Privacy Policy
In short.
The dashboard, the comparison tool and the calculator run in your browser: the values you type are not sent to us.
In the Readiness Index you see your result without giving any contact details. Your answers are sent to our server to calculate the result and are kept under a code, without your name, email or IP address, so that we can improve the Index. If you ask for the full plan or a conversation, we also keep your email (and your name, for a conversation) linked to those answers.
We only process personal data when you send it (forms, plan, conversation, newsletter subscription) or write to us, for example on WhatsApp. Below we explain which data, why, for how long and with whom. We use no advertising cookies and no session-recording tools, and we do not sell your data.
1. Data Controller
Controller: Carlos Vieira Leite (sole trader)
Trading name: SISO Consultoria
Tax ID (NIF): 300699239
Address: Rua Dom João I, 504, 2.º Esq. Ft., 4450-163 Matosinhos, Portugal
Full identification: Legal notice
Contact email: admin@sisoconsultoria.com
Website: sisoconsultoria.com
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 58/2019 and, for people who contact us from Brazil, also in accordance with Law no. 13.709/2018 (LGPD).
2. Which Data We Process, and Why
We only process the data we need for each purpose. In each situation:
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form (the Orientation page, which the site's contact buttons lead to; municipality sheet and dashboard data request; questionnaires) | Name, email, message and the fields you fill in: phone or WhatsApp, subject, municipality or region, approximate amount (optional), timeline, preferred channel. We also keep three internal labels, taken only from what you chose or the page you came from: language, subject and origin. | To reply to your request and take the preliminary steps towards a possible service; to organise our replies by subject and language. We email you a copy of the message you wrote. | Your request and pre-contractual steps (art. 6(1)(b) GDPR); legitimate interest in replying to people who contact us (point (f)). |
| Market Pulse and dashboard alerts | Name (Market Pulse), email, form of origin, date and time of consent and of confirmation (double confirmation). | To send the Market Pulse (monthly newsletter) and the dashboard alerts (quarterly), according to the form you signed up on. | Consent (art. 6(1)(a) GDPR), which you may withdraw at any time. |
| Buyer's guide download | Name, email, form of origin, date and time of consent and of confirmation. | To deliver the guide and send periodic updates from SISO Consultoria. | Consent (art. 6(1)(a) GDPR), which you may withdraw at any time. |
| Works project questionnaire (clients, by invitation) | Data about the household members you indicate (names, ages, habits, accessibility needs, pets) and your preferences for the project. We only ask for what is useful for the project. | To plan the works project around your family's premises. | Pre-contractual steps and performance of the contract (point (b)). |
| Readiness Index (self-assessment questionnaire) | To calculate and show the result: the answers to all questions (including your situation for living in Portugal and your documents situation), the result, the language and the date. We keep this record under a code, without your name, email or IP address. If you ask for the full plan: the email you provide, linked to the record, and your choice about receiving news. If you ask for a conversation: also your name and the notes of the conversation; in some cases, a complementary questionnaire. We do not ask about anyone's health and we do not ask for your phone number. If you choose WhatsApp, the message comes ready-written and reaches us only if you send it. |
To calculate and show the result; send the full plan; prepare and hold the conversation; improve the Index and SISO's services by analysing the answers as a whole, without your email or name; send news, only if you tick the option. We do not use the result to decide whether to serve anyone. | Your request and pre-contractual steps (art. 6(1)(b) GDPR) to calculate, send the plan and prepare the conversation; legitimate interest in improving the Index and services (point (f)), to which you may object and which ends if you ask for the record to be erased; consent for news (point (a)), which you may withdraw at any time. For people contacting us from Brazil, the equivalent LGPD bases apply. |
| Readiness Index account (optional) | Your email, the date, the index and the status of each area (Gap, Worth preparing or On track) of each result you ask us to save, your choice about receiving periodic information and, if you tick the dedicated option, your timeframe band, whether you intend to buy and whether you have already chosen the city. We do not keep your answers, your situation for living in Portugal or any health data: the Readiness Index record, described in the row above, is separate from the account history. We only save after you confirm your email through a link. | To let you review your history, redo the assessment and see your progress; to send periodic information if you ask; and, with the dedicated option, to prepare a future contact. | Your consent (art. 6(1)(a) GDPR), which you can withdraw at any time by deleting the account. |
| WhatsApp conversations | Your number, your profile name and the messages you send. | To talk with you, at your request. We do not use automatic replies or artificial intelligence in these conversations. | Your request (point (b)) and legitimate interest (point (f)). |
| Browsing | Aggregated visit statistics (pages, country, device type) through Vercel Analytics, without cookies; technical server logs, for security and operation. In the Readiness Index we count, without cookies and without keeping your IP address, how many people open the questionnaire, start, stop at each question, finish and ask for the plan or a conversation: these are aggregate numbers, not linked to any person. | To know which pages are used and to keep the site secure. | Legitimate interest (point (f)). |
We answer through the WhatsApp Business app. The profile is public: name (SISO Consultoria), username (@sisoconsultoria), description, website, email and phone. Conversations go through WhatsApp (Meta), which processes them under its own policy. If we start using an automated assistant, we will update this policy beforehand. In the Readiness Index, the WhatsApp buttons open the app with a written message (your index and priorities) that you read and send, or not. We do not ask for your phone number in the form. We reply by hand, from the company number, generally within 24 business hours and, at most, within 48 business hours. The buttons to send the result to your own WhatsApp or to the person you decide with build the text on your device: it does not pass through our server.
