GO_TO_CONTENT
logo

Partners

Blog

Privacy Policy

PRIVACY POLICY — CondoConnect

Version 1.0
18 September 2026

1. Introduction

This Privacy Policy (hereinafter the “Policy”) aims to inform users of the CondoConnect application and visitors to the website www.condoconnect.eu (LINK) (jointly referred to as “Users”) about how their personal data is processed when using the website condoconnect.eu (LINK) and the CondoConnect application (together, the “Services”).

CondoConnect is committed to protecting its users’ privacy and personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — “GDPR”), Law No. 58/2019 of 8 August (the law implementing the GDPR in Portugal), and other applicable legislation.

We recommend that you read this Policy carefully before using the Services. By accessing or using the Services, the user acknowledges having read the information provided herein.

2. Who we are — Identification of the Data Controller

The data controller, as defined in Article 4(7) of the GDPR, is CondoConnect – Construção, Tecnologia e Serviços, Lda., a legal entity with registration number 519189000, with its registered office at Rua da Portela, n.º 15, 2230-131 Sardoal, Portugal.

For any questions concerning this Policy, you may contact the data controller by email at: privacy@condoconnect.eu (LINK)

3. Categories of data subjects

In connection with the use of the Services, CondoConnect processes personal data relating to the following categories of data subjects:

  • Condominium administrators and managers;

  • Condominium unit owners, property owners, landlords, tenants, occupants and representatives;

  • Service providers;

  • Business contacts and prospective customers;

  • Website visitors.

4. Categories of personal data processed

The categories of personal data processed, organised by module or functionality of the Services, are as follows:

4.1. Registration, account and authentication

  • Name, email address, telephone number, address, tax identification number (where necessary), profile photograph (optional), internal identifier, profile, protected credentials (hash), session tokens, access logs.

4.2. Companies, teams and permissions

  • Company, role, profile, access level, permissions, assigned condominiums, action history.

4.3. Condominiums, buildings and units

  • Property identification, the user’s relationship with the unit (owner, condominium unit owner, landlord, tenant, occupant, representative).

4.4. Condominium fees and financial information

  • Condominium fee amounts, payments, debts, penalties, receipts, supporting documents, financial history.

4.5. Payments

  • Internal reference, Multibanco reference, mobile telephone number (MB WAY), payment method, date, amount, status, receipt.

4.6. Incidents

  • Author, description, photographs, attachments, comments, location, service provider, status, dates, history.

4.7. Notices and circulars

  • Author, recipients, title, content, attachments, condominium, dates, delivery records.

4.8. Chat, messages and communications

  • Participants, content, attachments, date/time, associated channel.

4.9. Document management

  • User, document type, condominium/unit, dates, permissions, history. This may include meeting minutes, regulations, contracts, insurance policies, powers of attorney, invoices and receipts.

4.10. Meetings and voting

  • Participants, meeting notice, agenda, attendance, powers of attorney, votes cast, results, meeting minutes.

4.11. Service providers

  • Name, email address, telephone number, address, tax identification number, company, professional category, incidents/tasks, quotations, documents, history.

4.12. Common areas and bookings

  • User, unit, space, date, time, booking status.

4.13. Support and assistance

  • Name, email address, telephone number, account identification, request content, attachments, communications, history.

4.14. Notifications

  • FCM token, user identifier, notification preferences and permissions, event type, technical delivery data.

4.15. Analytics and metrics

  • Technical identifiers, usage events, functionalities, device data, performance (Firebase Analytics in the application, Google Analytics on the website).

4.16. Diagnostics and security

  • Logs, actions, errors, crashes, date/time, technical identifiers.

Note on special categories of data

The CondoConnect platform was not designed to collect or process special categories of personal data within the meaning of Article 9 of Regulation (EU) 2016/679 (GDPR), namely data concerning health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic data, biometric data, or data concerning a person’s sex life or sexual orientation.

No field, form or functionality of the platform requests or requires this type of information to be entered. However, since certain functionalities allow users to submit free-text content — including messages, incidents, documents, photographs and comments — users may incidentally include special categories of data in the content they submit.

Users must refrain from entering special categories of data on the platform, unless this is strictly necessary for the purpose concerned and is based on an appropriate legal ground.

5. Purposes, legal bases for processing and data retention periods

Personal data is processed for the purposes, on the legal bases, and retained for the periods identified in the following points.

A — Account, Access and Permission Management

5.1. Account creation and management

  • Description: Create, activate and administer user accounts; authenticate identities; associate profiles with organisations, condominiums or units; manage access permissions.

