Introduction
LELLO LOCACAO E VENDAS LTDA. ("Lello Imóveis", "we", "us", or "our"), registered under CNPJ 00.100.765/0001-01 and headquartered at Avenida Paes de Barros, 960, Andar 1, Mooca, São Paulo-SP, operates the website lelloimoveis.site and the real-estate services offered through it.
We are committed to protecting the personal data of every visitor, property seeker, landlord, and business contact who interacts with us online or offline. This Privacy Policy describes, in full and transparent terms, what personal information we collect, the lawful bases on which we process it, with whom we may share it, and the rights you are entitled to exercise over your own data.
Our practices are designed to comply with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD, Law No. 13,709/2018), the European Union's General Data Protection Regulation (GDPR, Regulation 2016/679), and any other applicable privacy legislation. Where these frameworks differ, we apply whichever standard affords you the stronger protection.
By using our website or submitting your information through any of our contact forms, you acknowledge that you have read and understood this policy. If you have any questions before continuing, you are welcome to contact us at contato@lelloimoveis.site before providing any personal data.
Information We Collect
We collect personal information through several distinct channels. The nature of what we collect depends on how you interact with us.
Information you give us directly
When you fill in any form on our website — whether to enquire about a property listing, request a valuation, arrange a viewing, or contact our team — you typically provide some or all of the following:
- Full name — to address you correctly and identify your enquiry in our systems.
- Email address — our primary channel for responding to your request.
- Telephone number — for follow-up calls or WhatsApp messages, where you opt into this.
- Property preferences — type (apartment, house, commercial), neighbourhood, price range, number of bedrooms, and any specific requirements you describe in free-text fields.
- Documents for rental qualification — where you proceed to a rental application, we may request government-issued ID (CPF, RG), proof of income, or a credit reference. This data is processed separately under a dedicated rental-process data notice provided at that stage.
- Message content — any free-text you include in an enquiry or contact form, which may contain additional personal details you choose to share.
Information collected automatically
When you visit lelloimoveis.site, our web server and analytics tools automatically record certain technical data. This includes:
- Your IP address (processed in truncated or anonymised form wherever technically feasible).
- Browser type, version, and language settings.
- Operating system and device type (desktop, mobile, tablet).
- Referring URL — the page or search result that brought you to our site.
- Pages viewed, time spent on each page, and navigation path through the site.
- Date and time of each request.
- Search terms entered into our on-site property search tool.
This data is collected via cookies and similar tracking technologies. Please see Section 4 for full details.
Information from advertising platforms
If you arrive at our site through an advertisement placed on Google, a social media platform, or a property portal, that platform may share aggregated audience or attribution data with us (for example, that a click originated from a particular ad campaign). We do not receive your name or personal contact details from these platforms as a result of ad clicks alone; we only receive information you voluntarily submit after arriving on our site.
We do not collect or seek to collect special-category personal data (such as racial or ethnic origin, political opinions, health data, or biometric data) through our website. If any such information is inadvertently included in a message you send us, we will delete it and ask you to resubmit without it.
How We Use Your Information
Every use of your personal data is grounded in at least one of the lawful bases recognised by the LGPD (Art. 7) and the GDPR (Art. 6). Below we set out each purpose, the data involved, and the legal basis applied.
Responding to your property enquiry or contact-form submission
Data used: Name, email, phone, property preferences, message content.
Legal basis: Performance of a pre-contractual measure at your request (LGPD Art. 7(V); GDPR Art. 6(1)(b)).
What this means: When you ask us to show you available apartments in Mooca or to arrange a viewing, we need your contact details to fulfil that request. We cannot do this without your information.
Sending you property listings and market updates
Data used: Email address, property preferences.
Legal basis: Your explicit consent, given at the time you opt in to our mailing list (LGPD Art. 7(I); GDPR Art. 6(1)(a)).
What this means: If you tick the box to receive updates, we will email you curated listings that match your stated preferences. You can unsubscribe at any time using the link in any email we send, or by contacting us directly.
Running and improving our website
Data used: Technical and behavioural data collected via cookies and analytics.
Legal basis: Our legitimate interests in maintaining a functional, secure, and user-friendly website (LGPD Art. 7(IX); GDPR Art. 6(1)(f)), balanced against your right to privacy.
What this means: We use anonymised analytics to understand which pages are most useful, where visitors drop off, and how to improve the search experience on our site.
Advertising and remarketing
Data used: Cookie identifiers, hashed email addresses (where you have consented), behavioural data.
Legal basis: Your explicit consent via our cookie banner (LGPD Art. 7(I); GDPR Art. 6(1)(a)).