What stays only in your browser
The dashboard, the municipality comparison tool, the mortgage calculator and the municipality sheets run in your browser: the values you type are not sent to us.
The Readiness Index keeps a draft of your answers in your browser while you answer, so you do not lose what you have done. The draft is deleted when you finish and expires after 30 days. When you finish, the answers are sent to our server for the calculation, as described in the table above. We only send data when you submit a form, finish the Index, ask for the plan or a conversation, or confirm a subscription.
We do not make automated decisions about people. The Readiness Index is a self-assessment tool: it combines your answers, by area, into a number from 0 to 100, so that you can see where it is worth preparing. We do not use it to decide whether to serve anyone or how much to charge. The dashboard scores (for example, the Siso Score) refer to municipalities, not to people.
3. Cookies and Browser Storage
| What | Why | Duration |
|---|---|---|
| First-party cookies | The site does not currently set first-party cookies. If a future feature requires them (for example, link-based access), we will update this policy before enabling it. | — |
Local storage (localStorage) |
Preferences (theme, chosen profile, view mode), the Readiness Index draft (deleted when you finish; expires after 30 days) and a note that you have already subscribed (or that a subscription is pending). It does not leave your device. | Preferences: until you clear your browser data. Index draft: 30 days |
We do not use advertising cookies, Google Analytics, social network pixels or session-recording tools. According to Vercel, Vercel Analytics does not use cookies.
In the Readiness Index we count, in aggregate, how many people open the questionnaire, start, stop at each question, finish and ask for the plan or a conversation, without cookies and without keeping your IP address. These numbers are used only to improve the tool.
4. Who We Share Data With
We do not sell, rent or hand over your data for commercial or advertising purposes. We use the following providers, who process data on our behalf or receive technical data when you use the site:
| Provider | Why | Data received | Location |
|---|---|---|---|
| Brevo (Sendinblue SAS) | Sending form messages, confirmation emails, the Readiness Index full plan, internal notices to the team and the Market Pulse; subscriber lists; contact attributes (history of the optional Readiness Index account). | Name, email and message content (in the full plan: the result and the guidance); list data (origin, consent). Brevo may record opens and clicks in the emails sent and keeps a log of the emails sent according to its own policy. | France (EU) |
| Zoho Mail (Zoho Corporation) | Receiving and answering your messages (admin@sisoconsultoria.com). |
What you write to us. | According to the data centre of the Zoho account |
| Neon (Databricks group) | Database where we keep the Readiness Index records and the usage counts. | The records described in the Index row (answers, result, language, date and, if you ask, email, name and notes). | Frankfurt (EU); a US company |
| Vercel Inc. | Site hosting and aggregated statistics (Vercel Analytics). | IP address and technical request data, to deliver the page and for security. Our server reads your IP only in memory, to limit abusive requests, and does not store it in the Index record. | USA (standard contractual clauses) |
| Google Fonts | Typeface of the pages. | Your IP address, when the page loads the typeface. | USA |
| jsDelivr | Dashboard chart libraries. | Your IP address, when the page loads the library. | Global distribution network |
| CARTO and OpenStreetMap | Dashboard maps. | Your IP address and the map area you view. | According to each provider |
| WhatsApp (WhatsApp Ireland Limited, Meta) | Conversation channel: when you click the WhatsApp button or write to us there, the conversation takes place outside our site. | Your number, profile name and what you write, under WhatsApp's policy. | Ireland (EU) and other countries, according to WhatsApp |
When a provider is outside the European Economic Area, the transfer relies on the European Commission's standard contractual clauses or another mechanism provided for in the GDPR. We may also disclose data when required by law (for example, to competent authorities).
