Pronto Portal Privacy Policy

This Policy explains what personal data we process when you use the Platform and your Account on Pronto Portal (portal.prontosolucoes.pt), for what purposes and on what bases, who we share it with, how long we keep it and how you can exercise your rights. Part I corresponds to the Platform's Privacy & Cookies Policy and Part II describes the processing that is specific to the Account.

Part I — Privacy & Cookies Policy

1) Controller & contact

Controller: SUKARIME KALIKIO, UNIPESSOAL, LDA (hereinafter “Pronto”, “we”) — privacy@prontosolucoes.pt
Address: Rua Oliveira Monteiro 722 3, Direito, Porto

For the purposes of the GDPR, we act as the controller in relation to the processing described in this Policy, unless expressly stated otherwise. For general contact: info@prontosolucoes.pt.

1.1 Data protection officer. Pronto has not appointed a data protection officer, as it is not subject to the obligation in Article 37 of the GDPR. The address privacy@prontosolucoes.pt is the point of contact for any request or question about the processing of your data.

1.2 Scope. This Policy applies to the processing of personal data of those who use the Platform, including those who open an Account on Pronto Portal, and of those whose data is processed through it, such as the on-site contact of a property. When a Technician receives your data, section 4 applies.

2) Data we collect

We collect and process personal data in accordance with the principles of minimisation (only what is necessary) and purpose limitation.

Provided by you: name, telephone, email, area/address, description of the problem, preferred time, photos/videos; for technicians: business data, tax ID, IBAN, MB WAY number.
Automatic: IP, device, browser, pages viewed, timestamps, technical and security logs, and interaction events (e.g., clicks on “Call”/WhatsApp/forms), where applicable.
Third parties: advertising/directory platforms; payment metadata (status/reference) when we provide payments; call records and, if enabled and duly informed, recordings and their metadata.

Whenever you send us photographs, videos or descriptions, you should avoid including excessive or sensitive data that is not necessary for the triage of the request.

2.1 Categories of data subjects. The data described relates to three categories of people: (a) Clients, including Account holders; (b) the people whom the Client names, such as owners, tenants and on-site contacts; and (c) people who use a Reporting Link. The data specific to the Account is described in Part II.

2.2 Mandatory nature. The collection of the data needed to create and maintain the Account and to process a Request is necessary for the conclusion and performance of the contract. Without that data the Account cannot be created or the Request processed. All other data is optional.

3) Purposes & legal bases

We process personal data for the following purposes, on the corresponding legal bases (Art. 6 GDPR), as applicable:

Providing services and introductions (Art. 6(1)(b) GDPR – performance of a contract and pre-contractual steps).
Communications & support (contract and/or Art. 6(1)(f) – legitimate interest, in particular operational coordination, request management, quality and continuity of service).
Onboarding, management and invoicing of partners/technicians (contract and/or Art. 6(1)(c) – legal obligation, including tax/accounting obligations).
Analytics & marketing (consent where required, and/or legitimate interest, depending on the type of technology and context; you may withdraw consent at any time).
Security, fraud prevention, audit and legal compliance (legal obligation and/or legitimate interest, including defence of rights and management of disputes).

When we process data on the basis of legitimate interest, we carry out a balancing of our interests against your rights and freedoms, and implement measures to reduce the impact (e.g., minimisation, access control).

3.1 Purposes on the Portal. In connection with the Account, we process personal data specifically to: (a) create and manage the Account and verify the email address; (b) authenticate the holder and maintain the session; (c) receive, route and follow Requests and visits; (d) show quotes, receipts and other documents; (e) communicate with the holder about the Service; (f) provide customer support; (g) secure the Account and prevent abuse; and (h) record the version of the Terms of Use that was accepted and the date and time of acceptance.

3.2 Legal bases on the Portal. Purposes (a) to (f) are based on the performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) and, as regards communications and support, also on legitimate interest (Art. 6(1)(f)). Purpose (g) is based on the legitimate interest of Pronto and of holders in protecting Accounts (Art. 6(1)(f)). Purpose (h) is based on Pronto's legitimate interest in proving acceptance of the Terms and, where applicable, on compliance with legal obligations (Art. 6(1)(f) and (c)).

3.3 Right to object to marketing. Where the purpose of the processing is direct marketing, you have the right to object at any time, without having to give reasons, and we stop processing the data for that purpose.

4) Sharing of data

We share data only to the extent necessary, on an appropriate legal basis and with protection measures.

