Legal

Privacy Policy

Last updated: 11 October 2026

This policy explains what personal data is collected through this website, why, and what your rights are. It is written to comply with the EU General Data Protection Regulation (GDPR) and Portugal's data protection law (Lei n.º 58/2019).

1. Who is responsible for your data

The data controller is Natalie Gutman, a real estate consultant based in Cascais, Portugal.

2. What data is collected and why

Personal data is collected when you fill in a form on this site, plus the limited technical and analytics data described below.

Guide download (email form)

Data: your email address, and whether you ticked the optional marketing box. Purpose: to give you access to the property-buying guide. Occasional tips and updates about buying property in Portugal are sent only if you separately ticked the optional marketing box on the form; you can withdraw that consent at any time by replying to any such email or using the contact details below. Legal basis: your consent.

Contact form

Data: your name, email address, whether you are enquiring as a buyer or a seller, and the message you write. Purpose: to reply to your enquiry and discuss how Natalie can help. Legal basis: your consent and steps taken at your request before entering into a possible service relationship.

Viewing and valuation requests

Data: your name, email address and telephone number; for a viewing, your preferred way of being contacted and the property you asked about; for a valuation, the address, type and number of bedrooms of your property and any message you add. Purpose: to arrange the viewing or valuation you requested and to contact you about it. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). This data is not used for marketing unless you separately opt in.

Technical site data

This website is hosted by GitHub, Inc. (GitHub Pages), a company based in the United States. When you open a page, GitHub logs your IP address for security purposes, under its own privacy statement. GitHub has certified to the EU-U.S. Data Privacy Framework, which covers the transfer of this data to the United States. Legal basis: legitimate interest in operating a secure website (Article 6(1)(f) GDPR).

Site analytics

Counting visits. This site uses PostHog to count visits and to see, as totals, how the site is used: which pages are read and how far down, which website a visit came from (the website name only), how fast pages load, technical errors the page throws, which listings are opened, shared or enquired about, whether photo galleries, floor plans and calculators are used (never the figures you enter), whether a form is started or sent (never what you typed), when a WhatsApp, phone or email link is tapped, when something on a page does not respond to a tap, and which other websites are opened from links here (the website name only). It sets no cookies and stores nothing on your device for this. PostHog’s server turns your IP address, browser type and the date into a code that cannot be reversed; the key that makes the code changes every day and is deleted, so visits on different days cannot be linked, and your IP address itself is not kept. These figures are looked at only as totals, never to follow one visitor, and are never matched with what you send through a form. Legal basis: legitimate interest in understanding how the site is used and keeping it working (Article 6(1)(f) GDPR). If your browser sends a Do Not Track or Global Privacy Control signal, or you use the button in section 6, this counting is switched off.

Property portfolio pages

Data: your IP address, browser type and the time of the request. Purpose: the property listings, photographs and their details are stored on a dedicated server and are fetched by your browser when you open the home page or any page that displays property listings, including pages shared by private link. Your IP address necessarily reaches that server in order for it to send the page content back to you; it is used only to deliver the listings and to keep the server secure, and it is not used to build a profile of you or to track you across sites. Legal basis: legitimate interest in operating and securing the website (Article 6(1)(f) GDPR).

3. Cookies and local storage

This site uses no advertising cookies and does not track you across other sites. No analytics cookies are set and nothing is stored on your device for analytics (see section 2), unless you ask for the counting to be switched off (see section 6). Fonts and styles are served from this website itself; apart from the analytics script described in section 2, nothing is requested from advertising or content-delivery networks. The exceptions are the property portfolio (pages that show listings load them from a dedicated server operated by this site’s technical provider, see section 4 below) and the forms on this site, which send what you enter to that same provider’s server when you submit them. No cookies are set by these requests.

The site stores small, strictly necessary items in your browser's local storage: natalie_guide_unlocked (so that, if you return after downloading the guide, you go straight to your resources instead of seeing the form again) and, only if you press Stop counting my visits in section 6, natalie_no_count (so that the counting stays switched off in this browser). These items contain no personal data, are not shared with anyone, and you can clear them at any time through your browser settings.

