This Privacy Policy and Privacy Notice (“Policy”) establishes the rules applicable to the processing of personal data carried out in connection with the BRASHOUSE platform, its website, systems, Client Area, customer service channels and related services.
BRASHOUSE recognizes the importance of privacy and personal data protection and seeks to process personal data lawfully, transparently, securely and in accordance with applicable legislation, particularly Law No. 13,709/2018 — the Brazilian General Data Protection Law (“LGPD”).
This Policy should be read together with the Terms of Service, Terms of Use and Legal Notice, Cookie Policy and, where applicable, the Client Area Terms of Use, Acceptance and Electronic Signature Terms.

1. IDENTIFICATION OF THE DATA CONTROLLER
For personal data processing carried out within the BRASHOUSE platform and in connection with real estate services provided in Brazil, the data controller is:
Controller: The Rossa Group Imóveis LTDA
Trade Name / Platform: BRASHOUSE
CNPJ: 51.770.488/0001-38
CRECI: PJ8962-J
Address: Rua dos Polvos, 61, Florianópolis/SC, Brazil
Website: brashouse.com
E-mail: info@rossa.group
Privacy / LGPD Channel: info@rossa.group

Depending on the nature of a particular processing activity, third parties involved may act as data processors, independent controllers or, where legally applicable, joint controllers, according to their respective responsibilities and decisions concerning the processing of personal data.

2. WHO THIS POLICY APPLIES TO
This Policy applies to individuals who:
• access the BRASHOUSE website;
• create or use an account in the Client Area;
• request information about properties or services;
• complete forms;
• contact BRASHOUSE by email, telephone, WhatsApp, social media or other channels;
• respond to BRASHOUSE campaigns or advertisements;
• express interest in properties;
• request viewings, proposals or assistance;
• participate in negotiations;
• enter into documents or contracts related to the services;
• represent companies, property owners, buyers, sellers, investors, developers or partners;
• maintain any other legitimate relationship with BRASHOUSE.

3. HOW DATA MAY BE COLLECTED
Personal data may be collected directly from the data subject, automatically during use of the platform or, where permitted by applicable law, through third parties.

3.1. Data Provided Directly by the Data Subject
This may occur when the user:
• creates an account;
• completes a form;
• requests contact;
• sends a message;
• requests information about a specific property;
• provides documents;
• makes or receives a proposal;
• schedules a viewing;
• participates in negotiations;
• enters into a contract;
• uses the Client Area;
• requests any other service.

3.2. Data Collected During Use of the Platform
Certain technical information may be collected automatically through logs, cookies, pixels, identifiers and similar technologies.

3.3. Data Obtained from Third Parties
Where there is an appropriate legal basis, data may also be received through:
• advertising platforms;
• search engines;
• social media;
• WhatsApp;
• real estate portals;
• CRM systems;
• commercial partners;
• property developers;
• construction companies;
• property owners;
• real estate brokers and agencies;
• companies involved in the operation;
• technology providers;
• publicly available sources.

4. CATEGORIES OF PERSONAL DATA PROCESSED
Depending on the relationship with BRASHOUSE, the following data may be processed:

4.1. Identification Data
• first and last name;
• CPF or other identification document, when necessary;
• date of birth;
• nationality;
• occupation;
• information necessary to identify or represent an individual or legal entity.

4.2. Contact Data
• email address;
• telephone number;
• WhatsApp;
• city;
• State;
• country;
• address, when necessary for the operation.

4.3. Data Related to Real Estate Interests
This may include:
• properties viewed;
• type of property sought;
• location;
• price range;
• desired characteristics;
• intention to purchase, sell, lease or carry out another transaction;
• browsing and inquiry history;
• viewings;
• proposals;
• communications related to negotiations.

4.4. Data Necessary for Contracting and Operations
Where actually necessary, the following may be processed:
• personal documents;
• registration information;
• information relating to representation;
• contractual information;
• information necessary for fraud prevention;
• information required by law;
• information necessary to carry out the requested real estate transaction.

4.5. Technical and Browsing Data
The following may be recorded:
• IP address;
• session identifiers;
• browser;
• operating system;
• device type;
• date and time of access;
• pages visited;
• access source;
• actions performed on the platform;
• cookies;
• identifiers and similar technologies.

4.6. Client Area Data
The following may be processed:
• login credentials;
• user identifier;
• access history;
• documents viewed;
• expressions of interest;
• requests;
• proposals;
• authentications;
• acceptances;
• communication history;
• transactions performed.

4.7. Data Related to Acceptance and Electronic Signature
Where applicable, the following may be recorded:
• user identification;
• document presented;
• document version;
• date and time;
• IP address;
• device;
• authentication method;
• confirmation codes;
• technical records;
• transaction identifier;
• electronic evidence;
• expression of intent;
• other information necessary for the security and verification of the transaction.

5. SENSITIVE PERSONAL DATA
BRASHOUSE does not seek to collect sensitive personal data where such data is not necessary for the provision of services.
If the processing of sensitive personal data is actually necessary in a particular situation, it will be carried out in accordance with the circumstances authorized by applicable law and limited to what is necessary for the relevant purpose.