  • Data processed: Name, email address, telephone number, address, tax identification number; profile photograph (optional); internal identifier, language, profile, role; account status, credentials (hash); session tokens, access logs.

  • Legal basis: Article 6(1)(b) — performance of a contract or steps taken prior to entering into a contract; Article 6(1)(f) — legitimate interests (account created by the condominium management company).

  • Retention period: Following deactivation: 30 days to reverse the deactivation; thereafter, deletion or anonymisation, unless a legal obligation applies.

5.2. Company, team and permission management

  • Description: Associate employees with condominium management companies; define roles, access levels and assigned condominiums; record administrative actions.

  • Data processed: Company, role, profile, access level; permissions, assigned condominiums; action history.

  • Legal basis: Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests (organisation and security).

  • Retention period: For as long as the user is associated with the company; permissions are withdrawn when the association ends; audit history: 12 months after the association ends (a longer period applies in the event of an incident or proceedings).

B — Condominium and Property Management

5.3. Condominiums, buildings and units

  • Description: Register and organise condominiums, buildings and units; associate owners, condominium unit owners, tenants and representatives; manage permissions.

  • Data processed: Property identification; the user’s relationship with the unit; permissions, association history.

  • Legal basis: Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests.

  • Retention period: For as long as the relationship with the unit, condominium or company continues; following termination: retention to maintain continuity of historical records, comply with legal obligations or defend rights.

5.4. Incidents and maintenance

  • Description: Record problems in buildings or units; collect descriptions and evidence; assign and monitor their resolution.

  • Data processed: Author, description, photographs, attachments; comments, location; service provider, status, dates, history.

  • Legal basis: Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests.

  • Retention period: For as long as the incident remains open; following closure: 5 years (warranty, complaints, defence of rights); a longer period applies if linked to a contract, construction work, insurance claim or litigation.

5.5. Document management

  • Description: Store and make available meeting minutes, regulations, contracts, insurance policies, invoices and other documents; control access.

  • Data processed: User, document type; condominium/unit, dates; permissions, access history.

  • Legal basis: Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests / defence of rights.

  • Retention period — accounting/tax documents: 10 years.

  • Retention period — contracts/insurance policies: Duration of validity + applicable limitation period.

  • Retention period — meeting minutes/resolutions: Long-term retention.

  • Retention period — powers of attorney: Duration of validity + period required for evidentiary purposes.

  • Retention period — quotations not awarded: 2 years.

5.6. Meetings and voting

  • Description: Convene meetings; manage attendance and representation; collect votes; determine results; prepare and make meeting minutes available.

  • Data processed: Participants, meeting notice, agenda; attendance, powers of attorney; votes cast, results, meeting minutes.

  • Legal basis: Article 6(1)(f) — legitimate interests; Article 6(1)(b) — performance of a contract.

  • Retention period — meeting minutes and results: Long-term retention.

  • Retention period — meeting notices, attendance records, powers of attorney: For as long as necessary + applicable period for challenging resolutions.

  • Retention period — technical voting data: Deleted/anonymised after the meeting minutes have been finalised.

5.7. Common area bookings

  • Description: Make and administer bookings for common areas; check availability; manage schedules and cancellations.

  • Data processed: User, unit, space; date, time, booking status.

  • Legal basis: Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests (organisation and conflict prevention).

  • Retention period: 12 months after the booking has taken place or been cancelled; a longer period applies where a payment, incident or associated proceedings exist.

C — Financial Information and Payments

5.8. Condominium fees and financial management

  • Description: Issue and manage condominium fees; record payments, outstanding amounts and penalties; issue receipts; report on the accounts.

  • Data processed: User/unit identification; condominium fees, amounts, status (paid/overdue/outstanding); receipts, supporting documents, financial history.

  • Legal basis: Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests / defence of rights (debt collection).

  • Retention period: Throughout the relationship with the condominium and for as long as outstanding amounts remain.

  • Retention period — accounting/tax documents: 10 years.

  • Retention period — debt collection data: Until the applicable limitation period expires.

5.9. Payment processing

  • Description: Generate Multibanco references or MB WAY payment requests (via SIBS); confirm transactions; associate payments; issue receipts. CondoConnect does not store full payment card details.

  • Data processed: Internal reference, Multibanco reference; mobile telephone number (MB WAY), payment method; date, amount, status, receipt.

  • Legal basis: Article 6(1)(b) — performance of a contract; Article 6(1)(c) — legal obligation (tax and accounting); Article 6(1)(f) — legitimate interests (fraud prevention).

