Privacy

Version 2026-10-08 · Last update: October 8, 2026

1. Responsible for the treatment

Vortica Digital, Lda., NIPC 514465670, Rua D. João V, 24, Leap Center, 1290-091 Lisbon, Portugal, is responsible for the data treatments carried out to operate the Boa Porta. For privacy, rights or questions: Email@boaporta.pt, subject «Privacy Boa Porta».

This policy covers the website, the account and the profiles. The authors are responsible for what they submit, but this does not transfer to users the data protection obligations that are the responsibility of the operator.

2. Processed data and its origin

We collect the data you provide: name, email, password protected by hash, language, declaration of majority, date and version of the accepted terms, presentation name, description, county, languages, landlord/tenant papers and choice of visibility. We do not ask for date of birth or identification document in the registration of this step.

We also handle technical account and profile identifiers, sessions, IP address and browser information associated with the sessions or technical records of the accommodation, attempts and security events, confirmation and recovery tokens protected by hash, operating information of the queue of emails and communications that you send us. We don't need your password in readable text and we never request it by email.

Profiles and data provided by itself are the main source. A complaint may include information sent by third parties about a profile or content. In this case, we collect only what is necessary and provide the additional information due to the affected person, unless applicable legal exception.

We handle the classification, text, name and contact details indicated in the comments, the confirmation status of the email and the technical identifiers necessary to reduce repetitions and abuse. The name is public; Contacts follow the chosen visibility options. Email comments are only published after confirmation. There is no uploading of contracts/documents, identity verification or assignment of lease stamps. Do not send sensitive data or lease documentation without request and appropriate instructions.

3. PURPOSES AND FUNDAMENTALS

• Create and manage the account, authenticate, regain access, make the private profile available and send transactional messages: execution of the contract and diligences at the request of the holder. Mandatory data is required for these features; Without valid email and credentials we cannot create the account.
• publicly make the profile available: Consent through the activation expressed by the holder, after information about the public hearing. You can remove this choice by deactivating the profile without losing access to the private account. Optional fields are not required to create the account.
• Prevent fraud and abuse, protect accounts and keep strictly necessary technical records: legitimate interest in the security and continuity of the service, considered with the rights of the holders. may exercise opposition in the legal terms.
• Handle requests, complaints, contestation and orders from the authorities: Compliance with applicable legal obligations and, in the part not imposed by law, a legitimate interest in managing the service and defending rights. Data preserved for litigation is limited to what is needed.
• Usage statistics using optional tools: Prior consent on the Public Site, separated from the creation of an account. The refusal does not prevent access. See the cookies section.

We do not use the acceptance of these terms as consent for marketing. In this step there is no newsletter or promotional sending associated with the registration. Predicted advertising does not give advertisers access to emails, accounts, passwords or private history.

4. What is public

A profile is only public after confirmation of the email and express activation. In this situation, any visitor, even without an account, can consult the name of presentation, description, county, languages, papers, month of membership and public code/link presented on the page. The code is random, but does not make the data that the holder publishes anonymous.

The account email, password, sessions, tokens, technical history and security records are not shown on the public profile. QR and cards forward to the profile; do not reveal these private data.

Disabling the profile prevents your query and search on Boa Porta, including by link and qr. It is not equivalent to deleting the account. Third parties may have saved content while they were public; We were unable to guarantee the elimination of copies outside the portal. We instruct search engines not to index profile pages, but we do not guarantee compliance with these instructions by third parties.

5. Recipients, providers and transfers

Internal access is limited to authorized persons who need to deal with support, security or legal obligations. We use hosting providers, databases, email, maintenance and security, subject to applicable data protection conditions and obligations. The accommodation used is PTISP/WebServer; The application and the base are in the accommodation associated with the domain. We do not publish credentials, contracts, databases or logs in the publicly accessible folder.

We may communicate data to authorities on a legal basis and to professionals subject to confidentiality when necessary to defend rights. We do not sell personal data, we do not make the user base available to advertisers and we do not send content from accounts or profiles to artificial intelligence services at this stage.

