Skip to content

Last updated: August 2026

Privacy policy

This Policy describes the processing of personal data carried out during the pre-launch phase of Rivesta, where the main collection of data happens through the Founding Circle application.

1. Data controller

The controller of the personal data collected through Rivesta is the person responsible for operating the project.

Contact:

2. What data we collect

2.1 Data provided by the user

When the user submits the early-access form or contacts us, we may collect:

  • name;
  • email;
  • phone number, when provided;
  • profile type (investor, broker, etc.);
  • estimated search volume, when indicated;
  • districts or regions of interest, when indicated;
  • optional message or notes;
  • interest in partnership or collaboration, when indicated;
  • language used;
  • consent indication, where applicable.

2.2 Technical data

For security and service operation reasons, we may collect:

  • IP address (or a derived/hashed version);
  • user agent (browser, operating system);
  • date and time of access;
  • pages visited, where applicable;
  • traffic origin, where applicable;
  • security logs;
  • technical identifiers or cookies essential to operation, where they exist.

2.3 Future app usage data

If access to the platform is granted in the future, we may process additional data such as:

  • account data (credentials, preferences);
  • configured alerts;
  • favourites, history and interactions with opportunities;
  • metrics needed to operate and improve the service.

That data will be subject to the version of this Policy in force at the time.

2.4 Founding Circle application

When you submit an application to the Founding Circle, our pre-launch early access programme, we collect:

  • name;
  • email;
  • city and country;
  • current role and organisation;
  • a LinkedIn or professional profile link, where provided;
  • the areas of experience you select;
  • years of experience, markets, and level of experience with auctions or distressed assets, where provided;
  • your answers to the open questions on current activity, motivation, intended use and the priorities you consider important;
  • the interests you tick regarding the kind of relationship you are looking for;
  • the language of the application and a record of the consent given;
  • referral context, namely the referring domain and campaign parameters where present.

This data is processed in order to assess the application and to communicate with you about it, including arranging a conversation where applicable. The legal basis is the taking of steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR), together with the consent given in the form in respect of the professional information you choose to share (Article 6(1)(a)).

Applications are read by a small number of people involved in the assessment and are not shared with third parties for other purposes. Please do not include third-party confidential information, third-party personal data or information subject to professional secrecy in your open answers.

We do not deliberately collect special categories of personal data (for example, health data, racial or ethnic origin, political or religious beliefs, biometric data).

3. Personal data in publicly available content

The opportunities shown on Rivesta originate from publicly available announcements, notices and publications. That content may occasionally include personal data made public by the source itself, for example the names of parties to a process or the contact details of the entity responsible for a sale.

Regarding this data:

  • we process only what is strictly necessary to present and contextualise the opportunity;
  • we apply minimisation measures, and may abbreviate, omit or obscure identifying elements that are not necessary for that purpose;
  • the official source prevails and is the proper place for corrections to the original content.

The legal basis for this processing is the legitimate interest in making available and organising publicly accessible information relevant to the identification and triage of real estate opportunities (Article 6(1)(f) GDPR).

Anyone whose data appears in this content may request its removal, restriction or correction on the service through the address. Since this information is not collected directly from the data subjects, and where individual notification proves impossible or would involve disproportionate effort, this Policy also serves as information under Article 14 GDPR.

4. What we use the data for

We process personal data to:

  • manage early-access requests;
  • reply to contacts;
  • assess user profiles and suitability for the pilot phase;
  • communicate about Rivesta and the evolution of access;
  • operate, maintain and improve the service;
  • prevent abuse, spam, fraud and security breaches;
  • prepare a possible future contractual relationship, should the user join the service;
  • comply with applicable legal obligations.

5. Legal bases

Processing is based, depending on the case:

  • on pre-contractual steps taken at the data subject's request, namely to manage the early-access request and reply to the contact (Article 6(1)(b) GDPR);
  • on the controller's legitimate interest in keeping the service operational, secure and improving, in managing communications related to the request, and in making publicly accessible information available as described in section 3 (Article 6(1)(f) GDPR);
  • on consent, where applicable, for non-essential communications or for non-essential cookies/analytics (Article 6(1)(a) GDPR);
  • on compliance with a legal obligation, where applicable (Article 6(1)(c) GDPR).

