This website is operated by Biscaia Premium Advisory Services, Lda, with company number (NIPC) 517 642 581, and registered office at Avenida José dos Santos Farias, n.º 137, Loja A, 8135-167 Almancil, hereinafter referred to as “the Office” or “Biscaia & Co”, which acts as the controller of the personal data collected and processed through the website www.biscaia.co (the “Website”).
The Office may be contacted on data protection matters through the following details:
– Address: Avenida José dos Santos Farias, n.º 137, Loja A, 8135-167 Almancil
– E-mail: hello@biscaia.co
– Telephone: [+351 telephone]
The processing of personal data through the Website is carried out in accordance with:
– Regulation (EU) 2016/679 (GDPR) — the General Data Protection Regulation;
– Law No. 58/2019, of 8 August, which ensures the implementation of the GDPR in the Portuguese legal order;
– Law No. 41/2004, of 18 August, as amended by Law No. 46/2012, concerning the processing of personal data and the protection of privacy in the electronic communications sector (including rules on cookies).
In the context of the use of the Website, the Office may process the following categories of personal data:
a. Browsing and Website usage data
Data processed: IP address, device identifiers, date and time of access, pages visited, browser and operating system, performance and error data, and information resulting from strictly necessary cookies.
Purposes:
– To ensure the functioning, security and technical integrity of the Website;
– To produce aggregated and anonymous statistics on usage;
– To prevent fraud and misuse of the Website.
Legal basis:
– The legitimate interest of the Office in ensuring the safe and efficient functioning of the Website, pursuant to Article 6(1)(f) of the GDPR, balanced against the rights of data subjects.
b. Contact form and direct enquiries
Data processed: name, e-mail, telephone (optional) and the content of the message you send us through the contact form or by e-mail.
Purposes:
– To respond to your enquiry and to begin and conduct the conversation you have requested;
– To keep a record of our correspondence with you.
Legal basis:
– Steps taken at your request prior to entering into a relationship, and the legitimate interest of the Office in responding to enquiries (Article 6(1)(b) and (f) of the GDPR).
c. Newsletter, invitations to events and private communications
Data processed: name, e-mail, organisation or area of interest (optional), your communication preferences, and the history of your interactions with the communications we send.
Purposes:
– Sending a periodic editorial letter on life, culture, the property market and events in the Algarve and the Golden Triangle;
– Sending invitations, by invitation only, to vernissages, private viewings and other occasions held at the Private Office;
– Managing the list of recipients and their preferences.
Legal basis:
– Your consent for the sending of these electronic communications (Article 6(1)(a) of the GDPR and Article 13 of Law 41/2004). In relation to existing clients, the opt-out regime under Law 41/2004 may apply, provided that the communications relate to similar services and the right to object is ensured in each communication.
What are cookies?
Cookies are small text files placed on the user’s device, through the browser, when visiting the Website. They allow, among other things, improving browsing efficiency, saving preferences, and obtaining aggregated statistical information on usage.
Legal framework for cookies
The storage of cookies and access to information stored on the user’s device are subject to Article 5 of Law 41/2004 (as amended by Law 46/2012), which requires prior information and consent, except for cookies strictly necessary for the provision of a service expressly requested by the user.
Types of cookies used on the Website
– Strictly necessary cookies — to ensure the proper functioning of the Website, its security, session management and access to restricted areas. Legal basis: the legitimate interest of the Office in providing a functional and secure service; consent is not required under Law 41/2004 for these cookies.
– Preference (functional) cookies — to save user choices, such as language. Legal basis: user consent, when not strictly necessary.
– Analytical / statistical cookies — to obtain aggregated statistics on Website usage, in order to improve content and services. Legal basis: user consent.
– Marketing or third-party cookies — to enable third-party functionalities (for example, embedded social media content or maps). Legal basis: user consent. These are not strictly necessary and are activated only after explicit acceptance.
How can you manage cookies?
On the first visit to the Website, a cookie banner is displayed allowing you to accept all non-strictly-necessary cookies, reject them, or configure, on a granular basis, the categories you wish to accept. You may change your preferences at any time. Most browsers also allow you to control the acceptance, rejection or deletion of cookies through their settings. Disabling strictly necessary cookies may affect the proper functioning of the Website.