4. Who your data is shared with

The property listings on this site (details and photographs) are hosted, and your form submissions are received and relayed, for Natalie Gutman by Exclusive Recipe Unipessoal Lda, a company registered in Portugal, which acts as a data processor on her behalf under a written data processing agreement. The servers are located in France, and the underlying infrastructure provider is Hostinger operations, UAB (Vilnius, Lithuania), both within the European Union. Listing data and photographs are backed up nightly on the same EU infrastructure. No listing or visitor data is transferred outside the European Economic Area by this arrangement.

Your form submissions are first received on the technical provider’s server in the European Union (see above), are then stored in Google Sheets on Natalie’s own Google account, and a notification email is sent to Natalie through the technical provider’s email service. Google may process this data on servers outside the European Economic Area; where it does, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

Site analytics are processed by PostHog Inc. as a sub-processor of the technical provider under a written data processing agreement, on PostHog Cloud EU in Frankfurt, Germany. PostHog Inc. is a United States company; any access from the United States is covered by the EU Standard Contractual Clauses in that agreement.

Data is not sold, rented, or shared for advertising. It may be shared with professional advisers (for example a lawyer or accountant) only where needed to help with your specific enquiry, and with authorities where required by law.

5. How long it is kept

Guide sign-ups. If you ticked the marketing box, your email address is kept until you unsubscribe or ask to be removed. If you did not, it is deleted 12 months after you signed up.

Enquiries, viewing and valuation requests. Kept while your enquiry is active and for 24 months after our last contact, then deleted. If your enquiry leads to a property transaction, the records needed for it become part of the client file of the licensed brokerage and are kept for as long as the law requires (for example, seven years under Portugal’s anti-money-laundering law, Lei n.º 83/2017).

Earlier private-listing access requests. Until 11 October 2026, one unlisted listing page asked visitors for their email address before showing the full listing. That request no longer exists. The addresses already given are not used for anything and will be deleted by 10 November 2026.

Visit records. They hold no name, email address or IP address. They are used for 12 months; after that PostHog no longer includes them in any figures, although erasing them from its systems may take longer.

You can ask for deletion at any time.

6. Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict its use, receive a copy in a portable format, and withdraw consent at any time (without affecting earlier processing). Where data is used on the basis of legitimate interest (the technical site data, the visit counting and the property portfolio requests described in section 2), you also have the right to object to that use on grounds relating to your situation. Every marketing email also includes a one-click unsubscribe link. You can also switch the counting off with the Stop counting my visits button on this page; your choice is saved in this browser only. To object to the visit counting described in section 2, switch on Global Privacy Control or Do Not Track in your browser and the counting is switched off for that browser (Safari has neither setting; a content blocker or a browser that sends the signal works instead). Because the counting stores no identifier, there is nothing that can be linked back to you afterwards. You can also email the address below and we will confirm this in writing.

To exercise any of these rights, email natalie.gutman@expportugal.com. If you believe your data has been handled improperly, you can complain to Portugal's data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or to the data protection authority of the EU country where you live or work. Requests are answered within one month; if a request is complex this can be extended by up to two more months, and you will be told why. You may be asked to confirm your identity before data is released.

7. Other things you should know

You do not have to give any data. Every form on this site is optional. The fields marked as required are the ones needed to answer you; without them your request cannot be handled.

No automated decisions. Your data is not used for automated decision-making or profiling that has legal or similarly significant effects on you.

Children. This site is not aimed at anyone under 18. If you believe a child has sent personal data through it, please get in touch and it will be deleted.

Security. Pages and forms use encrypted connections. No system is completely secure, so please do not send sensitive information (such as health details or identity documents) through the forms.

8. Changes to this policy

This policy may be updated from time to time. The date at the top shows when it was last revised. If a change affects how data you have already given is used, you will be told by email where your email address is held for that purpose, and data you gave earlier will not be used for a new purpose without your consent where the law requires it.