Privacy Policy

1. Who is FROM?

FROM is Arrow Global Portugal’s new business-to-consumer platform. It supports the marketing and activation of the Group’s real estate projects and acts as a strategic partner to the Group’s various entities, ensuring an integrated approach throughout the value chain.

FROM respects the privacy of all its employees, business partners, clients, and suppliers. We process personal data responsibly and in compliance with applicable law, particularly European Union and Portuguese data protection legislation.

Data protection is a priority for FROM. This Privacy Policy explains how FROM processes personal data and describes the rights available to data subjects under the General Data Protection Regulation (GDPR).

2. What are our legal bases for processing personal data?

FROM may process your personal data on the following legal bases under Article 6 of the GDPR:

Compliance with a legal obligation;
Steps taken before entering into a contract and performance of a contract;
The data subject’s consent; and
Legitimate interests.

Where processing is based on the organization’s legitimate interests, FROM conducts a legitimate interests assessment to ensure that those interests do not override the data subject’s fundamental rights and freedoms. The principal processing activities carried out by FROM are set out below.

Processing Activity/Purpose	Legal Basis for Processing	Rationale
Management of real estate services	– Legitimate interests; – Compliance with a legal obligation; – Steps taken before entering into a contract and performance of a contract.	Management of your account in accordance with the contract and applicable legal obligations.
Management of direct and indirect marketing services	– Legitimate interests in conducting statistical analysis to improve services; – Consent for personalization activities supported by tracking technologies, or whenever legally required.	Management and improvement of marketing communications and services, subject to applicable legal requirements and your choices.
Statistical analysis and profiling	– Legitimate interests; – Consent.	Analysis and personalization of services and communications, subject to applicable legal requirements and your choices.
Compliance with, and support for compliance with, legal and regulatory obligations	– Legitimate interests; – Compliance with a legal obligation; – Performance of a contract.	Compliance with legal regulatory obligations.
Training and quality assurance	– Legitimate interests; – Compliance with a legal obligation.	Ensuring the quality of the services provided.
Customer service and market research	– Legitimate interests; – Compliance with a legal obligation.	Ensuring service quality and supporting communications and market research.
Recruitment and human resources management	– Steps taken before entering into a contract and performance of a contract.	Compliance with legal obligations and protection of personal data processed in relation to our employees and job applicants.

3. How do we use your personal data?

FROM collects and uses information provided directly by data subjects, as well as information obtained from the sources identified below. The personal data processed in relation to each client may include the following:

Category of Data	Description	Source
Client identification data	Personal data that may be used to identify the client, including: – full name; – identification number; – tax identification number; – date of birth and age; and – contact details, including telephone number and email address.	– The data subject during an interaction with FROM: or a processor, as well as postal codes obtained through CTT. Names and dates of birth are associated with the account. – Public databases, commercial registers, insolvency reports, and the Portuguese Central Credit Register.
Data relating to the client’s personal circumstances	Limited information concerning the client’s personal circumstances may be processed where strictly necessary to ensure accessibility, mobility, or adaptation of the services to the data subject’s specific needs. The purpose is to ensure that relevant personal circumstances are appropriately considered when providing real estate services.	– The data subject during an interaction with FROM: or a processor. – A third party duly authorized to represent the data subject.Personal circumstances will be recorded only with the data subject’s consent.
Financial Data	Financial data may include bank account details, credit card information, mortgages, and other arrangements involving credit agreements.	– The data subject during an interaction with FROM: or a processor. – A third party duly authorized to represent the data subject.
Public-interest and compliance data	Data may include politically exposed person (PEP) lists, sanctions-related information used to comply with Know Your Customer requirements, and other information from reliable public sources that is strictly relevant to compliance assessments, fraud prevention, or compliance with legal obligations.	Reliable commercial sources, including: – specialist risk and compliance information providers, including PEP and sanctions databases; – KYC/AML platforms, business data aggregators, and media monitoring services, such as Compliance Assist, Informa DB, and Bloomberg; and – insolvency lists.
Data obtained within the Arrow Global Portugal Group	Intra-group data is commercial in nature and may include data concerning prospective investors and buyers.	Related Group platforms, but only where processing is based on a legitimate interest or the data subject’s explicit consent.
Other data	We generate other data to manage our databases efficiently and keep personal data up to date. This may include linking information across databases. For example, if a client changes address, the update may be applied across multiple databases to help maintain data accuracy efficiently.	FROM: generates this data from available sources, including: – internal databases; – communications from the data subject; – business data providers, such as Informa DB; – KYC/AML platforms, such as Compliance Assist; and – public sources, including registers and information arising from judicial proceedings.

