Privacy Policy

1 Introduction

Familia Bacellar is a brand operated by BACELLAR IMOBILIARIA COPACABANA LTDA, a real-estate company registered under CNPJ 59.240.516/0001-56, headquartered at Rua Constante Ramos, 00033, Loja a G SSL, Copacabana, Rio de Janeiro — RJ, Brazil (hereafter referred to as "we", "us", "our" or "Familia Bacellar"). We operate the website familiabacellar.site and any associated digital properties or communication channels.

This Privacy Policy describes how we collect, use, store, protect and — where necessary — share personal information when you visit our website, submit a contact or property-enquiry form, or otherwise interact with our services. It applies to all visitors, leads and clients regardless of their location, and is designed to meet the requirements of the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados — LGPD, Law No. 13.709/2018), the European Union's General Data Protection Regulation (GDPR — Regulation (EU) 2016/679), and applicable Brazilian consumer protection legislation.

By browsing our website or submitting your data through any of our forms, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, please discontinue use of our website. We will never sell your personal data to third parties and we will never use it for purposes incompatible with what is described below.

2 Information We Collect

We collect personal information only when it is necessary to deliver our services, respond to your enquiries, or improve the performance of our website. The categories of data we process are described below.

Information you provide directly

When you fill in a contact form, property-enquiry form, WhatsApp link, or any other interactive feature on our site, you may submit:

• Full name
• Email address
• Phone number (including WhatsApp number, if provided)
• Property preferences — such as neighbourhood, budget range, number of bedrooms, or transaction type (purchase, rental, valuation)
• Any additional information you voluntarily include in a free-text message field

You are never required to provide sensitive personal data (such as your CPF/CNPJ, identity document, financial details or biometric data) through our public website. Such data is collected only at a later stage, in person or through secure, dedicated channels, when a transaction makes it strictly necessary and you have given explicit, informed consent.

Information collected automatically

When you visit familiabacellar.site, our servers and third-party analytics tools automatically record certain technical data:

• IP address (anonymised where technically possible)
• Browser type, version and language preference
• Operating system and device type
• Referring URL — the page that directed you to our site
• Pages visited, time spent on each page, and click paths
• Date and time of each visit
• Conversion events — for example, clicking a WhatsApp button or submitting an enquiry form

This technical data is collected through cookies and similar tracking technologies, described in detail in Section 4 below. On its own, this data does not typically identify you as an individual, but it may become identifiable when combined with other information you have provided to us.

Information received from third parties

If you reach our website through a Google Ads campaign, Google may share aggregated audience or conversion data with us through our Google Analytics and Google Ads accounts. This data is governed by Google's own privacy policies and is used by us solely to measure the effectiveness of our advertising and to refine our audience targeting. We do not receive raw personal profiles from advertising platforms.

3 How We Use Your Information

Every piece of data we hold is used for a defined, legitimate purpose. We process your personal information on the following legal bases, as provided by the LGPD and GDPR:

• Performance of a pre-contractual relationship or contract — when you request a property visit, ask for a valuation, or enquire about a listing, processing your contact data is necessary to respond to and fulfil your request.
• Consent — where you have explicitly opted in to receive marketing communications or to allow certain non-essential cookies.
• Legitimate interests — for website analytics, security, fraud prevention, and improving our service, provided these interests are not overridden by your fundamental rights.
• Legal obligation — when required to comply with applicable laws, court orders, or regulatory authority requests.

Specific purposes

• Responding to your property enquiries and scheduling property visits
• Matching your stated preferences with available listings in our portfolio
• Sending follow-up communications regarding properties you have expressed interest in
• Sending periodic newsletters or market updates, where you have subscribed or consented
• Measuring and improving the effectiveness of our website and digital advertising
• Complying with anti-money-laundering (AML) and know-your-customer (KYC) obligations applicable to Brazilian real-estate intermediaries
• Maintaining records for accounting, tax and regulatory purposes
• Detecting and preventing fraudulent activity or abuse of our services

4 Cookies & Tracking Technologies

Cookies are small text files placed on your device when you visit a website. They help websites remember your preferences, measure traffic patterns, and enable targeted advertising. We use a combination of first-party cookies (set by familiabacellar.site directly) and third-party cookies (set by service providers).

Cookie categories we use

Category	Purpose & examples	Duration
Strictly necessary	Required for the site to function. Includes session management, CSRF protection, and consent-preference storage. These cannot be disabled without breaking the site.	Session / up to 1 year
Analytics	Google Analytics 4 (GA4) — tracks page views, session duration, device type and conversion events. Data is sent to Google servers and processed under Google's privacy framework. IP anonymisation is enabled.	Up to 2 years
Advertising	Google Ads conversion tracking and remarketing tags. These allow us to measure when a user who clicked our ad subsequently submitted an enquiry form, and to show relevant ads to past visitors on the Google Display Network.	Up to 90 days
Functional	Optional cookies that remember your search preferences and language settings to personalise your browsing experience on return visits.	Up to 1 year

Managing your cookie preferences

When you first visit our website, a cookie consent banner will present your options. You can accept all cookies, accept only strictly necessary cookies, or customise your preferences by category. You may change these preferences at any time by clicking the "Cookie Settings" link in the footer of any page.

Independently of our banner, you can also control cookies directly through your browser settings. Most browsers allow you to view, block or delete cookies. Note that disabling certain cookies may affect the functionality of our website. For more information about managing cookies in your browser, visit allaboutcookies.org.

To opt out of Google Analytics tracking across all websites, you can install the Google Analytics Opt-out Browser Add-on. To opt out of personalised Google advertising, visit Google Ads Settings.