On the editorial site, if you authorize the measurement, Google Analytics is used, provided in Europe by Google Ireland Limited, with possible intervention by group entities and treatment outside the European Economic Area. The conditions of treatment of the provider and the legally admissible transfer mechanisms that effectively cover the recipient apply, such as the applicable adequacy decision or type contractual clauses with the necessary measures, apply. You can request information about the recipients and warranties applicable by our contact. Also see the Google information about partner data. Acceptance of cookies does not dispense with these guarantees.

6. Conservation

We keep account and profile as long as the account exists and the service is used. The holder can request deletion at any time. The deactivation only stops the post and keeps the information in the private area.

Sessions have 120 minutes of inactivity and a maximum absolute duration of 24 hours. Confirmation tokens expire in 24 hours; Recovery ones follow the validity indicated in the message, currently 30 minutes. Expiration prevents use, but does not necessarily mean immediate physical elimination. Expired tokens are cleaned by maintenance tasks.

Application security events are kept up to 90 days; Failed email job logs, up to 7 days; Daily application logs have rotation set to 14 days. Server logs, email and backups follow the periods and cycles of the hosting and are used only for the necessary technical purposes, not to reset a deleted profile as public. When a copy is restored, the relevant delete requests must be reapplied.

Requests and complaints are kept during the respective treatment and, later, only for the period necessary to fulfill obligations or the defense of rights, considering the nature of the case and the applicable legal deadlines. If there is a basis for conserving elements after an erasure request, we limit access and inform the holder when due. There is no unlimited conservation just because a data was a public day. You can ask for clarification on the period applicable to your case.

7. Cookies and browser storage

On WebApp we use technical session and protection against fraudulent requests, necessary for authentication and security. We do not load Google Analytics on the app's pages, nor do we transmit names, emails, searches, comments, private URLs or tokens to this tool.

On the editorial site, Google Analytics is only loaded after affirmative choice in the measurement panel. Refusing is as accessible as accepting; You can change the decision in “Cookie Preferences” in the footer. Preference is kept locally for approximately six months; Measuring cookies are configured with a maximum duration of 396 days, without automatic renewal per visit. The tool collects technical data and browsing events on eligible editorial pages, with deactivated Google signs and advertising customization.

Blocking strictly necessary cookies may prevent entry into the account; Refusing measurement does not prevent the use of the portal.

8. RIGHTS AND ORDERS

You can request access, rectification, erasure, treatment limitation and portability in the applicable cases, oppose treatments based on legitimate interest and withdraw consent without affecting the legality of the previous treatment. Some rights have legal limits, which will be explained when relevant.

Change the fields available in the personal area or write to Email@boaporta.pt. Deletion and export requests can be submitted by email; There is no need for an automatic button. We will confirm the identity proportionally before revealing, changing or erasing data. Do not send a copy of the identification document spontaneously.

We respond, as a rule, within a month; When the law allows an extension for the complexity or number of requests, we will inform you within that deadline and explain the reasons. We do not charge as a rule; Manifestly unfounded or excessive requests are dealt with in the legal terms.

can complain to National Data Protection Commission — CNPD and resort to the available judicial means, without having to contact us in advance.

9. Security, decisions and changes

We have adopted proportional technical and organizational measures, including access control, HTTPS, credential protection and tokens, protected sessions, limitation of attempts and separation of private files. No system allows to guarantee zero risk. Incidents are assessed and communicated to the authority and holders when the law requires it.

We do not make exclusively automated decisions with legal effects or similar impact on the acceptance of someone as a landlord or tenant. There is no automatic global rating of people at this stage.

Changes relevant to this policy will be published with a date and, where appropriate, communicated to the holders before further use. new incompatible purposes are not authorized by the simple publication of an updated version; new grounds and consent will be obtained when necessary.

Back to Boa Porta · Terms · Privacy · Cookies