6. PURPOSES OF PROCESSING
Personal data may be used to:
• identify users;
• authenticate access;
• create and manage accounts;
• respond to requests;
• provide customer service;
• understand real estate needs and preferences;
• present properties and opportunities;
• organize viewings;
• prepare and forward proposals;
• facilitate communication between participants in a particular transaction;
• monitor negotiations;
• prepare and manage documents;
• formalize contractual relationships;
• record expressions of intent;
• process acceptances and electronic signatures;
• maintain customer service and transaction histories;
• comply with legal and regulatory obligations;
• exercise legal rights;
• prevent fraud and abuse;
• protect users and the platform;
• conduct audits;
• resolve technical issues;
• analyze use of the platform;
• measure advertising campaigns;
• improve services and functionality;
• communicate in connection with services;
• carry out marketing where there is an applicable legal basis.

7. LEGAL BASES
Depending on the purpose and circumstances, processing may be carried out on the basis of the legal grounds provided under the LGPD, including:
• consent of the data subject;
• compliance with a legal or regulatory obligation;
• performance of a contract;
• preliminary procedures related to a contract;
• exercise of legal rights;
• legitimate interest;
• credit protection, where applicable;
• other legally permitted grounds.
Mere use of the website does not mean that all processing activities are based on consent.
Where consent is legally required, it will be requested in an appropriate and specific manner.

8. MARKETING AND COMMUNICATIONS
BRASHOUSE may send communications relating to:
• properties;
• services;
• requests submitted by the user;
• real estate opportunities;
• news and updates;
• commercial relationships.
Promotional communications will be sent where there is an applicable legal basis.
Where applicable, users may request that promotional communications be discontinued.
Opting out of marketing communications does not prevent the sending of messages necessary for account functionality, security, customer service, contracts or transactions requested by the user.

9. PROFILING, PERSONALIZATION AND ADVERTISING
BRASHOUSE may analyze information relating to user interactions in order to understand preferences and present content, properties or services that may be relevant.
Advertising and analytics technologies may be used for:
• campaign measurement;
• conversion analysis;
• audience creation;
• remarketing;
• personalization;
• advertising frequency management;
• analysis of platform performance.
Where required by law, such technologies will be used in accordance with the choices made by the user.
Further information is available in the Cookie Policy.

10. AUTOMATED PROCESSING
BRASHOUSE may use automated tools to assist with activities such as:
• organization and classification of leads;
• property recommendations;
• identification of interests;
• fraud prevention;
• security;
• operational efficiency;
• customer service.
The use of automated systems does not necessarily mean that decisions capable of producing relevant legal effects are made exclusively by algorithms.
Where applicable, the rights provided under the LGPD in relation to decisions based solely on automated processing will be observed.

11. DATA SHARING
Where necessary and legally permitted, personal data may be shared with:
• property owners;
• buyers;
• sellers;
• landlords;
• tenants;
• developers;
• construction companies;
• brokers;
• real estate agencies;
• commercial partners;
• companies involved in providing the services;
• property managers;
• technology providers;
• hosting and cloud computing companies;
• CRM systems;
• email providers;
• communication platforms;
• customer service tools;
• authentication providers;
• electronic signature companies;
• information security providers;
• consultants;
• lawyers;
• accountants;
• auditors;
• financial institutions and payment providers, where necessary;
• notary offices, registries and other parties necessary for the transaction, where applicable;
• public, administrative, judicial or regulatory authorities.
Sharing will, whenever possible, be limited to the information necessary for the corresponding purpose.
BRASHOUSE does not sell personal data databases as an independent product.

12. THIRD-PARTY SERVICES AND PLATFORMS
BRASHOUSE may use or integrate third-party services, including, depending on the configuration actually used:
• Google;
• Google Analytics;
• Google Ads;
• Meta;
• Facebook;
• Instagram;
• WhatsApp;
• CRM systems;
• cloud computing tools;
• email providers;
• analytics tools;
• security services;
• electronic signature platforms.
Some of these third parties may process data according to their own policies and may act as independent controllers under certain circumstances.
BRASHOUSE does not control independent processing activities carried out by third parties.

13. INTERNATIONAL DATA TRANSFERS
Due to the use of international technological infrastructure and the possible involvement of international partners in certain transactions, personal data may be stored, processed or accessed outside Brazil.
Depending on the transaction and the providers actually used, this may involve, among others, the United States of America, the United Arab Emirates, Oman and countries in the European Economic Area.
The existence of an international network of BRASHOUSE partners does not mean that personal data is automatically transferred to every country in which partners are located.
Any transfer will be limited to the actual needs of the relevant transaction or service used.
International transfers of personal data will comply with the conditions established by the LGPD and applicable regulations issued by the Brazilian Data Protection Authority — ANPD.
Where necessary, legally recognized mechanisms may be used, such as:
• adequacy decisions;
• standard contractual clauses;
• specific contractual clauses;
• global corporate rules;
• other mechanisms permitted by applicable legislation and regulations.
Transfers may occur for purposes such as:
• hosting;
• storage;
• security;
• communications;
• CRM;
• analytics;
• customer service;
• customer management;
• electronic signature;
• technological support;
• integration with partners;
• performance of international transactions requested by the user.
The data subject may request additional information regarding international transfers through the Privacy/LGPD channel.

