Privacy Policy

1 Introduction

This Privacy Policy is issued by PROLAR IMOVEIS ADMINISTRACAO E CORRETAGEM LTDA (CNPJ 87.506.283/0001-26), a real estate brokerage and property management company headquartered at Avenida Julio de Castilhos, 657, Centro, Caxias do Sul – RS, Brazil — hereinafter referred to as "Prolar Imóveis," "we," "our," or "us."

We operate the website prolarimoveis.site (the "Site") and related digital channels through which prospective clients, property owners, tenants, and visitors may interact with us. As the data controller, we are responsible for determining the means and purposes of any processing of personal data obtained through these channels.

This policy applies to all personal data we collect when you browse our Site, contact us directly, or communicate with us by telephone, email, or in person at our offices. We encourage you to read this document in full. If you do not agree with the practices described here, please discontinue use of our Site and refrain from submitting personal data to us.

We may link to third-party websites (for example, property portals, social media pages, or partner platforms). Those sites operate under their own privacy policies, and we accept no responsibility for their data practices. We recommend reviewing their policies before providing any personal information on those platforms.

2 Information We Collect

We collect only the personal data that is necessary for us to provide our services, respond to your enquiries, and comply with our legal obligations. The categories below describe the information we may receive:

Information you give us directly

When you reach out by telephone, email, or any other direct means of communication, you may provide us with personal data such as your full name, email address, phone number, postal address, and any details you share about the property or service you are enquiring about. We treat all such information as confidential and use it exclusively for the purpose of responding to your request and, where applicable, fulfilling the service agreement established between us.

Information collected automatically

When you visit our Site, our web server and analytics tools automatically record certain technical information. This may include:

• Your IP address and approximate geographic location (country/city level).
• The type and version of the browser and operating system you are using.
• The pages you visit on our Site, the order in which you visit them, and the time you spend on each page.
• The referring URL — that is, the website or search result that directed you to ours.
• Device identifiers and screen resolution, used solely for rendering our pages correctly.
• Interaction data such as scroll depth, button clicks, and link navigation, captured via analytics software.

This technical data is collected primarily through first-party and third-party cookies. It does not ordinarily identify you by name but may constitute personal data under applicable law when it can be combined with other information to single you out as an individual.

Information from third-party sources

We may receive information about you from publicly available property registers, credit reference agencies (when conducting tenancy or ownership verifications required by law), or from our advertising partners indicating, in aggregated and anonymised form, how users interact with our advertisements on platforms such as Google. We do not purchase or sell personal data lists.

3 How We Use Your Information

We process personal data only where we have a lawful basis to do so under the LGPD and, where applicable, the GDPR. The legal bases we rely on include: the fulfilment of a contract or pre-contractual steps at your request; compliance with a legal or regulatory obligation; our legitimate interest in operating a secure, functional, and well-marketed business; and, in specific circumstances, your freely given consent.

The purposes for which we use your data include:

• Responding to your enquiries: When you contact us about a property, rental management service, or any other matter, we use the information you provide to answer your questions, schedule appointments, and follow up appropriately.
• Providing and managing our services: For clients who engage us for property management, brokerage, or rental administration, we process your data to draft and execute contracts, coordinate with third parties such as maintenance providers, and manage payments and documentation as required by Brazilian law.
• Legal and regulatory compliance: Brazilian real estate brokerage regulations (COFECI/CRECI) and general civil and tax law require us to retain certain transactional records. We process data to the extent required to meet these obligations.
• Site analytics and improvement: Anonymised and aggregated traffic data helps us understand which pages and content are most useful to visitors, identify technical issues, and improve the overall experience of our Site.
• Marketing communications: Where you have provided consent, or where we have a legitimate interest in doing so, we may send you information about our services, market reports, or notable properties. You may opt out of marketing at any time by contacting us at the address below.
• Fraud prevention and security: We may use automatically collected technical data to detect, investigate, and prevent fraudulent activity, unauthorised access, or other misuse of our digital channels.

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on any individual. Our use of analytics is limited to aggregate, statistical purposes to guide business decisions at a population level.

4 Cookies & Tracking Technologies

Our Site uses cookies and similar technologies such as web beacons and local storage objects. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies serve a variety of purposes — some are essential for the Site to function, while others help us understand how visitors use our content and allow us to reach people who have previously visited our Site through targeted advertising.