  • Retention period — accounting/tax documents: 10 years.

  • Retention period — transaction records: For as long as necessary for legal obligations, reconciliation and defence of rights.

D — Communications

5.10. Notices, circulars and operational communications

  • Description: Communicate notices, decisions, maintenance work, interruptions or urgent situations to users.

  • Data processed: Author, recipients; title, content, attachments; condominium, dates.

  • Legal basis: Article 6(1)(c) — legal obligation (where legally required); Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests.

  • Retention period — temporary notices: 12 months after they cease to have effect.

  • Retention period — communications documenting decisions or obligations: The retention period of the associated matter or proceedings.

5.11. Chat, messages and comments

  • Description: Enable communication between authorised users; centralise exchanges concerning condominiums, incidents, documents and services.

  • Data processed: Participants, content, attachments; date/time, associated channel.

  • Legal basis: Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests (traceability).

  • Retention period: Throughout the contractual relationship; following closure of the matter: a maximum of 2 years.

  • Retention period — messages relevant to an incident, meeting, contract or litigation: The retention period of the associated matter or proceedings.

5.12. Operational and push notifications

  • Description: Communicate relevant events: condominium fees, payments, incidents, messages, meetings, documents.

  • Data processed: FCM token, user identifier; preferences, event type; technical delivery data.

  • Legal basis: Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests; Article 6(1)(a) — consent (promotional notifications).

  • Retention period — token: For as long as the account/device remains active; deleted upon deactivation.

  • Retention period — technical sending records: 6 months.

  • Retention period — permanent content: The retention period of the originating module.

E — Service Providers and Support

5.13. Service provider management

  • Description: Register service providers; request and manage proposals/quotations; assign tasks and incidents; monitor service work.

  • Data processed: Name, email address, telephone number, address, tax identification number, company; professional category; incidents/tasks, quotations, documents, history.

  • Legal basis: Article 6(1)(b) — steps taken prior to entering into a contract and performance of a contract; Article 6(1)(c) — legal obligation (accounting, tax); Article 6(1)(f) — legitimate interests.

  • Retention period: Throughout the pre-contractual and contractual relationship.

  • Retention period — quotations not awarded: 2 years.

  • Retention period — contracted services: Contract duration + warranty period + period required for defence of rights.

  • Retention period — invoices: 10 years.

5.14. Support and assistance

  • Description: Respond to support requests; identify and resolve technical or functional problems; follow up on complaints.

  • Data processed: Name, email address, telephone number, account identification; request content, attachments; communications, history.

  • Legal basis: Article 6(1)(b) — performance of a contract or steps taken prior to entering into a contract; Article 6(1)(f) — legitimate interests; Article 6(1)(c) — legal obligation (complaints).

  • Retention period: While the request is being handled; following closure: 2 years.

  • Retention period — complaints (complaints book): A minimum of 3 years (Decree-Law No. 156/2005).

  • Additional retention period: A longer period applies in the event of proceedings.

F — Analytics, Diagnostics and Security

5.15. Analytics and usage metrics

  • Description: Measure use of the website, platform and application; analyse functionalities; produce statistics; improve the user experience.

  • Data processed: Technical identifiers; usage events, functionalities; device data, performance.

  • Legal basis: Article 6(1)(a) — consent (Google/Firebase Analytics and non-essential technologies); Article 6(1)(f) — legitimate interests (aggregated or anonymised metrics).

  • Retention period — identifiable/pseudonymised data: A maximum of 14 months; thereafter, deletion or irreversible aggregation.

  • Retention period — anonymised data: No time limit.

  • Withdrawal of consent: Collection ceases.

5.16. Diagnostics, Crashlytics and error resolution

  • Description: Detect errors and failures; analyse crashes; diagnose technical problems; fix vulnerabilities.

  • Data processed: System logs, errors, crashes; date/time, technical identifiers.

  • Legal basis: Article 6(1)(f) — legitimate interests (operation and security).

  • Retention period: 90 days; a longer period applies where necessary for an unresolved problem; thereafter: deletion or anonymisation.

5.17. Security, authentication and technical logs

  • Description: Protect accounts and systems; manage sessions; control access; prevent abuse and fraud; investigate incidents; maintain audit logs.

  • Data processed: Actions performed, identifiers; date/time, access events, changes; security events.

  • Legal basis: Article 6(1)(f) — legitimate interests; Article 6(1)(b) — performance of a contract.