5. How Long We Keep Data
| Data | Period |
|---|---|
| Messages and contact requests that do not become a service | Up to 24 months after the last contact, or sooner if you ask for deletion. |
| Readiness Index record (answers and result), with or without email | 24 months from the date of the result, or sooner if you ask for erasure. |
| Index record with a conversation request (includes name and notes) | 36 months from the date of the result, or sooner if you ask for erasure. |
| Index usage counts | No period: they are aggregate statistics with no personal data. |
| Readiness Index account (history) | Until you delete it, or 24 months without access. You can delete everything and download your data at any time, on the account page. |
| WhatsApp conversations | Up to 12 months after the last contact, or sooner if you ask for deletion. |
| Client data (contracts, invoicing, project) | For the duration of the relationship and for the periods required by tax and accounting law. |
| Market Pulse, dashboard alerts and guide | Until you unsubscribe or withdraw consent; we delete within 30 days from then. |
| Technical logs and statistics | For the period set by the provider (Vercel), usually short. |
6. Your Rights
Under the GDPR (and, where applicable, the LGPD), you have the following rights:
To exercise any of these rights, or to withdraw consent (which does not affect earlier processing), send an email to admin@sisoconsultoria.com with the subject "GDPR rights". We reply within one month at most.
For the Readiness Index, to ask for access, a copy or erasure, give the email you used for the plan or the result code (shown on screen and in the plan email). For your security, we reply to the email that made the request. We erase or send the data within one month.
To unsubscribe from the newsletter, you can also click "Unsubscribe" in any email we send.
Double confirmation
After you submit your email for the newsletter, you receive a confirmation message and only join our list once you click the link. This way, nobody is subscribed without knowing.
7. Security
The site uses an encrypted connection (HTTPS), access to messages is restricted and the providers above are bound by contract to data protection obligations. No system is infallible; if a breach affects your data, we will notify as required by law.
8. Minors
The site is not intended for people under 16 and we do not knowingly collect data from minors. If you become aware that a minor has sent us data, please contact us so we can delete it.
9. Changes to This Policy
We may update this Policy. The latest version is always at sisoconsultoria.com/privacy and relevant changes will be communicated by email to newsletter subscribers.
Version 2.3 (20/10/2026): full identification of the controller (tax ID and address); WhatsApp described as a conversation channel, with a public profile and no automatic replies; Market Pulse, dashboard alerts and guide download described as consent-based purposes; English version.
Version 2.4 (26/10/2026): contact forms become two, one in Portuguese and one in English (the Orientation page); the confirmation email includes a copy of the message sent; contacts receive three internal labels (language, subject and origin), with no profile or scoring of the client; the approximate amount is always optional.
Version 2.5 (26/10/2026): our email provider (Brevo) may record opens and clicks in the emails sent (the option cannot be switched off in the account); in confirmation emails, site addresses are now plain text.
Version 2.6 (28/10/2026): new Readiness Index (self-assessment questionnaire): we describe what stays in your browser, what we receive (contact details, index, status of each category and priorities) and what we only receive if you ask for a conversation; replies on WhatsApp are written by hand; retention periods for the contact and for the conversation request; anonymous usage counters for the questionnaire; we no longer state that we build no automatic profiles and instead describe what the index does and does not do.
Version 3.0 (01/11/2026): the Readiness Index now calculates the result on our server. Answers are kept under a code, without your name, email or IP address, so that we can improve the Index; people who ask for the full plan receive it by email, and the email is linked to the answers to prepare a possible conversation. We count use of the questionnaire without cookies. News by email only if you choose it. New database provider (Neon, Frankfurt). Periods: 24 months, or 36 if a conversation is requested. We still do not ask about anyone's health.
Version 2.10 (31/10/2026): in the Readiness Index, the guidance for each area (questions to reflect on, steps, common mistakes and checklist) now comes from our server, only for your priority areas. The request carries only the language and the names of those areas, without your answers or anything that identifies you, and it is not kept. The calculation and your answers stay on your device, and we still do not ask about anyone's health.
Version 2.9 (29/10/2026): the reply time to messages is now, in general, up to 24 business hours, with the maximum of 48 business hours kept as the limit in busier periods.
Version 2.8 (29/10/2026): in the Readiness Index we no longer ask for a phone number: the result appears immediately and the copy goes by email; anyone who prefers WhatsApp opens a conversation with a written message that the person sends, and can send the result to themselves or to the person they decide with, without the text passing through our server; the reply time of up to 48 business hours now applies only to the conversation with the team.
Version 2.7 (28/10/2026): optional Readiness Index account with history (date, index and status of each area), a single-use access link sent to your email, a choice about periodic information and the right to delete and download your data at any time; we only save after you confirm your email.
10. Complaints
You have the right to lodge a complaint with a data protection authority. In Portugal:
CNPD — Comissão Nacional de Proteção de Dados
Rua de São Bento n.º 148-3.º, 1200-821 Lisboa
Tel: +351 213 928 400 · www.cnpd.pt
In Brazil, under the LGPD: National Data Protection Authority (ANPD) — www.gov.br/anpd.
Questions about privacy?
For any question about the processing of your personal data, or to exercise your rights, write to us:
admin@sisoconsultoria.com
Subject: GDPR rights — [your request]