What this means: With your consent, we may use platforms such as Google Ads to show you relevant listings or reminders if you have previously visited our site. You can withdraw consent at any time through our cookie settings.
Legal compliance and fraud prevention
Data used: Any data relevant to a specific legal obligation or investigation.
Legal basis: Compliance with a legal obligation (LGPD Art. 7(II); GDPR Art. 6(1)(c)), or protection of our legitimate rights in judicial, administrative, or arbitration proceedings (LGPD Art. 7(VI); GDPR Art. 6(1)(f)).
We will never sell your personal information to third parties. We do not use your data for automated decision-making processes that produce legal or similarly significant effects on you without human review.
Cookies & Tracking Technologies
Cookies are small text files placed on your device when you visit a website. We use them — along with similar technologies such as pixel tags and local storage — to make our site function correctly, understand how visitors use it, and (with your consent) deliver targeted advertising.
When you first visit our site, a cookie-consent banner gives you a clear choice: accept all cookies, accept only essential cookies, or customise your preferences. You may change these preferences at any time by clicking the "Cookie Settings" link in the footer.
To opt out of Google Analytics tracking specifically, you may install the Google Analytics Opt-Out Browser Add-On. To manage interest-based advertising from Google, visit adssettings.google.com.
Please note that disabling non-essential cookies will not prevent you from using any core feature of our site, including browsing listings or submitting a contact enquiry.
Sharing With Third Parties
We do not sell, rent, or trade your personal information. We share it with third parties only in the specific circumstances described below, and only to the extent necessary for each purpose.
Service providers acting on our behalf
We engage carefully selected third-party companies to perform certain services. These parties process your data solely on our documented instructions and are contractually prohibited from using it for their own purposes. They include:
- Cloud hosting and infrastructure — our website and CRM data are hosted on servers located in Brazil or within the European Economic Area (EEA), with appropriate data-processing agreements in place.
- Email delivery — we use a transactional email provider to send you responses, confirmations, and (where you have consented) property newsletters.
- Analytics providers — Google LLC, operating Google Analytics 4 under a Data Processing Amendment, with IP anonymisation enabled.
- Advertising platforms — Google LLC, operating Google Ads, for conversion tracking and remarketing (consent-dependent).
- CRM and productivity software — our internal team uses a cloud-based CRM to manage property enquiries. Data stored therein is subject to the same retention and security standards as the rest of your information.
Property owners and landlords
When you express a specific interest in a listed property, we may share your name and contact details with the relevant property owner or landlord — but only to facilitate the viewing or negotiation you have requested. We will inform you before doing so.
Legal and regulatory disclosure
We may disclose your information to courts, law-enforcement agencies, regulators, or other government bodies if we are legally required to do so, or if disclosure is necessary to protect our legal rights, prevent fraud, or ensure the safety of our team or clients.
Business transfers
If Lello Imóveis undergoes a merger, acquisition, or sale of all or part of its assets, your personal data may form part of the transferred assets. We will notify you by email and/or a prominent notice on our website before your data becomes subject to a different privacy policy, and we will give you a reasonable opportunity to object or request deletion.
We do not knowingly share personal data with third parties located outside Brazil or the EEA unless those parties offer an equivalent level of data protection, backed by appropriate transfer mechanisms such as Standard Contractual Clauses (SCCs) or an adequacy decision by Brazil's Autoridade Nacional de Proteção de Dados (ANPD) or the European Commission.
Data Retention
We retain personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our standard retention periods are as follows:
- Enquiry and contact-form data — kept for up to 2 years from the date of last contact. If your enquiry leads to an active rental or purchase process, data is retained for the duration of that relationship plus 5 years, in line with Brazil's civil limitation periods.
- Email marketing consent and preferences — retained for as long as you remain subscribed, plus 3 years after unsubscription as evidence of the consent you provided.
- Analytical and behavioural data — Google Analytics data is retained for 14 months by default. Server logs are retained for up to 12 months for security and debugging purposes.
- Advertising cookies — expire within 90 days of your last interaction with an ad, as specified in Section 4.
- Rental application documents — retained for the duration of the tenancy plus 5 years following its conclusion, to comply with contractual and tax obligations under Brazilian law.
When a retention period expires, we permanently delete or irreversibly anonymise the data so that it can no longer be linked to you. If you request early deletion and no overriding legal obligation prevents it, we will act on that request within 15 business days.
Data Security
We take the security of your personal data seriously and implement a layered set of technical and organisational measures to protect it against unauthorised access, accidental loss, disclosure, alteration, or destruction.
Technical safeguards
- All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS). Our entire website is served exclusively over HTTPS.
- Contact-form submissions and CRM records are stored on servers protected by firewalls, intrusion-detection systems, and role-based access controls.