4. How do we process special categories of data and profiling data?

How do we process health data (Special Categories of Personal Data)?

FROM may process information concerning a data subject’s physical or mental health where it is strictly necessary to adapt our services to the client’s specific needs, for example, mobility limitations, accessibility requirements, or communication-related needs.

Such sensitive data is processed strictly on the basis of the data subject’s explicit consent, obtained during the interaction with the client, in accordance with Article 9 of the GDPR.

This data is processed solely to ensure that our services are provided appropriately and will not be used for any other purpose.

Why do we process data for profiling purposes?

FROM carries out statistical analysis and profiling to personalize our real estate offerings, optimize marketing communications, and ensure that the services provided are relevant to each client’s specific needs.

This processing allows us to tailor property suggestions and commercial content to the user’s demonstrated interests and preferences, thereby improving the relevance and efficiency of our services.

How can you exercise your rights in relation to profiling?

As a data subject, you have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning you or similarly significantly affects you. You may object to this processing at any time by contacting our Data Protection Officer (DPO) as described in Section 12.

5. With whom do we share personal data?

In the course of FROM’s business activities, we share personal data only where strictly necessary and with the following recipients:

Entities within the Arrow Global Portugal Group;
Entities outside the Group, including partners and processors; and
Supervisory and regulatory authorities, as required by law.

Entities within, or associated with, the Arrow Global Portugal Group:

Personal data collected may be disclosed to entities within, or associated with, the Arrow Global Portugal Group, of which FROM forms part, in connection with joint business activities. Depending on the specific activity undertaken, Group entities may act as independent controllers, joint controllers, or processors. Their role is determined on a case-by-case basis in accordance with Articles 26 and 28 of the GDPR. FROM ensures that Group entities receiving personal data comply fully with the GDPR and Portuguese Law No. 58/2019, including by implementing internal control mechanisms.

Processors

FROM may outsource the management of marketing and real estate services to third-party entities acting as processors. These service providers act on behalf of, and under the instructions of, FROM in connection with the management of the client account and do not act as controllers for those activities. Where applicable, you will be duly informed of such outsourcing.

Information Technology Service Processors

FROM may also engage other external entities to perform tasks on its behalf, including information technology and call center service providers, in support of its business operations. These processors act as FROM’s service providers and follow FROM’s instructions when contacting data subjects.

Payment Processors

If you choose to make payments by direct debit or credit card, FROM will transmit the information required to the relevant payment processors to complete the transaction.

Supervisory and Regulatory Authorities

FROM may share personal data with supervisory authorities and other legal or regulatory bodies where strictly necessary to comply with its legal obligations.

6. Where is personal data stored and to where is it transferred?

Our clients’ personal data is processed within the European Economic Area (EEA) and is protected by European Union law, including the GDPR. FROM shares personal data with third parties only where legally permitted. In such cases, we implement appropriate contractual provisions and security measures to protect the data and comply with confidentiality and security requirements.

Personal data is shared or transferred to countries outside the EEA only where the country is covered by an adequacy decision adopted by the European Commission or where appropriate Standard Contractual Clauses are in place. Such transfers are made only within the Group.

FROM may also share personal data on other lawful grounds, including to comply with court orders, in connection with investigations, or where necessary to safeguard and protect our legal rights.