  • Retention period: 12 months; thereafter: deletion or anonymisation; a longer period applies in the event of an incident, fraud, audit or proceedings.

G — CondoConnect Business Relationship and Billing

5.18. Billing and business relationship management

  • Description: Manage proposals, contracts and subscriptions; issue invoices; process collections; maintain accounting records; manage renewals and cancellations.

  • Data processed: Customer contact details; proposals, contracts, subscriptions; billing, collections.

  • Legal basis: Article 6(1)(b) — steps taken prior to entering into a contract and performance of a contract; Article 6(1)(c) — legal obligation (tax and accounting); Article 6(1)(f) — legitimate interests (management of receivables).

  • Retention period — data relating to prospects who do not become customers: 2 years after the last contact.

  • Retention period — contractual data: Contract duration + periods required for legal obligations + defence of rights.

  • Retention period — invoices/accounting records: 10 years.

H — Compliance, Rights and Legal Defence

5.19. Data subject requests and cooperation with authorities

  • Description: Respond to requests for access, rectification, erasure, restriction, objection or portability; retain evidence of compliance; cooperate with authorities.

  • Data processed: Requests received, responses; supporting documentation.

  • Legal basis: Article 6(1)(c) — legal obligation; Article 6(1)(f) — legitimate interests (evidence of compliance).

  • Retention period: While the request is being handled; thereafter: 5 years to demonstrate compliance with the GDPR and defend rights.

5.20. Litigation and defence of rights

  • Description: Manage complaints and disputes; collect debts; exercise or defend rights in judicial, arbitration or administrative proceedings; preserve evidence.

  • Data processed: All data relevant to the proceedings concerned.

  • Legal basis: Article 6(1)(f) — legitimate interests (establishment, exercise or defence of rights); Article 6(1)(c) — legal obligation (order from an authority).

  • Retention period: Until the proceedings have been definitively concluded + the period for compliance with the decision + the applicable limitation period.

  • Scope of retention: Applies only to data relating to the proceedings.

5.21. Security incidents and data breaches

  • Description: Investigate and resolve incidents; document facts, effects and corrective measures; notify the CNPD and data subjects where required.

  • Data processed: Incident records; affected data, measures adopted.

  • Legal basis: Article 6(1)(c) — legal obligation (Articles 33 and 34 of the GDPR, notification to the CNPD); Article 6(1)(f) — legitimate interests (documentation and corrective measures).

  • Retention period: During investigation and resolution; thereafter: 5 years, or a longer period if CNPD proceedings, legal proceedings or an outstanding legal obligation exist.

I — Marketing and Optional Functionalities

5.22. Marketing and commercial communications

  • Description: Send news, content or offers concerning CondoConnect’s services. An opt-out mechanism is always available.

  • Data processed: Name, email address; communication preferences; interaction history.

  • Legal basis: Article 6(1)(a) — consent (prospective customers with no prior relationship); Article 6(1)(f) — legitimate interests (existing customers, similar products — Law No. 41/2004, Article 13-A).

  • Retention period: For as long as consent or the relationship remains in effect; reviewed where there has been no interaction for 2 years.

  • Following an objection: Use for marketing ceases.

  • Suppression list: Retained for as long as necessary.

5.23. Profile photograph and optional functionalities

  • Description: Personalise the user’s profile; facilitate identification on the platform. Entirely optional and removable without affecting use of the service.

  • Data processed: Profile photograph.

  • Legal basis: Article 6(1)(a) — consent.

  • Retention period: For as long as it is retained by the user; deleted when the user removes it or deletes the account.

6. Data recipients

Personal data may be disclosed or made accessible to the following categories of recipients, to the extent strictly necessary for the stated purposes:

  • Management entities, administrators, owners and authorised users: In the context of condominium management, data is shared with users who have appropriate permissions within the platform.

  • Technology service providers: Entities providing hosting, development, email, notification, analytics and diagnostic services, acting as data processors.

  • SIBS and parties involved in payments: For processing payments via Multibanco, MB WAY and card.

  • Professional advisers, auditors and insurers: Where necessary to comply with legal obligations, conduct audits or manage risks.

  • Public authorities and courts: Where required by law, regulation, judicial or administrative decision.

  • Potential acquirers in a corporate transaction: In the event of a merger, acquisition, restructuring or sale of assets, data may be transferred with appropriate data protection safeguards.

7. International data transfers

CondoConnect prioritises the processing of personal data within the European Economic Area (EEA). The main infrastructure of the Services is hosted by DigitalOcean, in the FRA1 region, in Frankfurt, Germany (EEA).

Nevertheless, some of CondoConnect’s data processors may process or access personal data from countries outside the EEA, in particular:

  • Google Firebase and Google Analytics: Contracts are entered into with Google Ireland Limited (Dublin, Ireland — EEA), but data may be processed or accessed from countries outside the EEA, including the United States of America.

Where personal data is transferred to countries outside the EEA, CondoConnect ensures that appropriate safeguards are in place, namely:

  • Adequacy decisions of the European Commission, pursuant to Article 45 of the GDPR.

  • The EU–US Data Privacy Framework, where the recipient entity is certified.

  • Standard Contractual Clauses approved by the European Commission, pursuant to Article 46(2)(c) of the GDPR.

  • Additional technical and organisational measures, where necessary, to ensure a level of protection equivalent to that provided within the EEA.

8. Cookies and similar technologies

The Services use cookies and similar technologies for different purposes. In accordance with Article 5 of Law No. 41/2004 of 18 August, CondoConnect requests the user’s prior consent for the installation of cookies and tracking technologies that are not strictly necessary, providing clear and comprehensive information about their respective purposes.

8.1. Website (condoconnect.eu (LINK))

  • Google Analytics: Used to measure and analyse website use, subject to the user’s prior consent.

  • Strictly necessary cookies: Authentication, security and session cookies, exempt from consent requirements under the law.

  • LocalStorage: Used on the web platform for local storage of authentication data.

8.2. Mobile application (APP STORE (LINK)) - (GOOGLE PLAY STORE (LINK))

  • Firebase Analytics: Used for usage metrics, subject to consent.

  • Firebase Cloud Messaging: Used to send push notifications.

  • Firebase Crashlytics: Used to diagnose errors and failures, subject to consent.

  • MMKV: Used for local storage of session data on the device.

8.3. Preference management

The user may separately accept or refuse each category of non-essential cookies or technologies and withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Preference management is available through the consent mechanism presented when the Services are first accessed and, subsequently, through the account or browser settings.

9. Automated decision-making and profiling

CondoConnect does not make decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect data subjects, within the meaning of Article 22 of the GDPR.

Certain functionalities of the Services include automated rules of a purely operational nature, such as:

  • Sending automatic notifications based on platform events.

  • Automatically updating payment statuses.

  • Classifying incidents by type or status.

These rules do not constitute profiling or result in decisions that produce legal or similarly significant effects on data subjects. There is no automated scoring of service providers.

10. Data subject rights

Under Articles 15 to 22 of the GDPR and Law No. 58/2019, data subjects have the following rights regarding the processing of their personal data:

  • Access: The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed and, where that is the case, the right to access their personal data.

  • Rectification: The data subject has the right to obtain from the data controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

  • Erasure: The data subject has the right to obtain from the data controller the erasure of their personal data without undue delay, and the data controller has the obligation to erase personal data without undue delay.

  • Restriction of Processing: The data subject has the right to obtain restriction of processing from the data controller.

  • Portability: The data subject has the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used and machine-readable format, and the right to transmit that data to another data controller without hindrance from the data controller to whom the personal data was provided.

  • Objection: The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them.

  • Withdrawal of Consent: The data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

10.1. How to exercise your rights

Requests to exercise rights must be sent to:

  • Email: privacy@condoconnect.eu (LINK)

  • Postal address: CondoConnect – Construção, Tecnologia e Serviços, Lda., Attn: Privacy / Data Protection, Rua da Portela, n.º 15, 2230-131 Sardoal, Portugal.

The request must identify the right that the data subject wishes to exercise and the data or processing activities to which it relates. CondoConnect may request additional information to confirm the requester’s identity.

Rights may be exercised free of charge, except where requests are manifestly unfounded or excessive, in which case a reasonable fee may be charged.

10.2. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with the competent supervisory authority:

  • Portuguese National Data Protection Commission (CNPD).

  • Rua de São Bento, n.º 148, 3.º, 1200-821 Lisboa, Portugal.

  • Website: www.cnpd.pt (LINK).

11. Changes to the Privacy Policy

CondoConnect reserves the right to update or amend this Privacy Policy at any time to reflect changes in data processing practices, applicable legislation or the Services.

The latest version of the Policy will always be available on the website condoconnect.eu (LINK) and in the CondoConnect application, indicating the date of the most recent update.

Where a change is substantial, CondoConnect will inform users appropriately, namely through a notice on the platform or by email. Where a change requires new consent to be obtained, this will be requested before processing begins.