Privacy policy

NALA Lda, trading as Aurea Properties, is the data controller for the personal data described in this policy. It is based in Vilamoura, Algarve. You can contact Aurea by email at the address below.

The information collected depends on how you interact with Aurea. It may include:

• your name, email address, telephone number and preferred contact method;
• property interests, search preferences, budget, viewing requests and enquiry details;
• members’ account, authentication and private-office activity records;
• concierge request details, requested dates and party size;
• correspondence sent by email, telephone or WhatsApp; and
• limited technical and security information, such as an IP address, request time and essential session-cookie data.

Aurea uses personal data only where there is a lawful reason to do so. Depending on the circumstances, this may be to take steps requested before entering a contract, perform a contract, comply with a legal obligation, pursue a legitimate business interest or act with your consent.

• respond to enquiries and arrange introductions, calls or property viewings;
• operate and secure the members’ private office;
• record property requirements and provide relevant property or service information;
• coordinate requested concierge or partner services;
• protect the website, prevent misuse and diagnose technical problems;
• meet accounting, regulatory, anti-money-laundering and other legal duties; and
• send optional marketing only where the applicable legal requirements have been met.

Aurea does not sell personal data. Information may be shared only as reasonably necessary with hosting, database, email and IT providers; professional advisers; competent public authorities; and property or service partners involved in a request you have made.

The call-back form is protected by Cloudflare Turnstile, which checks that a request comes from a person rather than an automated script. To do this, Cloudflare processes technical information such as your IP address and browser characteristics under its own privacy policy.

If you follow a link to a partner or another external service, that provider will process information under its own privacy terms.

Some technology or communications providers may process personal data outside Portugal or the European Economic Area. Where data is transferred internationally, Aurea will use a lawful transfer mechanism and appropriate safeguards where required.

Personal data is kept only for as long as it is reasonably needed for the purpose for which it was collected, to manage an ongoing relationship, or to meet legal, regulatory, accounting and dispute-resolution requirements. It is then deleted, anonymised or securely archived as appropriate.

Subject to the conditions in applicable law, you may ask for access to your personal data, correction, deletion, restriction or portability, or object to certain processing. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing.

To exercise a right, email Aurea at the address below. Aurea may need to verify your identity before acting on a request. You may also complain to Portugal’s data-protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

Aurea uses proportionate organisational and technical measures intended to protect personal data. No internet service can guarantee absolute security, so please avoid sending unnecessary sensitive information through ordinary email or messaging services.

This policy may be updated when services, technology or legal requirements change. The latest version and its update date will be published on this page.