7. How long do we retain personal data?

Your personal data will be retained only for as long as strictly necessary to fulfill the processing purposes identified above. As a general rule, where data is retained for the performance of contractual obligations, it will be kept for the duration of the active contractual relationship with FROM.

Retention periods vary depending on the purpose of processing, the type of data, applicable legal requirements, and the need to establish, exercise, or defend FROM’s legal rights.

The applicable retention period will be determined by reference to factors relevant to the specific circumstances, including limitation periods, agreed contractual terms, regulatory requirements, and industry practices.

For accounting and tax purposes, personal data will be retained in accordance with the legal, accounting, and tax obligations imposed by Portuguese law, including Article 40 of the Portuguese Commercial Code and Article 52 of the Portuguese Value Added Tax Code.

8. What security measures do we use?

To protect personal data throughout its lifecycle, from collection, storage, and processing through to deletion, FROM adopts comprehensive technical and organizational measures designed to ensure the confidentiality, integrity, availability, and resilience of information.

These technical measures include:

encryption of data both at rest and in transit to prevent unauthorized access or interception;
pseudonymization, where appropriate, to reduce the possibility of directly identifying data subjects; and
backup and recovery mechanisms, together with security testing, to ensure business continuity and data recovery in the event of an incident.

FROM also applies rigorous organizational measures, including:

access profiles based on the principle of least privilege, ensuring that information is accessible only to duly authorized personnel as required for their duties, together with multifactor authentication, periodic access reviews, and segregation of privileges where appropriate;
Implementation of internal security and data protection policies, regularly reviewed and updated;
internal security and data protection policies that are regularly reviewed and updated;
employee awareness and training initiatives designed to promote a strong data protection culture; and
control and monitoring procedures, including access logs and incident management, to ensure that operations performed on personal data are traceable.

FROM periodically evaluates the effectiveness of these measures to ensure that they remain appropriate in light of evolving risks, technological developments, and applicable regulatory requirements.

9. What are my rights under the General Data Protection Regulation?

1. Right of Access

You have the right to access your personal data and related information held by us. You may submit a data subject access request using any of the contact details set out in Section 12.

2. Right to Rectification

You have the right to request the rectification of personal data concerning you where it is incorrect, inaccurate, or incomplete. When receiving personal data, FROM checks for apparent omissions or errors, although it relies on the accuracy of information supplied by providers and clients. If you believe that your data is inaccurate or incomplete, you may request that it be updated. Where personal data is shown to be incorrect, FROM will update it accordingly. You may contact the Controller using the contact details set out in Section 12 of this Policy.

3. Right to Erasure (the “Right to be Forgotten”)

You may ask FROM to stop processing or erase your personal data where there is no lawful basis for retaining it.

4. Right to Restriction of Processing and Right to Object

You have the right to request that FROM restrict the processing of your personal data. You may also object to processing or withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

These rights are not absolute. Your personal data may continue to be processed where necessary:

for the establishment, exercise, or defense of legal claims;
to protect the rights of another individual or legal entity; or
for reasons of public interest.

FROM will review each request for restriction and assess whether any exception applies in the specific circumstances.

In relation to FROM’s direct marketing activities, data subjects have the rights provided under the GDPR and Portuguese Law No. 41/2004 of August 18. You may object at any time to the processing of your personal data for direct marketing purposes or request its erasure where continued retention is no longer required.

Processing activities and purposes are described in Section 2. Exercising the right to object does not necessarily result in the immediate deletion of all personal data. FROM will assess each request individually and, where deletion is not legally possible, will inform the data subject of the applicable grounds.

5. Right to Lodge a Complaint

You have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), if you believe that your rights as a data subject have not been respected.

6. Right to Data Portability

You have the right, where the applicable legal requirements are met, to receive your personal data and transmit it to another controller.

7. Right Not to be Subject to Automated Decision-Making or Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, where the applicable legal conditions are met.