Personal data collected through the Website may be disclosed to the following categories of recipients, strictly to the extent necessary:
– IT and hosting service providers that support the functioning of the Website and electronic communications (for example, hosting, maintenance, security), acting as processors and bound by a written contract in accordance with Article 28 of the GDPR.
The Office does not disclose data to third parties for those third parties’ own marketing purposes.
Personal data are retained only for the period strictly necessary for the purposes for which they are processed, namely:
– Browsing data: retained for the period necessary to ensure the security and integrity of the Website and for aggregated statistics, and subsequently anonymised or deleted.
– Contact data: retained for the period necessary to handle your enquiry and any resulting relationship.
– Newsletter and invitation data: retained until you withdraw consent or exercise the right to object, without prejudice to longer periods where another legal basis applies.
Upon expiry of these periods, data are deleted or anonymised, unless additional retention is legally required.
Under the GDPR, you have the following rights in relation to your personal data:
– Access — to obtain confirmation as to whether your data are being processed and, if so, to access them and related information.
– Rectification — to correct inaccurate data and complete incomplete data.
– Erasure — to request the deletion of data under the conditions of Article 17 of the GDPR.
– Restriction — in the situations provided for in Article 18 of the GDPR.
– Objection — to object, at any time, to processing based on legitimate interest, on grounds relating to your particular situation.
– Portability — to receive the data you have provided in a structured, commonly used and machine-readable format, and to transmit them to another controller, where applicable.
– Withdrawal of consent — where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise any of these rights, please contact the Office using the details in section 1. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the competent supervisory authority in Portugal (www.cnpd.pt).
The Office adopts appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of data subjects. Such measures may include logical and physical access controls, encryption of communications and data at rest where appropriate, logging of relevant security events, and internal procedures for managing security incidents and personal data breaches.
This Privacy and Cookies Policy may be updated to reflect legislative changes or changes in the processing of personal data carried out by the Office. Changes are published on the Website with an indication of the date of the last update. Where changes are substantial, new consent may be requested where consent is the applicable legal basis.
Date of last update: 16 June 2026
This website is operated by Biscaia Premium Advisory Services, Lda, with company number (NIPC) 517 642 581, and registered office at Avenida José dos Santos Farias, n.º 137, Loja A, 8135-167 Almancil, hereinafter referred to as “the Office” or “Biscaia & Co”, which acts as the controller of the personal data collected and processed through the website www.biscaia.co (the “Website”).
The Office may be contacted on data protection matters through the following details:
– Address: Avenida José dos Santos Farias, n.º 137, Loja A, 8135-167 Almancil
– E-mail: hello@biscaia.co
– Telephone: [+351 telephone]
The processing of personal data through the Website is carried out in accordance with:
– Regulation (EU) 2016/679 (GDPR) — the General Data Protection Regulation;
– Law No. 58/2019, of 8 August, which ensures the implementation of the GDPR in the Portuguese legal order;
– Law No. 41/2004, of 18 August, as amended by Law No. 46/2012, concerning the processing of personal data and the protection of privacy in the electronic communications sector (including rules on cookies).
In the context of the use of the Website, the Office may process the following categories of personal data:
a. Browsing and Website usage data
Data processed: IP address, device identifiers, date and time of access, pages visited, browser and operating system, performance and error data, and information resulting from strictly necessary cookies.
Purposes:
– To ensure the functioning, security and technical integrity of the Website;
– To produce aggregated and anonymous statistics on usage;
– To prevent fraud and misuse of the Website.
Legal basis:
– The legitimate interest of the Office in ensuring the safe and efficient functioning of the Website, pursuant to Article 6(1)(f) of the GDPR, balanced against the rights of data subjects.
b. Contact form and direct enquiries
Data processed: name, e-mail, telephone (optional) and the content of the message you send us through the contact form or by e-mail.
Purposes:
– To respond to your enquiry and to begin and conduct the conversation you have requested;
– To keep a record of our correspondence with you.
Legal basis:
– Steps taken at your request prior to entering into a relationship, and the legitimate interest of the Office in responding to enquiries (Article 6(1)(b) and (f) of the GDPR).
c. Newsletter, invitations to events and private communications
Data processed: name, e-mail, organisation or area of interest (optional), your communication preferences, and the history of your interactions with the communications we send.
