. The request is answered within one month, extendable under Article 12(3) GDPR where the complexity or the number of requests justifies it.

10. Complaint to the supervisory authority

Without prejudice to any other administrative or judicial remedy, you may lodge a complaint with the national supervisory authority: the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority: www.cnpd.pt.

11. Changes to this policy

This policy may be updated whenever the way the site works or the processing described here changes, namely if a contact form comes to exist. The version in force is, at any given moment, the one published on this page.

Date last updated: 17 August 2026.