8. Right to be Informed

You have the right to be informed about how we collect and use your personal data. This Privacy Policy is intended to provide that information. You also have the right to be notified of a personal data breach where the breach is likely to result in a high risk to your rights and freedoms.

Time limit for responding to rights requests

FROM responds to requests from data subjects without undue delay and, in any event, within one month of receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months, for a total of up to three months, in accordance with the GDPR. The data subject will be informed of any extension and of any additional information required.

10. How do we use Cookies?

We use cookies and similar technologies to improve your browsing experience, analyze website traffic, and personalize content.

What are cookies?

Cookies are small text files that our website stores on your computer or mobile device through your browser when you visit us. They allow the website to remember your actions and preferences, such as your username, selected language, or shopping cart, so that your browsing experience is faster, more efficient, and more personalized and you do not need to re-enter this information each time you return.

How do we manage consent and preferences?

When you first access our website, you will be shown a consent banner. The banner allows you to accept all cookies, reject non-essential cookies, or manage your choices through our Preference Center. Non-essential cookies will be used only after you have provided prior, explicit consent.

You may change or withdraw your consent at any time by reopening the Preference Center available in the footer of our website.

Which Categories of Cookies do we use?

Strictly Necessary Cookies: These cookies are enabled automatically and are strictly necessary for the website to function.
Analytical Cookies: We use tools such as Google Analytics to understand how you interact with the website and to improve its performance. These cookies collect statistical data, such as pages visited, visit duration, and traffic source. Their use is subject to your prior consent.
Marketing Cookies: We use technologies such as the LinkedIn Insight Tag and Meta Pixel to measure campaign effectiveness and deliver targeted advertising based on your previous visits. These cookies enable retargeting, including targeted advertising through LinkedIn and Facebook Ads Manager based on prior visits to our website. Their use is subject to your prior consent.

For further information about the privacy practices of the tools we use, please refer directly to Google and LinkedIn’s privacy policies.

11. What Artificial Intelligence tools do we use?

To improve the efficiency and quality of our services, we use artificial intelligence (AI) tools, including Microsoft Copilot in an enterprise environment and an internal GPT tool.

Why do we use AI?

We use AI to support our operational activities, including the analysis and summarization of information and the optimization of internal workflows. Only the personal data strictly necessary for the intended purpose is entered into AI systems, in accordance with the GDPR principles of data minimization and necessity.

What is the legal basis?

In this context, processing is based on our legitimate interests in improving productivity and service quality, provided that those interests do not override the data subjects’ fundamental rights and freedoms.

What safeguards apply to the use of AI?

Human oversight and validation: We ensure human oversight and validation throughout the use of AI systems. AI serves only as a support tool. No decision producing legal or similarly significant effects for data subjects is made solely by automated means without appropriate human intervention and control.
Secure processing environment: Data processed through Microsoft Copilot in the enterprise environment and the internal GPT tool is confined to the company’s secure environment and is not used to train or improve global AI models external to the organization.

For further information about Microsoft Copilot in an enterprise environment, please refer to Microsoft’s privacy policy.

12. Whom can I contact or complain to about the use of my personal data?

The Controller is FROM ADVISORY, UNIPESSOAL LDA (FROM:), with registered office at Avenida Almirante Gago Coutinho, 30, Ground Floor, 1000-017 Lisbon, Portugal.

If you have any questions or concerns regarding this Policy or FROM’s processing of personal data, or if you wish to exercise any of the rights described in Section 9, you may contact our Data Protection Officer, Laura Oliveira, using either of the following methods:

Email: DPO@from.pt
Address: FROM ADVISORY, UNIPESSOAL LDA (FROM), Avenida Almirante Gago Coutinho, 30, Ground Floor, 1000-017 Lisbon, Portugal.

You may also lodge a complaint directly with the Comissão Nacional de Proteção de Dados (CNPD), using the channels made available by that supervisory authority.

Last updated: July 30, 2026.