5 Sharing With Third Parties

We do not sell, rent or trade your personal data. We may share your information with third parties only in the following strictly defined circumstances:

Service providers (data processors)

We engage trusted technology and professional-service providers who process data on our behalf and under our instruction. These include:

• Google LLC — providing Google Analytics, Google Ads, Google Workspace (email) and Google My Business. Data is processed in accordance with Google's Data Processing Addendum and, for EU users, Standard Contractual Clauses.
• Meta Platforms Ireland Ltd — if we run Instagram or Facebook advertising campaigns, pixel data may be processed by Meta under their Data Processing Terms.
• Web hosting and infrastructure providers — our website host has access to server logs which may include technical visitor data. They are bound by confidentiality agreements and may not use this data for any other purpose.
• CRM and email platforms — contact details of leads and clients may be stored in a customer relationship management system used exclusively for managing our property business.
• WhatsApp Business — if you contact us via WhatsApp, your messages are processed by Meta under WhatsApp's terms. We do not control Meta's infrastructure.

All service providers are required by contract to: (a) process data only on our documented instructions, (b) maintain appropriate security measures, (c) not sub-process data without our approval, and (d) assist us in meeting our obligations under the LGPD and GDPR.

Legal and regulatory disclosure

We may disclose your personal data to public authorities, courts, law enforcement agencies or regulatory bodies — including Brazil's National Data Protection Authority (ANPD) — when we are legally required to do so, or where disclosure is necessary to protect our legal rights, prevent fraud, or safeguard the safety of any individual.

Business transfers

In the event of a merger, acquisition, restructuring or sale of all or part of our business, personal data held by us may be transferred to the acquiring entity. We will notify you via email or a prominent notice on our website if such a transfer occurs, and any successor entity will be bound by this Privacy Policy.

6 Data Retention

We retain personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our default retention periods are:

• Website enquiry and contact form data: Retained for up to 3 years after your last interaction with us. This allows us to maintain a record of your expressed preferences and any related correspondence.
• Client transaction records: Retained for a minimum of 5 years after the conclusion of a transaction, in accordance with Brazilian tax and commercial law obligations.
• Marketing and newsletter subscription data: Retained for as long as your subscription is active, plus 6 months after an opt-out request, to process the unsubscribe and prevent accidental re-addition.
• Analytics and technical logs: Aggregated analytics data is retained in Google Analytics for up to 14 months per our account configuration. Server access logs are deleted after 90 days.
• Cookie consent records: Retained for up to 12 months as evidence of consent, after which a fresh consent is requested.

When the retention period expires, data is securely deleted or irreversibly anonymised. If you exercise a deletion right (see Section 8) before the retention period expires, we will honour your request unless we have an overriding legal obligation to retain the data.

7 Data Security

We take the security of your personal information seriously and implement a layered set of technical and organisational measures designed to protect it against unauthorised access, alteration, disclosure or destruction.

• Encrypted transport: Our website is served exclusively over HTTPS using TLS encryption, ensuring that data transmitted between your browser and our servers cannot be intercepted in transit.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Only authorised team members and service providers with a specific operational need can access client information, and they are bound by confidentiality obligations.
• Secure data storage: Data held in our CRM and email systems is protected by industry-standard encryption at rest, multi-factor authentication and regular access audits.
• Vendor security assessment: We select service providers that demonstrate robust security certifications and practices (such as ISO 27001 or SOC 2), and we review their security posture periodically.
• Incident response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ANPD and, where required, affected individuals within the timeframes prescribed by the LGPD and GDPR (72 hours for authorities under GDPR; prompt notification under LGPD).

While we apply all reasonable measures, no method of electronic transmission or storage is 100% secure. We encourage you to take steps to protect yourself online, including using unique, strong passwords and keeping your devices updated.

8 Your Rights

Under the LGPD (Articles 17–22) and the GDPR (Chapter III), you hold a comprehensive set of rights over your personal data. We are committed to facilitating the exercise of these rights promptly and without unnecessary barriers. Your rights are as follows:

How to exercise your rights

To exercise any of the rights listed above, please send a written request to contato@familiabacellar.site with the subject line "Data Rights Request". Please include your full name and, if applicable, the email address you used when contacting us, so we can identify your records. We will acknowledge your request within 5 business days and provide a substantive response within 15 business days (extendable to 30 business days for complex requests, with prior notice). We will not charge a fee for handling your request unless it is manifestly unfounded or excessive.

We may need to verify your identity before fulfilling certain requests. This is to ensure that we do not disclose or delete data at the request of someone other than the data subject.

9 Children's Privacy

Our website and services are directed exclusively to adults. We do not knowingly collect or process personal data from individuals under the age of 18 (or the applicable age of digital consent in their jurisdiction). Our property enquiry services are inherently intended for adults capable of entering into legally binding contracts.

If you are a parent or guardian and believe your child has submitted personal data to us without your consent, please contact us immediately at contato@familiabacellar.site. We will investigate and, if confirmed, delete the data from our systems promptly. We will not use any such data to contact the minor directly.

10 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, applicable law, or guidance issued by data protection authorities. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Where reasonably practicable, notify existing contacts by email or through a prominent notice on our website before the changes take effect
• Where required by law, seek fresh consent for any new processing activities

We encourage you to review this policy periodically. Your continued use of our website or services after changes have been posted constitutes your acceptance of the updated terms, to the extent permitted by applicable law. Prior versions of this policy can be made available on request.

11 Contact & Data Controller

If you have any questions, concerns or requests relating to this Privacy Policy or to the way we handle your personal data, please do not hesitate to reach out. We are committed to resolving any issues fairly and transparently.

The data controller responsible for your personal information is: