Legal
Privacy notice
Last updated 1 October 2026.
Controller and privacy contact
SONHESQUEMA, LDA, NIPC 516 360 418, Rua São Francisco Sales, 16-A, 1250-231 Lisboa, Portugal, operates IMOJA and is the controller for the processing described here. To request access, correction, deletion or another privacy action, email geral@imoja.pt. You may also write to the address above, marked “Privacy”.
Data we may process
Depending on the feature and stage of the service, we may process:
- your name, email, language and information needed for your My IMOJA account;
- your password only as a secure hash, together with session and security records;
- the selected address, Google Place reference, confirmed map pin and property details;
- your chosen selling service, timing, notes, optional answer about how you found IMOJA, referral source and campaign parameters;
- buyer enquiries, viewing requests, offers and property-related messages once the relevant service begins;
- contract, ownership, identity and compliance documents only in the protected area and when needed.
Do not upload identity documents, bank details or other sensitive information through the initial public form. The first selling request contains only the details needed for IMOJA to review it.
Why we process information
Depending on the stage and purpose, processing is based on:
- steps requested before a possible contract, including reviewing a selling request or another enquiry;
- performance of an agreement if the client later appoints IMOJA;
- legal obligations applying to real-estate mediation, accounting, tax, consumer protection and anti-money-laundering controls;
- legitimate interests in securing the service, preventing abuse, attributing enquiries, keeping an auditable client record and improving operations, balanced against the individual’s rights;
- consent only where it is specifically requested for an optional purpose. Consent can be withdrawn without affecting earlier lawful processing.
Selling requests and Property Files
A selling request or enquiry may contain contact details, service interest, the selected property address or area, map reference, property characteristics, preferred selling route, timing and notes. We use these data to provide the requested review and communicate the next step. If a client later uses My IMOJA, relevant property details may also be held in a private Property File.
My IMOJA account and security
My IMOJA access uses an email address and password. Passwords are stored only as secure hashes. Sessions are limited in time and can be revoked when the user signs out or resets the password. Single-use, time-limited tokens are used to verify email addresses and recover access.
Choose a unique password, do not share it and sign out on devices you do not control. No system is infallible; IMOJA applies technical and organisational measures appropriate to the risk and reviews access.
Source and campaign information
The referring page, campaign parameters such as UTM values and an advertising click identifier may be recorded with an enquiry. They are used to understand which campaign produced the request, prevent duplicate or abusive submissions and measure service acquisition. They are not used to make an automated decision about whether IMOJA accepts a property or client.
Optional website analytics and cookie choices
IMOJA uses Google Tag Manager to operate Google Analytics and Microsoft Clarity on public website pages. Analytics helps us understand page use, service interest, broad acquisition sources, confirmed form completions and usability through interaction metrics, heatmaps and session recordings. We do not intentionally send names, email addresses, telephone numbers, property addresses or free-text messages to Google Analytics or Clarity.
Before a visitor makes a choice, Google Consent Mode sets analytics storage, advertising storage, advertising user data and advertising personalisation to denied. Tag Manager may load with those denied signals and limited cookieless technical information. Clarity also receives an explicit denied analytics signal before consent. Analytics storage is enabled only after the visitor selects “Accept”. Advertising storage and personalisation remain disabled while IMOJA is not using advertising tags.
The choice and its update time are stored on the visitor’s device. It can be changed or withdrawn at any time through the “Cookie settings” control shown on public pages. Withdrawing stops future stored analytics and optional interaction or conversion events, and removes accessible Google Analytics and Clarity cookies from the IMOJA domain. Tag Manager and Clarity may still process limited cookieless technical signals showing that analytics storage is denied. Google processes information under its own information for sites using Google services, and Microsoft under its privacy statement.
Address search, the public catalogue and Google Maps
The selling-request address step may load Google Maps Platform to offer suggestions and allow pin confirmation. The public property catalogue or property page loads Google Maps only when there is a published property area to display. Search text and map interactions needed for these features may therefore be processed by Google.
A selected address, Google place identifier and confirmed private pin may be used by IMOJA to identify and review a property. They are not automatically published in the catalogue. A public listing uses an approved location label and a shaded approximate area of 500 metres or more. Its centre is offset automatically; the exact address and private pin are never returned by the public catalogue.
Google acts under its own Google Maps End User Terms and Privacy Policy. Manual address entry remains available if the map service is not configured or cannot be used.
