Privacy policy
What we collect, what for, who receives it and how long it stays.
Version 2 · in force since 05.10.2026
Who the controller is
The controller is HOLY CHAOS, UNIPESSOAL LDA (NIF 519403908, Porto, Portugal). To write to us about personal data: info@flatin.pt.
What we collect
Only what you type into the form and what the site cannot work without.
- Name and contact — what you entered in the form.
- What you are looking for: type of home, area, budget, timing.
- Technical data about the request: IP address, time, page, browser. These go into the server logs.
- The consent text in the version you saw, and the moment you confirmed it.
What for and on what basis
The list is the same one as in the record of processing activities (Article 30 GDPR): this page is assembled from it rather than restating it.
| Processing | Purpose | Legal basis | Data subjects | Retention |
|---|---|---|---|---|
| Receiving and handling the request | take the request, work out what you are looking for and choose who to send it to | performance of the contract | visitors who left a request | 3 years after the request is closed |
| Passing the contact to the agency | send the request to the named professional of a licensed agency | consent | the same | 3 years after the request is closed |
| Working on the request in the workspace | let the assigned professional work on the request and record who saw the contact and when | performance of the contract, legitimate interest | the same | 3 years after the request is closed |
| Quality survey | check that what we promised was done, and spot deals made around the platform | legitimate interest | the same | a 12-month window; answers — 3 years after closing |
| Newsletter | send materials and selections to those who subscribed | consent | subscribers | until withdrawal; record of the withdrawal — 3 years |
| Professionals' accounts and sign-in | access of a partner agency's professional to the workspace | performance of the contract | professionals of partner agencies | for the term of the contract and 3 years after |
| Notifications to professionals | tell the professional that a new request has arrived | performance of the contract | professionals of partner agencies | 90 days |
| Technical logs and abuse protection | keeping the site working, investigating incidents, rate limiting | legitimate interest | all visitors | 30 days |
| Invoicing and accounting | invoice the agencies and meet tax obligations | legal obligation | contact persons at the agencies | the period set by tax law |
| Contacts of agents who source new-build data | reach the professional the development data came through and agree how the commission is shared | legitimate interest | agency professionals selling in the development | while the development is on sale, then one year |
Who receives the data
Your name and contact are received by the named professional at a licensed estate agency — that is what you authorise in the form. From the moment they receive them, the agency becomes an independent controller of that data and answers for it under its own policy.
Besides them, our suppliers touch the data for technical reasons:
| Recipient | What for | Location | Transfer outside the EU | Safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | the servers the site and the database run on | DE | no | processing agreement; the data stays in the EU |
| Cloudflare, Inc. | protecting the site and delivering pages | US | yes | EU standard contractual clauses |
| Google Ireland Ltd. (Google Workspace) | work mail: messages to professionals and to us | IE | yes | processing agreement and EU standard contractual clauses; the message to the professional carries neither your name nor your contact, only the request number |
| Telegram FZ-LLC | telling the professional a new request has arrived | AE | yes | there is no processing agreement; that is why the message carries neither your name nor your contact, only the request number |
We do not sell data and do not share it for third-party advertising.
How long we keep it
The periods are in the table above. A request stays 3 years after it is closed — not for the archive, but because a dispute over the fee can surface after the request is shut. Once the period is over, the data is deleted.
Cookies and measurement
The public site sets no cookies at all and carries no pixels or advertising scripts. That is also why there is no consent banner here: there is nothing to consent to.
There are two cookies on the domain, and both only for those who have signed in to the partners' workspace: the session cookie, without which signing in does not work, and a mark with no identifier that keeps the pages a partner opens out of the view count. Visitors to the site get none.
To know how many people read the site, after your first real action (click, tap, key press) the page sends our server a short request with the page address. At that moment the server derives an anonymous code from the IP address, the browser and a random value that changes every day at midnight (UTC) and is then deleted; the IP and browser are not stored. The code only stops us counting the same person twice on the same day and is deleted with that day's value; we keep daily totals only. There are no cookies, nothing is stored on your device and visits on different days cannot be linked. The legal basis is our legitimate interest in measuring the site's audience (Art. 6(1)(f) GDPR), with anonymous statistics that need no consent.
Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time. How to exercise them and how quickly we answer is on the «Your data» page.
Complaints
If you think we handled your data badly, write to us — and quite apart from that, you may complain to the supervisory authority: CNPD (Portugal).
Do you have to give the data?
No. Without a name and a way to reach you the request cannot be accepted — there would be nothing to answer on; everything else is optional.
Automated decisions
Who receives the request is chosen by software, from the type of home, the deal and the area. It is not a decision with legal effects for you: it settles who calls you, and you can ask for another professional. We do not profile within the meaning of Article 22 GDPR.
Changes
This policy is versioned; the version and the date it took effect are at the top of the page. The consent text is versioned separately, and the wording you saw is stored with each request.
The Portuguese version is the only authentic one; this translation is for information and has no legal force.