Privacy · 23 September 2026
Your data, explained clearly.
This notice explains the information needed for your account, request, quote and project updates, and how to exercise your rights.
1. Who is responsible?
The controller is NIVELINVISÍVEL REMODELAÇÕES E DESIGN DE INTERIORES LDA, tax number (NIF) 519310039, registered at Av. 25 de Abril no. 5 B, 2855-725 Corroios, Portugal. REVA is the brand used on this site. Real estate licence AMI 27152.
For privacy questions or to exercise your rights, email ola@reva.pt · +351 911 831 870.
2. What data do we process and why?
| Purpose | Data | Legal basis |
|---|---|---|
| Create and protect the account | First and last name, email, telephone, password hash, creation date, email verification, session and login attempts. | Pre-contractual steps requested by you (GDPR Art. 6(1)(b)); legitimate interest in service security (Art. 6(1)(f)). |
| Respond to your request | Location, type of property and project, goal, intended budget, timing, messages, and documents or images you choose to attach. | Pre-contractual steps requested by you (Art. 6(1)(b)). |
| Prepare and present quotes | Categories, work items, quantities, prices, terms, versions, status, notes and your response to the quote. | Pre-contractual steps and, if there is a contract, its performance (Art. 6(1)(b)). |
| Track the works | Phases, completion percentages, notes and work photographs. Photographs are converted to JPEG and original metadata is removed. | Performance of the contract (Art. 6(1)(b)). |
| Send access links | Email address and temporary links to confirm the account or reset the password. | Providing and securing the requested service (Art. 6(1)(b) and (f)). |
You can complete the questionnaire without an account. When you choose “Send request”, the draft stays in this tab's session storage until you create an account or sign in. The team receives the request only when you confirm its submission in your account. First name, last name, email, telephone and password are needed to create an account. You may also contact us by telephone or WhatsApp without an account.
We do not request health information, identity documents or other special-category data. Please do not include such information in messages or attachments. Share only project-related documents that you are entitled to provide.
We do not use account data for personalised advertising, selling contact details or marketing campaigns.
3. Who can access the data and where is it stored?
Signed-in clients can see only their own requests, quotes, messages, documents and works. Only authorised REVA team members can manage these matters. The database and private files are stored on an OVHcloud VPS in France, outside the site's public directory. OVHcloud provides the hosting and email service used for account links. Access is protected by HTTPS and server-side identity checks.
We have not installed audience analytics, advertising, SMS or external storage services for client-area data. If you choose to open WhatsApp, you will access an external service; any message you send is handled under that service's rules.
4. How long is it kept?
Requests without a contract: the prospective client's account, messages, requests, unaccepted quotes and attachments are kept for no longer than 12 months after the last communication with REVA. The team regularly reviews these cases and deletes those reaching that limit, unless a specific legal obligation or dispute justifies a different period.
Contracted projects: data needed to perform the works is kept during the contractual relationship. Documents subject to legal duties, particularly accounting rules, or needed to defend rights follow the applicable statutory periods. REVA reviews these cases separately; the rule for requests without a contract does not apply to them.
An unsent draft disappears when the tab is closed or after submission. The session cookie expires after 14 days or is removed when you sign out. Verification links expire after 24 hours and recovery links after one hour. Login-attempt records have a 15-minute operational window; expired records are cleared on later access.
Local backups are retained for up to 14 days. OVHcloud's backup service keeps rotating VPS recovery points. After deletion from the active database, data still in a backup cannot be accessed through the site and disappears as that backup rotates out.
5. What are your rights?
You may request access, correction, deletion, restriction of processing, objection where applicable, and data portability when its conditions are met. We may need to verify your identity and explain any legal duties preventing immediate deletion.
Send your request to ola@reva.pt. We will respond without undue delay, normally within one month. You may lodge a complaint with the Portuguese Data Protection Authority (CNPD). CNPD ↗
7. Security and automated decisions
Passwords are stored as salted hashes, never as plain text. Sessions use random identifiers and cookies inaccessible to scripts. Documents and photographs are served only after access checks. Backups are checked periodically.
The questionnaire organises information and provides a qualitative indication. It does not make decisions with legal effects, approve requests, calculate prices or value properties. Every proposal requires human review by REVA.
8. Changes to this notice
We will update this page whenever purposes, providers or retention rules change, before starting new processing.
Back to account creation ↗