- Database access is restricted to authenticated team members on a need-to-know basis. Credentials are managed with strong password policies and two-factor authentication.
- We conduct periodic vulnerability scans and apply security patches to our infrastructure promptly.
Organisational safeguards
- Only staff members whose roles require access to personal data are permitted to view it. All such staff receive training on data-protection obligations.
- Third-party service providers are vetted for security compliance before engagement and are bound by data-processing agreements that include security obligations.
- We maintain an internal incident-response procedure. In the event of a personal-data breach that poses a risk to your rights and freedoms, we will notify the competent authority within 72 hours and will inform affected individuals without undue delay, as required by LGPD Art. 48 and GDPR Art. 33–34.
While we take every reasonable precaution, no method of electronic transmission or storage is 100% secure. We therefore encourage you to use strong, unique passwords for any accounts you hold and to contact us immediately at contato@lelloimoveis.site if you believe your interaction with us has been compromised in any way.
Your Rights
Regardless of where you are located, we recognise and honour the data-subject rights set out below. Brazilian residents may exercise these rights under the LGPD (Art. 18–22); EU/EEA residents may exercise them under the GDPR (Art. 15–22). Both frameworks grant materially similar protections.
Right of Access
You may request a complete copy of the personal data we hold about you, along with information on how it is used, where it was obtained, and with whom it has been shared.
Right to Correction
If any information we hold is inaccurate, incomplete, or out of date, you have the right to request that we correct it promptly.
Right to Deletion (Erasure)
You may ask us to delete your personal data when it is no longer necessary for the purpose for which it was collected, or when you withdraw consent and no other lawful basis applies.
Right to Object
You may object at any time to processing based on our legitimate interests, or to the use of your data for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.
Right to Portability
Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format (e.g., CSV or JSON) so you can transfer it to another provider.
Right to Restrict Processing
In certain circumstances — such as while we verify the accuracy of data you have contested — you may ask us to restrict how we use your data rather than delete it outright.
Right to Withdraw Consent
Where processing relies on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Right to Lodge a Complaint
If you believe we have handled your data unlawfully, you may lodge a complaint with Brazil's ANPD (gov.br/anpd) or the supervisory authority in your country of residence.
How to exercise your rights: Submit your request by email to contato@lelloimoveis.site with the subject line "Data Rights Request — [Your Name]". To protect your privacy, we will verify your identity before processing any request. We aim to respond within 15 business days and, where a request is complex, no later than 30 days. This service is provided to you free of charge in all but the most manifestly unfounded or excessive cases.
Children's Privacy
Our website and services are directed exclusively at adults aged 18 and over. We do not knowingly collect, store, or process the personal data of individuals under the age of 18 (or the applicable age of digital consent in your jurisdiction) through our online channels.
If you are a parent or guardian and believe that a minor has submitted personal information to us without your knowledge or consent, please contact us immediately at contato@lelloimoveis.site. Upon verification, we will promptly delete any such data from our records.
In the limited context where a rental contract involves a guarantor or co-tenant who may be under 18 (for example, a student in shared accommodation), any personal data relating to that individual is processed solely on the basis of parental consent or a legal requirement and is handled with additional care under our internal procedures.
Changes to This Policy
Privacy law and technology evolve, and so do our services. We may update this Privacy Policy from time to time to reflect changes in how we handle personal data, new legal requirements, or feedback from our users and regulators.
When we make a material change — one that meaningfully affects your rights or how we use your data — we will notify you in at least one of the following ways:
- A prominent notice on our homepage and this page for a period of at least 30 days before the change takes effect.
- An email to the address you provided, if you are on our mailing list.
- A revised "Last updated" date at the top of this document.
We encourage you to review this page periodically. Your continued use of our website and services after a notified change has taken effect will constitute your acknowledgement of the updated policy. If you do not agree with any change, you are entitled to delete your account or contact us to request deletion of your data before the change comes into effect.
For minor clarifications that do not affect your rights in any meaningful way — such as correcting a typographical error or adding explanatory detail — we will update the document without separate notification, and only the "Last updated" date will change.
Contact & Data Controller
The data controller responsible for the personal information processed through this website is:
Data Controller — Lello Imóveis
For all privacy-related enquiries, data-rights requests, or complaints, please email us using the subject line that best describes your request (e.g., "Data Access Request", "Data Deletion Request", or "Privacy Complaint"). We will acknowledge receipt within 2 business days and provide a substantive response within 15 business days.
If you are not satisfied with our response, you have the right to escalate your concern to Brazil's Autoridade Nacional de Proteção de Dados (ANPD). Details on how to contact the ANPD are available at gov.br/anpd.