6. Communications and marketing

We may send communications related to the access request, product evolution or invitations to test functionality, under the relationship initiated by the user.

Non-essential commercial communications will only be sent where an adequate legal basis exists, namely consent.

The user may, at any time, request that these communications stop through the address or, where available, the unsubscribe link included in the communication itself.

Essential messages (a direct reply to the request, relevant operational updates or legal notices) may continue to be sent for as long as necessary.

7. Who we share data with

We do not sell personal data, nor do we hand it to third parties for their own marketing.

We may use technical providers that process personal data on our behalf, only as needed for the operation of the website, replying to contacts, security and technical operation. Possible categories:

  • hosting and cloud infrastructure;
  • transactional email delivery;
  • database and storage services;
  • protection against abuse, spam or captcha, where applicable;
  • analytics or technical monitoring, where applicable;
  • support or contact tools, where applicable;
  • payments and invoicing, in the future, should paid plans exist.

These providers act under instructions, contracts and adequate safeguards, and only for the purposes set out in this Policy.

Data may be shared with authorities or third parties to comply with a legal obligation, in response to a legitimate request from a competent authority, or to defend rights.

8. International transfers

Some technical service providers may be located outside the European Economic Area (EEA).

In those cases, adequate safeguards are applied where required, namely standard contractual clauses approved by the European Commission, adequacy decisions or other legally provided mechanisms.

9. Retention

Data is kept for as long as necessary for the purposes for which it was collected:

  • early-access requests and related contacts: up to 24 months after the last interaction, unless erasure is requested or a legal need exists;
  • Founding Circle applications: up to 12 months after the decision where no place is offered, and for the duration of participation plus 24 months where one is;
  • technical and security logs: up to 90 days, unless an abuse or security investigation is needed;
  • account or app data, in the future: while the account/access is active and for a reasonable period after it ends;
  • invoicing data, in the future, should payments exist: for the period required by applicable law.

These periods may be adjusted in light of legal obligations or operational needs.

10. Cookies and analytics

Cookies strictly necessary for the operation of the website may exist, namely for language preference or security. We do not use advertising cookies or tracking technologies for advertising purposes.

We use a cookieless analytics tool, based on statistical, aggregated data, to understand site usage in general terms. It does not collect names, email addresses, phone numbers or answer content, and does not allow individual users to be identified. Should non-essential cookies or analytics tools be introduced in the future, this Policy will be updated and, where required, an adequate mechanism for information and consent collection will be made available.

11. Data subject rights

The user has the following rights over their personal data:

  • access;
  • rectification;
  • erasure, where applicable;
  • restriction of processing;
  • objection to processing based on legitimate interest;
  • portability, where applicable;
  • withdrawal of previously given consent, without affecting the lawfulness of prior processing;
  • lodging a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD, cnpd.pt).

To exercise these rights, simply send the request through the address. Additional information may be requested to confirm identity before replying. We reply within one month at most, extendable under the GDPR in cases of particular complexity, with the data subject kept informed.

12. Security

We adopt reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration or improper disclosure. These measures may include limited data access, encryption in transit, operational logs, abuse protection and careful selection of providers.

No electronic transmission or storage system is fully secure. Although we make reasonable efforts, we cannot guarantee absolute security.

13. Minors

Rivesta is not aimed at minors. We do not knowingly collect personal data from minors. If improper processing of a minor's data is identified, please contact us so we can proceed with erasure.

14. Changes to this Policy

This Policy may be updated to reflect the evolution of the service, of processing practices or of applicable law.

The version in force is the one published on this page, with the date of last update indicated. Material changes will be reflected on this page and, where warranted, communicated through an appropriate channel.

← Back to the product