Technicians: to fulfil your request (contacts, description, relevant media).
Processors: hosting/backups, email/SMS/WhatsApp, forms & CRM (e.g., WPForms, Jetpack CRM), analytics (GA4), marketing (Google Ads), call tracking/routing, automation (Zapier/Make), payments (Mollie).
Authorities: where required by law, court order, or to protect rights, safety and the integrity of the Platform.

Important: after sharing with the Technician, the Technician acts as an independent controller for the subsequent processing, within the scope of its direct relationship with the client (e.g., quotes, performance of the work, invoicing, guarantees and complaint management). Pronto does not control the means and purposes of that subsequent processing by the Technician.

4.1 Processors for the Portal. To operate the Portal, Pronto uses providers that process data on its behalf and on its instructions, including: hosting and databases (for example Render and Neon); file storage, such as photographs (for example Backblaze); telephone, WhatsApp and SMS communications (for example Vonage) and email; and payments (Mollie). With each processor Pronto concludes, where required, a contract in accordance with Article 28 of the GDPR.

4.2 Data shared with the Technician. The Technician assigned to a Request receives the data needed to contact the Client and carry out the work, such as the name, telephone number, address, the description of the problem, photographs and, where necessary for the visit, the Access Instructions.

5) International transfers

Where applicable, we rely on recognised legal mechanisms, including EU adequacy decisions, Standard Contractual Clauses (SCCs) and appropriate additional safeguards (e.g., technical and organisational measures, encryption where applicable and access limitations).

5.1 The providers referred to in section 4.1 may process data outside the European Economic Area. In those cases, the transfer takes place only under one of the mechanisms described above, and you may ask us for information on the safeguards applied at privacy@prontosolucoes.pt.

6) Data retention

We keep data only for as long as is necessary for the purposes described, respecting the principles of storage limitation and minimisation.

Leads & jobs: normally 24 months after the last activity (or longer where required by law, by tax/accounting obligations, fraud prevention, audit or defence of rights in the event of a dispute).
Call recordings (if enabled): normally 12 months, unless longer retention is needed for a dispute/defence of rights or a legal obligation.
Partner & invoicing records: up to 10 years (tax/accounting obligations and archiving requirements).

We may keep data in anonymised (non-identifiable) form for longer periods for statistical purposes and service improvement.

6.1 Account data. Account, Property and Request data is kept while the Account exists and, as a rule, for 24 months after the last activity, or for the longer period that applies under this section. Payment and invoicing documents and records are kept for the period that tax and commercial law require, up to 10 years. Security and audit records are kept for as long as necessary to protect the Platform and for the establishment, exercise or defence of legal claims.

6.2 Closure of the Account. If you ask for the Account to be closed, we stop using it and delete or anonymise the data at the end of the applicable periods, unless the law requires it to be kept.

7) Your rights (GDPR)

You have the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent (where applicable). To exercise your rights: privacy@prontosolucoes.pt.

We may request reasonable information to verify your identity before replying to your request, in order to protect data and prevent improper disclosure. You also have the right to complain to the CNPD.

7.1 Content of each right. (a) Access (Art. 15): to obtain confirmation that we process your data, a copy of it and information about the processing. (b) Rectification (Art. 16): to have inaccurate data corrected and incomplete data completed. (c) Erasure (Art. 17): to obtain deletion of the data in the cases provided for by law, for example where it is no longer necessary. (d) Restriction (Art. 18): to ask for processing to be restricted in the cases provided for by law. (e) Portability (Art. 20): to receive the data you provided to us in a structured, commonly used format and to transmit it to another controller. (f) Objection (Art. 21): to object, on grounds relating to your particular situation, to processing based on legitimate interest. (g) Withdrawal of consent (Art. 7(3)): to withdraw consent at any time, without affecting the lawfulness of the earlier processing.

7.2 Time to respond. We reply to requests without undue delay and, in any case, within one month of receipt, a period that may be extended by up to two further months where necessary, taking into account the complexity and number of requests, in which case we inform you.

7.3 Updating in the Account. You can update your name, telephone number and language directly on the Account page.

7.4 Complaint. Without prejudice to any other remedy, you have the right to make a complaint to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt. We would be grateful if you contacted us first so that we can try to put it right.

8) Security

We implement appropriate technical and organisational measures, including HTTPS, access control, the principle of least privilege and backups. Even so, no method of transmission or storage is 100% infallible; therefore, share only what is necessary and contact us if you suspect any security incident.

