Privacy Policy
Last updated: 22 October 2026
1. Who we are
ImoDesk is provided by Fátima & Tavares, Lda., NIPC 502 453 079, Rua da Portela, 42, 1800-306 Lisboa, Portugal. Privacy contact: privacidade@imodesk.pt.
2. Our two roles
- Processor for real estate agencies. When an agency uses ImoDesk, it decides which personal data of its clients (sellers, buyers, spouses, heirs, representatives) is processed and why. The agency is the data controller, and we process that data only on its behalf, under a Data Processing Agreement (Article 28 GDPR). If you are a client of an agency, please contact the agency to exercise your rights; we will help the agency respond.
- Controller for our own customers and website. We are the controller for the data of the agencies' staff who use ImoDesk (account data) and of visitors and contacts of our website.
3. Data processed on behalf of agencies
Identification data (name, tax number, ID document and validity, date and place of birth, nationality, marital status, addresses); contact data (phone, email); transaction data (property, price, commission, deposit, contract and closing dates, whether there is a mortgage loan and whether it is approved, whether taxes are paid); anti-money-laundering data required by Portuguese law 83/2017 (profession, employer, politically exposed person status, source and purpose of funds, means of payment, proof of address and profession, beneficial owner); copies of uploaded documents and the information extracted from them; activity records (who did what and when). We do not process special categories of personal data.
4. Data we process as controller
Account data of agency users (name, email, phone, role, login records); messages sent to us. We only use cookies that are essential for the platform to work (session cookies); we do not use analytics or advertising cookies. Purposes and legal bases: providing the service under contract (Art. 6(1)(b) GDPR); security and service improvement (legitimate interest, Art. 6(1)(f)); legal obligations (Art. 6(1)(c)).
5. Automated document review
Uploaded documents are read by an AI service to extract data and flag inconsistencies. Results are suggestions reviewed by people; no decision with legal effects is taken solely by automated means. Data is not used to train AI models.
6. Service providers (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare (R2) | Document file storage | European Union |
| MongoDB Atlas | Database | European Union (Frankfurt) |
| Emergent | Application hosting | {REGIAO_ALOJAMENTO_EN} |
| Anthropic | AI document reading | United States, under Standard Contractual Clauses |
| Resend | Transactional email | United States (sending from the EU) |
| Twilio / Meta (WhatsApp) | Messages to clients, when the agency enables them | United States |
| AssinaJá | Qualified electronic signature (Portuguese Digital Mobile Key) | Portugal |
Transfers outside the EU rely on an adequacy decision (EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses.
7. Retention
Data processed for agencies is kept for as long as the agency keeps it in ImoDesk, considering its legal obligations (for example, anti-money-laundering records must be kept for the period set by law). When an agency leaves, it can export its data for 30 days, after which we delete it. Account data is kept while the account is active and then deleted within 90 days, except where the law requires longer retention.
8. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data. Clients of agencies should contact the agency; for data we control, contact privacidade@imodesk.pt. You may also complain to the Portuguese data protection authority, the CNPD (www.cnpd.pt).
9. Security
See our Information Security Policy at imodesk.pt/en/security.
10. Changes
We will publish updates on this page and notify customers of material changes.