You can control or disable cookies at any time through your browser settings. Note that disabling certain cookies may affect the functionality of our Site. Most browsers accept cookies by default, but you can configure them to refuse cookies or alert you when cookies are being sent. Refer to your browser's help documentation for instructions.

Category	Purpose	Retention
Strictly Necessary	Enable core website functions such as page navigation, load balancing, and security. These cannot be switched off as the Site cannot operate without them.	Session / up to 1 year
Analytics & Performance	Collect anonymised data about how visitors use the Site — pages visited, time spent, error messages. We use Google Analytics 4 (with IP anonymisation enabled) for this purpose. Data is aggregated and cannot identify you personally.	Up to 26 months
Advertising & Remarketing	Enable platforms such as Google Ads to serve relevant advertisements to users who have previously visited our Site, based on browsing behaviour. These cookies are set by Google LLC and are governed by Google's own privacy policy.	Up to 18 months
Functional / Preference	Remember choices you make (such as language preferences or whether you have dismissed a banner) to provide a more personalised experience on return visits.	Up to 12 months

We use Google Analytics 4 with IP anonymisation and data-sharing settings configured to minimise the transfer of personally identifiable information to Google. We have a Data Processing Agreement in place with Google LLC, as required under GDPR Article 28 and its LGPD equivalent. You may opt out of Google Analytics tracking by installing the Google Analytics Opt-Out Browser Add-on.

We may also use the Google Ads conversion tracking tag to measure the effectiveness of our paid search campaigns. This tag collects information about actions you take after clicking on one of our advertisements. No personally identifiable data is passed to Google through this mechanism; only hashed, anonymised signals are used for attribution.

5 Sharing With Third Parties

We do not sell, rent, or trade your personal data to any third party for their own commercial purposes. We may share your information only in the circumstances described below, and always with appropriate safeguards in place.

Service providers and processors

We engage carefully selected technology and professional service providers who process data on our behalf and under our instructions. These include our website hosting provider, email platform, cloud storage provider, and analytics tools (including Google LLC as described above). All processors are contractually bound to maintain the confidentiality and security of any personal data they handle and are prohibited from using it for any purpose other than delivering services to us.

Professional and legal partners

In the course of providing property management and brokerage services, it may be necessary to share relevant client information with solicitors, notaries, surveyors, accountants, insurance brokers, maintenance contractors, or other professionals directly involved in a transaction you have instructed us to manage. We will only share the minimum data necessary for each specific purpose.

Regulatory and public authorities

We may disclose personal data to Brazilian government agencies, courts, the Receita Federal, CRECI-RS, or any other regulatory body when required to do so by law, court order, or enforceable governmental request. In such cases we will, where legally permitted, notify you of the disclosure requirement.

Business transfers

In the unlikely event of a merger, acquisition, restructuring, or sale of all or part of our business, personal data held by us may be transferred to the acquiring entity. We will notify you in advance of any such transfer and of any material changes to how your data is processed, and you will retain the right to request deletion of your data before or after any such event.

International transfers

Some of our third-party service providers are headquartered outside Brazil — notably Google (United States). When personal data is transferred outside Brazil, we ensure appropriate safeguards are in place, such as the use of standard contractual clauses approved under LGPD and, where relevant, the EU-U.S. Data Privacy Framework. By using our Site, you acknowledge that your data may be processed in jurisdictions with different data protection standards than your country of residence.

6 Data Retention

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements imposed on us as a licensed real estate brokerage in Brazil.

• General enquiry data (name, contact details, enquiry content) is retained for up to five years from the date of last contact, in line with the civil limitation periods established under the Brazilian Civil Code (Lei 10,406/2002).
• Contractual and transactional records related to completed real estate sales, purchases, or managed tenancies are retained for a minimum of ten years to comply with fiscal, legal, and CRECI record-keeping obligations.
• Website analytics data collected via Google Analytics is retained for 26 months by default, after which it is automatically deleted from Google's servers. Aggregated statistical reports derived from this data may be retained indefinitely as they contain no personal data.
• Marketing consent records are retained for as long as you remain on our mailing list and for a period of three years after you withdraw consent, to demonstrate our compliance with applicable law.