Purposes:
– Sending a periodic editorial letter on life, culture, the property market and events in the Algarve and the Golden Triangle;
– Sending invitations, by invitation only, to vernissages, private viewings and other occasions held at the Private Office;
– Managing the list of recipients and their preferences.
Legal basis:
– Your consent for the sending of these electronic communications (Article 6(1)(a) of the GDPR and Article 13 of Law 41/2004). In relation to existing clients, the opt-out regime under Law 41/2004 may apply, provided that the communications relate to similar services and the right to object is ensured in each communication.
What are cookies?
Cookies are small text files placed on the user’s device, through the browser, when visiting the Website. They allow, among other things, improving browsing efficiency, saving preferences, and obtaining aggregated statistical information on usage.
Legal framework for cookies
The storage of cookies and access to information stored on the user’s device are subject to Article 5 of Law 41/2004 (as amended by Law 46/2012), which requires prior information and consent, except for cookies strictly necessary for the provision of a service expressly requested by the user.
Types of cookies used on the Website
– Strictly necessary cookies — to ensure the proper functioning of the Website, its security, session management and access to restricted areas. Legal basis: the legitimate interest of the Office in providing a functional and secure service; consent is not required under Law 41/2004 for these cookies.
– Preference (functional) cookies — to save user choices, such as language. Legal basis: user consent, when not strictly necessary.
– Analytical / statistical cookies — to obtain aggregated statistics on Website usage, in order to improve content and services. Legal basis: user consent.
– Marketing or third-party cookies — to enable third-party functionalities (for example, embedded social media content or maps). Legal basis: user consent. These are not strictly necessary and are activated only after explicit acceptance.
How can you manage cookies?
On the first visit to the Website, a cookie banner is displayed allowing you to accept all non-strictly-necessary cookies, reject them, or configure, on a granular basis, the categories you wish to accept. You may change your preferences at any time. Most browsers also allow you to control the acceptance, rejection or deletion of cookies through their settings. Disabling strictly necessary cookies may affect the proper functioning of the Website.
Personal data collected through the Website may be disclosed to the following categories of recipients, strictly to the extent necessary:
– IT and hosting service providers that support the functioning of the Website and electronic communications (for example, hosting, maintenance, security), acting as processors and bound by a written contract in accordance with Article 28 of the GDPR.
The Office does not disclose data to third parties for those third parties’ own marketing purposes.
Personal data are retained only for the period strictly necessary for the purposes for which they are processed, namely:
– Browsing data: retained for the period necessary to ensure the security and integrity of the Website and for aggregated statistics, and subsequently anonymised or deleted.
– Contact data: retained for the period necessary to handle your enquiry and any resulting relationship.
– Newsletter and invitation data: retained until you withdraw consent or exercise the right to object, without prejudice to longer periods where another legal basis applies.
Upon expiry of these periods, data are deleted or anonymised, unless additional retention is legally required.
Under the GDPR, you have the following rights in relation to your personal data:
– Access — to obtain confirmation as to whether your data are being processed and, if so, to access them and related information.
– Rectification — to correct inaccurate data and complete incomplete data.
– Erasure — to request the deletion of data under the conditions of Article 17 of the GDPR.
– Restriction — in the situations provided for in Article 18 of the GDPR.
– Objection — to object, at any time, to processing based on legitimate interest, on grounds relating to your particular situation.
– Portability — to receive the data you have provided in a structured, commonly used and machine-readable format, and to transmit them to another controller, where applicable.
– Withdrawal of consent — where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise any of these rights, please contact the Office using the details in section 1. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the competent supervisory authority in Portugal (www.cnpd.pt).
The Office adopts appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of data subjects. Such measures may include logical and physical access controls, encryption of communications and data at rest where appropriate, logging of relevant security events, and internal procedures for managing security incidents and personal data breaches.
This Privacy and Cookies Policy may be updated to reflect legislative changes or changes in the processing of personal data carried out by the Office. Changes are published on the Website with an indication of the date of the last update. Where changes are substantial, new consent may be requested where consent is the applicable legal basis.
Date of last update: 16 June 2026
2026 © Biscaia & Co
2026 © Biscaia & Co