Privacy
Privacy Policy
The short version
We are a real estate agency in Ipanema. We collect your personal data when you enquire about a property, book a viewing, or sign a lease or purchase through us — and, in a lighter way, when you simply browse this website.
We do not sell your data. We share it only with the people a transaction actually requires: the owner or buyer on the other side, and the notary, lawyer or accountant handling the paperwork. You can ask us at any time what we hold, correct it, or have it deleted, by writing to consultant@oabitat.com.
This policy explains what we do with personal data, on what legal basis, for how long, and what you can require of us. It applies to this website and to the brokerage, rental and property-management services we provide from our office in Rio de Janeiro.
1. Who is responsible for your data
The controlador — the party that decides how and why your data is processed — is:
OABITAT REAL ESTATE LTDA (trading as Oabitat)
CNPJ 48.622.109/0001-97
Rua Barão da Torre 167, loja, Ipanema, Rio de Janeiro – RJ, CEP 22.411-001, Brazil
CRECI-RJ 089162/O
E-mail: consultant@oabitat.com · Telephone and WhatsApp: +55 21 95902 8516
Under Article 41 of the LGPD a controller normally appoints an encarregado (data protection officer). Resolution CD/ANPD nº 2/2022 exempts agentes de tratamento de pequeno porte from that requirement, provided they keep an open channel for data subjects. Oabitat is registered as a microempresa and falls within that definition. The e-mail address above is that channel, and messages sent to it about personal data are handled directly by the agency’s management.
2. What we collect, why, and on what legal basis
The LGPD requires a lawful basis for every processing activity. Ours are set out below. Where the basis is consent you may withdraw it at any time; where it is the performance of a contract or a legal obligation, withholding the data usually means we cannot complete the service.
| What we collect | Why | Legal basis (Art. 7) | How long we keep it |
|---|---|---|---|
| Name, e-mail, telephone and the message you send through a contact or property enquiry form | To answer you, arrange a viewing and advise on properties | Pre-contractual steps at your request (VI); our legitimate interest in responding (IX) | Up to 24 months from our last contact, unless you become a client |
| Your search criteria, budget and the properties you ask about | To send you suitable listings and understand what you are looking for | Pre-contractual steps (VI); consent for marketing e-mails (I) | Until you ask us to stop, or 24 months of inactivity |
| CPF or passport, identity document, address, marital status, proof of income and bank details | To draw up a lease or a purchase contract, run the tenancy checks a landlord requires, and register a deed | Performance of a contract (V); compliance with a legal obligation (II) | Up to 10 years after the transaction, the general limitation period under Art. 205 of the Civil Code |
| Invoices, commission records and tax documents | Accounting and tax compliance | Legal obligation (II) | At least 5 years, as required by the tax authorities |
| WhatsApp and e-mail correspondence with us | To keep a record of what was agreed and continue the conversation | Performance of a contract (V); legitimate interest (IX) | For the life of the relationship, then as above |
| IP address, browser, device and pages visited | Security, fraud prevention and understanding how the site is used | Legal obligation (II) for access logs; legitimate interest (IX) for the rest | Access logs for 6 months, under Art. 15 of the Marco Civil da Internet |
We do not knowingly collect dados sensíveis — data on health, religion, political opinion, union membership, biometrics or sexual life. Please do not send them to us. If a landlord or a bank asks for something in that category as part of an application, we will tell you first and ask for your explicit consent.
3. Cookies and measurement
A cookie is a small file a website stores in your browser. This site uses three kinds:
- Strictly necessary — they keep your language selection, your currency and your session working. The site cannot function without them.
- Analytics — Google Analytics 4 tells us how many people visit, which pages they read and how they arrived. We use it in aggregate; we do not use it to identify you personally.
- Contact and CRM — HubSpot records that an enquiry came from a particular visit, so that a conversation started on the site can be continued by e-mail. Google reCAPTCHA runs on our forms to keep automated spam out.
You can block or delete cookies in your browser settings at any time; the strictly necessary ones will simply be recreated on your next visit, and blocking them may stop parts of the site working. You can also opt out of Google Analytics with the browser add-on Google provides.
4. Who else sees your data
We share personal data only where a service or a transaction requires it, and only to the extent required:
- The other side of a transaction — the owner, the buyer, the tenant, or their representative.
- Professionals handling the paperwork — the cartório, the notary, lawyers, accountants and, where a mortgage is involved, the bank.
- Property managers and condominium administrators, where we manage a property on your behalf.
- Our service providers, acting as operadores on our instructions: our website host, our e-mail provider, HubSpot (CRM), and Google (analytics and anti-spam).
- Public authorities, where a law, a court order or a regulatory request obliges us.
We do not sell personal data, and we do not pass your contact details to third parties for their own marketing.
5. International transfers
Some of the providers above store data outside Brazil, principally in the United States and the European Union. Article 33 of the LGPD permits this where the transfer is necessary for the performance of a contract, where the data subject has given specific consent, or where the provider offers adequate guarantees. Our providers are engaged under their standard data protection terms, which include the contractual safeguards required for international transfers. If you would like to know where a specific category of data is held, ask us.
6. How long we keep your data
The table in section 2 gives the period for each category. In summary: enquiries that do not lead to a transaction are deleted or anonymised after 24 months; records connected to a completed transaction are kept for as long as they may be needed to defend or establish a right, and tax records for the period the tax authorities require. When a period ends, the data is deleted or anonymised.
7. Your rights under the LGPD
Article 18 gives you the following rights. You may exercise any of them free of charge, and we will answer within a reasonable time.
To know whether we process your personal data at all.
To obtain a copy of the data we hold about you.
To have incomplete, inaccurate or out-of-date data put right.
Of data that is unnecessary, excessive, or processed contrary to the law.
To have your data transferred to another provider on request.
Where we rely on your consent, you can require the data to be erased.
To know which public and private bodies we have shared your data with.
To be told what happens if you decline to give consent.
To withdraw consent at any time, without affecting what was lawful before.
How to exercise them
Write to consultant@oabitat.com from the address you gave us, or ask us in writing at the office. We may need to confirm your identity before releasing data, which protects you as much as us. If you are not satisfied with our answer, you may complain to the Autoridade Nacional de Proteção de Dados (ANPD), the Brazilian supervisory authority, at gov.br/anpd.
8. Security
We keep personal data on access-controlled systems, use encrypted connections for this website and our e-mail, and limit access to the people who need it to do their work. No system is perfect; if a security incident occurs that presents a relevant risk to you, we will notify you and the ANPD as Article 48 of the LGPD requires.
9. Children
Our services are directed at adults. We do not knowingly collect data from children or adolescents. Where a minor appears in a transaction — as an heir or a co-owner, for instance — their data is provided and handled through their legal representative.
10. Changes to this policy
We update this page when our practices change or the law does, and the date at the top always shows the current version. If a change materially affects how we use data you have already given us, we will tell you directly rather than relying on this page alone.
Write to us and a person will answer — not a form. We can tell you what we hold, correct it, or delete it.
This page is published in several languages. In the event of any divergence between versions, the Portuguese text prevails, as Brazilian law governs this policy and the relationship between us. See also our Terms of Use.