Privacy policy

This page describes the data used when browsing the public pages of aptogroup.eu, in contact requests and when team members sign in to the internal area. It does not cover the processing of documents or third-party data within a specific professional engagement.

For questions about your personal data or to exercise your rights, contact Apto Group at geral@aptogroup.eu.

The form asks for your situation, name and email. Phone number, property location and message are optional. When analytics is active, the request also includes the page where you entered the website, the page of the form and the domain the visit came from. This data lets us understand your request and get back to you; the form cannot be sent without the required fields.

Your message is emailed to Apto Group through an email delivery provider. The form does not accept attachments and does not store a copy of the request in the application's database. Avoid including identity documents, health data or third parties' personal information that is not needed to explain your question.

Sending a request does not sign you up for a newsletter or any promotional mailing list.

The back office does not offer accounts to the public. For authorized team members, we keep the email address, sign-in credentials and session data needed to protect internal access.

Sign-in uses cookies that are necessary to recognize the team member's session. Blocking these cookies may prevent signing in to the back office.

We use an audience analytics service on the public pages to understand visits, interactions and the contact requests accepted by the email provider. This analysis starts automatically, even when the browser's Do Not Track option is turned on. We do not enable it in the private team or client areas.

The analysis uses a random browser identifier, the full addresses of the public pages and of the pages the visit came from, including parameters and fragments, campaign parameters (such as source, medium and campaign name), general information about the browser and device, the IP address and the approximate location derived from it. Visitor profiles are created and linked to the browser identifier, including for visitors who are not signed in. Depending on the service configuration, this may include interactions, page exits, visit duration, scrolling, performance metrics, technical errors and session replay. In session replay, only password fields are configured to be masked. The other form fields, including name, email, phone, property location and message, may be recorded, as well as page text, interactions, console logs and network request data. The service keeps internal filters for certain credentials and other sensitive content. The event confirming a contact request includes the browsing context.

Analytics cookies are set to last 180 days; the browser may limit their actual lifetime. You can block or delete these cookies in your browser settings. Deleting the cookies does not automatically delete events already sent.

The analytics service is configured to receive events through its European infrastructure. How long events are kept depends on the service configuration; you can request information or exercise your rights through the contact given on this page. Events and replays are linked to the browser identifier and may include content entered in forms. We do not link them to a signed-in account or to a client profile in the application.

To limit repeated submissions and abuse, the form uses identifiers derived from the IP address and the email. These identifiers are kept temporarily in server memory, with a 15-minute rate-limiting window, and are not stored in the database.

This check may temporarily block new submissions. If you need help, you can contact us directly by email.

We use hosting and storage providers to run the website and keep internal sign-in data, and email providers to send and receive messages. These services process the data needed for their respective functions.

The email delivery provider stores message content and delivery logs in the United States. According to that provider, transfers are covered by the standard contractual clauses included in its data processing agreement.

Messages received stay in the email inbox, and team sign-in data stays in the application's database. The form does not automatically delete messages after they are answered, and signing out does not delete internal credentials. You can ask about how long your data is kept or request its deletion through the contact given on this page, as permitted by law.

You can request access to, correction, deletion, restriction of processing, objection to processing and portability of your data, where applicable, at geral@aptogroup.eu. State the right you wish to exercise and the details needed to identify your request, without sending unnecessary personal data.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt. Changes to this information are published on this page with the date of the update.