When personal data is no longer required for any of the above purposes, we securely delete or anonymise it so that it can no longer be associated with any individual. In some cases, where immediate deletion is technically impractical, the data will be quarantined and permanently purged at the next scheduled deletion cycle.

7 Data Security

The security of your personal data is a matter we take seriously. We implement a combination of technical and organisational measures designed to protect your information against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit: Our Site is served exclusively over HTTPS using TLS 1.2 or higher. All data transmitted between your browser and our servers is encrypted so that it cannot be intercepted by third parties.
• Access controls: Access to personal data held in our internal systems is restricted on a need-to-know basis. Team members receive access only to the data necessary to perform their specific role, and all accounts are protected by strong, unique credentials.
• Regular security reviews: We periodically review our data handling procedures, IT infrastructure, and third-party service arrangements to identify and address potential vulnerabilities before they can be exploited.
• Staff awareness: All employees who handle personal data receive appropriate training on data protection obligations and our internal security policies as part of their onboarding and on an ongoing basis.
• Incident response: In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority (ANPD in Brazil) within the timeframes required by the LGPD and, where applicable, will inform affected individuals without undue delay.

Despite these safeguards, no transmission of data over the internet and no storage system can be guaranteed to be 100% secure. We encourage you to take your own precautions, such as keeping any reference numbers or passwords confidential, and to contact us immediately at contato@prolarimoveis.site if you suspect any unauthorised access to information you have shared with us.

8 Your Rights

Under the LGPD (and the GDPR, where applicable), you have specific rights with respect to the personal data we hold about you. These rights are not absolute — in some circumstances legal obligations may require us to retain or continue processing certain data — but we are committed to reviewing every request promptly and responding within the statutory timeframe of 15 days under the LGPD (or one month under the GDPR, extendable in complex cases).

To exercise any of these rights, please contact our Data Protection Officer by email at contato@prolarimoveis.site, clearly stating your name, the right you wish to exercise, and sufficient information to allow us to locate and verify your identity. We will not charge a fee for reasonable requests but reserve the right to charge an administrative fee or decline requests that are manifestly unfounded or excessive.

9 Children's Privacy

Our Site and services are directed exclusively at adults. We do not knowingly collect or process personal data from individuals under the age of 18. All real estate transactions and service contracts entered into through or facilitated by Prolar Imóveis require the involvement of persons with full legal capacity under Brazilian civil law.

If we become aware that personal data has been submitted to us by or on behalf of a minor without appropriate parental or guardian authorisation, we will promptly delete that information from our records. If you believe that a minor has inadvertently provided us with personal data, please contact us immediately at contato@prolarimoveis.site so that we can take appropriate action.

Where processing of a minor's data is necessary in the context of a legal obligation — for example, in transactions involving properties co-owned by minors through succession — we will process only the minimum data required and will handle it with enhanced confidentiality safeguards in accordance with Article 14 of the LGPD.

10 Changes to This Policy

Data protection law, technology, and our business practices continue to evolve. We review this Privacy Policy at least annually and whenever a material change to our data processing activities makes an update necessary. The most current version of this policy is always available on this page, and the "Last updated" date at the top will reflect the date of the most recent revision.

When we make changes that materially affect how we use your personal data — for example, introducing a new category of processing, sharing data with a new category of third party, or altering our retention periods — we will take appropriate steps to bring those changes to your attention. This may include a prominent notice on our homepage, a direct communication to known contacts, or a pop-up notification the next time you visit our Site.

Your continued use of our Site after any revision is posted constitutes your acknowledgement of the updated terms. If you do not agree with a revised version of this policy, you should cease using our Site and may contact us to request the deletion of any personal data we hold about you, subject to any legal retention requirements.

11 Contact & Data Controller Information

If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or want to raise a concern about the way we handle your personal data, please do not hesitate to get in touch. We aim to resolve all enquiries within 15 business days of receipt.

For matters specifically related to data protection, your correspondence will be handled by our designated Data Protection Officer, who is responsible for overseeing our compliance with the LGPD and other applicable privacy legislation.

For complaints that we have not resolved to your satisfaction, you have the right to escalate the matter to Brazil's national data protection authority:

• Autoridade Nacional de Proteção de Dados (ANPD) — accessible via the federal government portal at gov.br/anpd. The ANPD oversees the application of the LGPD and can investigate complaints, issue guidance, and impose sanctions where violations are found.