Privacy Notice
1. Who we are
REIA is the data controller for personal data you provide when ordering a market analysis report. This notice explains what data we collect, why, how long we keep it, and your rights under GDPR.
2. What data we collect and why
| Data | Why we collect it | Legal basis |
|---|---|---|
| Full name | To identify you and address your report | GDPR Art. 6(1)(b) — performance of contract |
| Email address | To deliver your report and communicate about your order | GDPR Art. 6(1)(b) — performance of contract |
| Country of residence | To apply the correct consumer protection law and VAT treatment | GDPR Art. 6(1)(b) — performance of contract; Art. 6(1)(c) — legal obligation (VAT rules) |
| Property URL / address | To produce the analysis you requested | GDPR Art. 6(1)(b) — performance of contract |
| Intended use (LTR / STR / mixed) | To scope the analytical sections of your report | GDPR Art. 6(1)(b) — performance of contract |
| Order and payment records | Financial record-keeping and dispute resolution | GDPR Art. 6(1)(c) — legal obligation (PT/ES accounting and tax law) |
We collect only the data needed to deliver the report. We do not set analytics cookies, retargeting pixels, or advertising identifiers without your explicit opt-in consent.
Legal basis: GDPR Art. 5(1)(c) — data minimisation principle.
3. How we use your data
We use your data only to:
- Produce and deliver your market analysis report.
- Communicate about your order (delivery confirmation, error corrections, refund requests).
- Meet legal obligations (accounting, tax, consumer-rights compliance).
We do not sell your data. We do not use it for automated decision-making or profiling that produces legal or similarly significant effects (GDPR Art. 22).
4. Who we share data with
| Recipient | Purpose | Safeguard |
|---|---|---|
| Stripe (payment processor) | Payment processing | GDPR-compliant; Standard Contractual Clauses where applicable |
| Report delivery service | PDF delivery by email | Data processing agreement in place |
| Internal analyst agents | Report production | Internal — no transfer outside REIA systems |
We do not transfer your data outside the European Economic Area except under adequate safeguards as required by GDPR Chapter V.
5. How long we keep your data
| Data | Retention | Reason |
|---|---|---|
| Name, email, order details | 3 years from delivery | Customer dispute resolution window |
| Payment records | 7 years from transaction | PT/ES legal accounting requirements |
| Property URL, intended use | Duration of report production + 3 years | Customer dispute resolution |
After the retention period, data is deleted or anonymised.
6. Your rights under GDPR
You have the right to:
- Access (Art. 15): request a copy of the personal data we hold about you.
- Rectification (Art. 16): ask us to correct inaccurate data.
- Erasure (Art. 17): ask us to delete your data ("right to be forgotten").
- Restriction (Art. 18): ask us to limit processing in certain circumstances.
- Portability (Art. 20): receive your data in a machine-readable format.
- Objection (Art. 21): object to processing based on legitimate interests.
- Withdraw consent (Art. 7(3)): where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any right, email privacy@reia.eu with subject: "Data Rights Request — [your name]". We will respond within 30 days (GDPR Art. 12(3)).
Erasure procedure (Art. 17 — right to be forgotten)
- Email privacy@reia.eu with subject: "Erasure Request — [your name] — [order ID if known]".
- We will verify your identity by asking you to confirm from your registered email address.
- We will confirm erasure or explain any legal reason why certain data cannot be erased (e.g., accounting retention obligations) within 30 days.
- Payment records subject to the 7-year accounting retention cannot be erased before that period expires; all other data will be erased.
7. Cookies and tracking
Our website uses only essential cookies required for checkout (session management, CSRF protection). We do not use analytics cookies or advertising trackers without your explicit consent. You can withdraw consent for non-essential cookies at any time via the cookie preference centre.
Legal basis: GDPR Art. 6(1)(a) for non-essential cookies; ePrivacy Directive 2002/58/EC as transposed in PT (Lei n.º 46/2012) and ES (Ley 34/2002, LSSI-CE).
8. Complaints
If you believe we have not handled your data in accordance with GDPR, you may lodge a complaint with:
- Portugal: CNPD (Comissão Nacional de Proteção de Dados) — cnpd.pt
- Spain: AEPD (Agencia Española de Protección de Datos) — aepd.es
- The supervisory authority in your country of residence (GDPR Art. 77).
Revision log
| Version | Date | Author | Change |
|---|---|---|---|
| v1 | 2026-05-09 | Legal Advisor | Initial draft |