8.1 On the Portal, passwords are stored only as a cryptographic fingerprint (“hash”), never in readable form; changing a password ends the sessions on all other devices; and staff access to Account data is limited to what is necessary. In the event of a personal data breach likely to result in a risk to your rights, Pronto notifies the CNPD and, where required, the affected data subjects, in accordance with Articles 33 and 34 of the GDPR.

9) Cookies & choices

We use cookies/pixels and similar technologies to operate the site, improve the experience and measure performance and advertising.

Strictly necessary: security, load balancing, form progress.
Preferences/functional: remembering settings (e.g., language).
Analytics: e.g., Google Analytics 4.
Marketing/advertising: e.g., Google Ads/remarketing.

Your choices: use our banner to Accept/Reject non-essential cookies; adjust your browser; reopen preferences through the button on the prontosolucoes.pt site.

Note: when you use the WhatsApp link, Meta may process your number/message under its own terms and policies.

9.1 On the Portal, we use only what is strictly necessary for it to work, described in section 17. Consent is not required for strictly necessary technologies.

10) Payments

Where we provide payments (e.g., MB WAY, Multibanco, cards, Apple Pay/Google Pay, bank transfer), processing is carried out by a payment service provider (Mollie). We may receive and process transaction metadata (e.g., status, method, reference, amount, date/time) for the purposes of reconciliation, fraud prevention, management of refunds/chargebacks and support.

We do not store full card credentials or sensitive payment credentials; that data is handled by the payment provider.

11) Children

The Platform is not intended for children under 16. If you suspect that a minor has given us personal data, contact us so that we can delete it, unless retention is required by law.

11.1 The Account is intended only for people who are of full age and have full legal capacity, under the Terms of Use. If we learn that an Account belongs to a minor, we close it and delete the data, unless retention is required by law.

12) Changes

We may update this Policy. We will indicate the new “Last updated” date. Continued use of the Platform after the updated version is published constitutes acceptance of the changes, to the extent permitted by law.

12.1 The version in force is identified by the number at the end of this page. Where a change is significant, we inform Account holders by email or on the Portal.

Part II — Processing specific to the Account

Part II describes the processing of personal data that is specific to the Account on Pronto Portal and applies in addition to Part I.

13) Account data

To create and maintain the Account, we process: the name, email address, telephone number, language and the profile chosen (for example your own home, a rented property, short-stay hosting or a portfolio of properties); the date of the last session and the confirmation of the email; a record of the version of the Terms of Use that you accepted and when; and, if you do not use Google, the password, which we store only in the form of a hash.

We also process the data of the Requests and of the history of jobs associated with the Account: the Properties, descriptions, photos and videos, assigned technicians, visits and times, quotes, reports, receipts and support messages.

14) Properties and Access Instructions

The Access Instructions to a Property, such as the floor, the door, entry codes, the alarm and where keys are kept, are information that deserves particular care. We ask you to give only what the visit needs and not to include passwords for personal accounts, bank details or other data unrelated to access.

We process them only to allow the assigned Technician to carry out the visit and for customer support, and we share them only when necessary for those purposes, as set out in section 4.2. The basis is the performance of the contract (Art. 6(1)(b) GDPR).

15) Reporting Links and third-party data

When a person uses a Reporting Link created by an Account holder, we process what that person sends, such as the text and photographs, and the associated technical data, such as the IP address, in order to deliver the report to the Account, to limit abuse and for security. That person does not see the Account's data.

The Account holder, by recording the data of other people, such as the telephone number of an owner, a tenant or an on-site contact, declares that they do so lawfully and that those people know that they may be contacted. A person who is contacted and who considers that their data was wrongly given can exercise their rights under section 7.

16) Sign-in with Google

If you choose to sign in or create the Account with a Google account, we receive from Google the identifier of the Google account, your verified email address and your name. We do not receive the password of your Google account. We use that data to create the Account or to authenticate you and to link it to an existing Account, where applicable. Google's processing of your data is governed by Google's own privacy policy.

17) Storage on your device

The Portal uses only what is strictly necessary to work: a session cookie that keeps you signed in and a language preference stored on your device. The browser may also keep the content of a form that you are filling in, so that you do not lose it. These elements are not used for advertising.

18) Automated decisions and sale of data

We do not take decisions that produce legal effects concerning you, or that significantly affect you, based solely on automated processing, including profiling. We do not sell your personal data.

Contacts

Privacy: privacy@prontosolucoes.pt · General: info@prontosolucoes.pt
SUKARIME KALIKIO, UNIPESSOAL, LDA · Tax ID 518331156
Rua Oliveira Monteiro 722 3, Direito, Porto, Portugal
Telephone: +351 923 250 285