14. DATA RETENTION AND DELETION
Personal data will be retained for the period necessary to:
• fulfill the purposes for which it was collected;
• perform contracts;
• manage the relationship;
• comply with legal and regulatory obligations;
• preserve records;
• prevent fraud;
• protect the platform;
• exercise legal rights;
• comply with requirements from competent authorities.
Data relating to potential clients may be retained while there is a legitimate and compatible purpose for its use, subject to periodic review.
Data related to contracts and transactions may be retained throughout the contractual relationship and subsequently for the periods necessary to comply with obligations and exercise rights.
Security records and electronic evidence may be retained for the period necessary for fraud prevention, security, verification of transactions and exercise of legal rights.
Where consent is the sole applicable legal basis, withdrawal of consent may result in the termination of the relevant processing, subject to legally permitted retention requirements.
After the applicable retention period has ended, data may be deleted or anonymized, unless its retention is authorized or required by law.

15. INFORMATION SECURITY
BRASHOUSE adopts technical, administrative and organizational measures that are reasonable and proportionate to the risks involved in processing.
Such measures may include:
• access controls;
• credential management;
• authentication;
• activity logs;
• privilege limitation;
• infrastructure protection;
• backups;
• security monitoring;
• mechanisms to prevent and detect suspicious activity;
• internal security procedures.
However, no electronic system or transmission over the Internet can guarantee absolute security.

16. SECURITY INCIDENTS
If a security incident involving personal data occurs and may result in relevant risk or harm to data subjects, BRASHOUSE will take the measures required by applicable law and regulations, including, where applicable, notification to the ANPD and affected data subjects.

17. DATA SUBJECT RIGHTS
Under applicable law, data subjects may request, where applicable:
• confirmation of the existence of processing;
• access to data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• data portability, subject to applicable rules;
• deletion of data processed on the basis of consent, subject to legally permitted retention;
• information about public and private entities with which data has been shared;
• information regarding the possibility of refusing consent and the consequences thereof;
• withdrawal of consent;
• objection to processing, where applicable;
• exercise of rights relating to automated decisions, where applicable;
• submission of a complaint or petition to the competent authority, subject to applicable procedures.
These rights may be subject to limitations established by law.
For example, a request for deletion does not require BRASHOUSE to delete data whose retention is necessary or permitted for compliance with a legal obligation, exercise of legal rights or another purpose authorized by law.

18. HOW TO EXERCISE YOUR RIGHTS
Requests relating to privacy and data protection may be sent to:
Privacy / LGPD: info@rossa.group
BRASHOUSE may request additional information reasonably necessary to verify the identity of the requester and prevent unauthorized access to third-party data.

19. COOKIES
The platform may use cookies and similar technologies for:
• technical operation;
• security;
• authentication;
• session maintenance;
• preferences;
• statistics;
• analytics;
• advertising.
Detailed information about the use of these technologies is available in the BRASHOUSE Cookie Policy.
Where necessary, users may manage their preferences through the tool made available by the platform.

20. CHILDREN AND ADOLESCENTS
BRASHOUSE services are not specifically directed at children.
If it becomes necessary to process personal data relating to children or adolescents in the context of a particular transaction, the specific provisions of applicable law and the best interests of the child or adolescent will be observed.

21. LINKS AND EXTERNAL SERVICES
The platform may contain links to or integrations with websites and services operated by third parties.
BRASHOUSE does not necessarily control the privacy practices of independent third parties.
Users are advised to review the applicable terms and privacy policies before providing information directly to third parties.

22. USER RESPONSIBILITIES
Users should:
• provide truthful and up-to-date information;
• protect their credentials;
• not share passwords or authentication codes;
• use reasonably secure devices;
• immediately report suspected unauthorized access to their account.

23. CHANGES TO THIS POLICY
This Policy may be updated to reflect changes in:
• legislation;
• regulations;
• technology;
• business practices;
• operations;
• services offered.
The current version will be made available on the platform together with the applicable update date.
Where an amendment is materially relevant, BRASHOUSE may use additional means to inform data subjects or request a new manifestation of consent where required by law.

24. APPLICABLE LAW
The processing of personal data subject to Brazilian law will comply with Law No. 13,709/2018 — the Brazilian General Data Protection Law, as amended, and the regulations issued by the Brazilian Data Protection Authority — ANPD.

25. CONTACT
BRASHOUSE
Operated in Brazil by: The Rossa Group Imóveis LTDA
CNPJ: 51.770.488/0001-38
CRECI: PJ8962-J
Address: Rua dos Polvos, 61, Florianópolis/SC, Brazil
Website: brashouse.com
E-mail: info@rossa.group
Privacy / LGPD: info@rossa.group

By using the platform, the user acknowledges having had access to this Policy.
Where a particular processing activity legally requires consent, such consent will be requested specifically and will not be presumed solely from use of the website.