Property marketing and buyer activity
After the applicable service agreement and any required mediation appointment, approved property information and photographs may be supplied to the portals and marketing channels named in the signed channel plan. Potential-buyer contact details, enquiry content, viewing requests, feedback and offers may be received through those channels and recorded so IMOJA can coordinate the instruction and report relevant activity to the owner.
My IMOJA displays only information available to IMOJA through its own systems, a portal connection authorised for the property or a verified report. The public listing never exposes the seller’s private Property File.
Service emails
IMOJA may send account confirmation, access recovery, Property File creation and service updates. These operational emails are not advertising. The delivery provider receives only the information needed to deliver and secure the message.
Contracts, identity and protected documents
If a client proceeds, additional ownership, authority, identity, anti-money-laundering, agreement, signature-certificate, timestamp and delivery information may be required. Those data are collected only through the protected operational process after the applicable provider, purpose and retention information have been supplied. They are not requested through the initial public form.
Payments and billing
When a paid service is activated, the designated payment provider processes payment details under its own privacy information. IMOJA receives only the information needed to confirm and reconcile the payment, issue an invoice, process any applicable refund and comply with accounting, tax and consumer-protection obligations. This can include the amount, payment status, transaction reference and limited billing details. IMOJA does not receive or store full payment-card details.
Recipients and international transfers
Access is limited to authorised IMOJA personnel and providers needed for hosting, security, communication, address search, authorised portal publication, electronic signature and the requested service. Independent lawyers, solicitors, credit intermediaries or technical professionals receive information only when required and under their own professional role. Where a provider processes personal data outside the EEA, IMOJA uses an applicable adequacy decision, contractual clauses or another lawful transfer safeguard.
Retention
Each category is kept only for as long as needed for the purpose, follow-up, security and applicable legal periods. Accounts without an active service and inactive Property Files are reviewed for deletion or anonymisation under the retention policy. Account sessions expire automatically according to the applicable security limits and may be revoked earlier. Contract, accounting, tax, mediation and anti-money-laundering records are kept for the applicable statutory period.
AI property listing analysis
If you import a public listing link, IMOJA requests that page and its available photographs from the source websites to fill in the review form. Those websites receive requests from our servers, without your browser cookies or login details. If direct retrieval is unavailable, the public URL may be sent to OpenAI to retrieve an already indexed search copy; the current text, photographs and other form fields are not sent for this retrieval. A search copy may be incomplete or outdated and is identified in the preview, with a link to the original listing. Imported content is shown for you to check before requesting an analysis. IMOJA does not save imported links or content in its CRM, file storage or application logs.
When you request an automatic listing review, the description, optional property details and optional photographs are sent to OpenAI through its API to produce the requested suggestions. IMOJA does not save the submitted text, photographs or analysis in its CRM, file storage or application logs. The result stays in the current page until you leave or reload it. Requests disable storage of the response at the provider, but this does not mean the provider has no security or abuse-monitoring retention. Do not include identity documents, contact details or identifiable people. Security rate-limit records use a hashed IP identifier; analytics, where consented, records only language, photograph count and completion or service-link events.
AI service assistant and WhatsApp
When you send a question to the AI service assistant, your message and up to six recent messages are sent to OpenAI to answer questions about IMOJA. The assistant cannot access My IMOJA or private client records. IMOJA does not save the conversation in its CRM or application logs; it stays in the open assistant and is cleared when you close it or leave the page. Response storage is disabled in the API request; provider security and abuse-monitoring retention may still apply. Please do not enter personal details or private documents. Hashed IP rate-limit records help prevent abuse. Chat text is masked from session-recording analytics and is not sent as an analytics event.
Choosing WhatsApp opens that external service to contact the IMOJA team. The AI conversation is not copied or sent to WhatsApp. You choose whether to send a message there; WhatsApp processes information under its own privacy terms.
AI and automated decisions
AI may assist organisation, drafting and routine analysis, but IMOJA does not use the public form to make a solely automated decision with legal or similarly significant effect. A team member remains responsible for client-facing review and decisions.
Your rights
Depending on the processing, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may withdraw an optional consent at any time. Identity may need to be verified before a rights request is completed.
Send privacy and deletion requests to geral@imoja.pt. Deletion remains subject to identity verification and any records that IMOJA must retain by law.
You may also complain to Portugal’s data-protection authority, the Comissão Nacional de Proteção de Dados (CNPD). The current version and update date of this notice appear above.