This Privacy Policy explains how we handle your personal data when you use the SCB Imóveis website (scbimoveis.com) and the SCB Imóveis app, under Brazil's General Data Protection Law (LGPD, Law No. 13.709/2018). It applies to both; where a rule applies to only one of them, the text says so.
1. Who we are
SOUTH COAST BRASIL LTDA (CNPJ 66.894.484/0001-78), located at Estrada Dom João Becker 2000, Ed. Mirante Home Club, Ingleses do Rio Vermelho, Florianópolis/SC, Brasil, is the controller of the personal data processed on the scbimoveis.com website and in the SCB Imóveis app (together, the “services”). SCB Imóveis is the brand under which we operate. Our data-protection officer (encarregada; LGPD, Article 41) is Claudia Anahi Paez, reachable at privacidade@scbimoveis.com or +55 48 99141-6615.
2. Data we collect on the website
On the website we collect the data you send us through its forms: when you ask about a property (name, email, phone and message, together with the property and the page you sent it from); when you request a visit (name, email, phone, the property and the time slot you chose); when you ask us to sell your property (your contact details and the property details you provide); when you register as a partner broker (name, email, WhatsApp, CRECI and agency); and when you turn on email alerts (your email and the search filters). With information, visit and sale requests we record the language, the page, your IP address, your browser's user agent and the record of your consent; with partner-broker registrations, the language, the IP address and the date of consent; and, when you turn on alerts, the language and the date of consent. We also receive, through our servers, the inquiries you send about our listings on the ZAP Imóveis, Viva Real and OLX portals (Grupo OLX): name, email, phone and message. If you click to contact us on WhatsApp, we record the click, the property and technical data (IP address and browser), without contact details; the click identifiers and campaign parameters present in the address of the page you are on may be attached to that record and, if you have accepted optional cookies, also the referring domain and the other visit-origin data described in section 3; the conversation itself takes place on WhatsApp. Our servers also process your IP address to deliver the pages and protect them against abuse (for example, by limiting requests) and keep the access records described in section 12. The website also keeps its own usage statistics, without cookies and without contact details (listings viewed, searches and interactions such as clicks, with the page where they happened, and a random session identifier that is cleared when you close the tab or browser). Favorites, recently viewed listings, your last search, the searches you save and the contact details you entered in the forms (to prefill them next time) are stored in your browser's local storage, for your convenience; they only reach our servers when you send them yourself (for example, when you submit a form or turn on an alert), and you can clear them in your browser settings.
3. Cookies, analytics and advertising on the website
We use necessary cookies — one to remember the language you chose and, on pages with a form, a security cookie that protects submissions against forgery — and we store your cookie choice in your browser. On your first visit, a banner asks you to accept or decline optional cookies. Google Analytics 4 runs with Google Consent Mode (v2): until you accept — or if you decline — it sets no cookies and sends Google only cookieless measurement signals; if you accept, it uses analytics cookies to measure browsing. The website may also use the Google Ads tag to measure conversions from our ads and for remarketing and personalized advertising; it is loaded only after you accept, never before, through the same consent control that reports four Google Consent Mode v2 signals to Google (analytics storage, ad storage, ad user data and ad personalization): all four stay denied until you accept — and go back to denied if you decline — and, while denied, Google sets no advertising cookies. The website may also use the Meta Pixel (Facebook and Instagram) to measure and optimize our advertising; it is loaded only after you accept, never before. With your acceptance, when you send an inquiry or a visit request, we may tell Meta from our servers that the conversion happened, sending your email and phone in hashed form (SHA-256), your IP address, your browser, the identifiers of Meta's cookies, if any, the page and the property. After you accept, we store in your browser, for up to 90 days, the data of the first visit recorded (the page on which you accept counts) — the referring domain, the entry page and, if present, the ad click identifiers (gclid, gbraid or wbraid) and UTM parameters — and, separately, the data of the most recent visit that carried any of those identifiers or parameters; if you submit a form, request a visit or click to contact us on WhatsApp, this information is attached to the record of your contact so we know which ad or channel brought you. If you do not accept, nothing is stored in your browser; only the click identifiers and UTM parameters present in the address of the page you are on — and nothing else — may accompany a form, a visit request or a WhatsApp click. You can review your choice at any time through the “Cookie preferences” link in the website footer; if you decline, the analytics and advertising cookies already set and the visit-origin data stored in your browser are deleted, and the Pixel is no longer loaded on the following pages. You can also block or delete cookies in your browser settings. The app uses no cookies and no advertising identifiers (see section 4).
4. Data we collect in the app
In the app, when you create an account, complete onboarding, edit your profile, book a visit or contact us, we collect your name, email, phone/WhatsApp, country of residence, your search preferences (purpose, property types, areas, budget, interests), the details of your visit requests (property, preferred date and time) and the messages or inquiries you send, including property details if you ask us to sell a property. If you sign in with Apple or Google, we receive your name, email and a provider identifier; with Apple you can choose to hide your email. As you use the app we collect device and usage information (app events, through Google Firebase Analytics), crash and performance diagnostics (Firebase Crashlytics), your language and platform, and a push notification token if you allow notifications. When you are signed in, analytics events are linked to an internal account identifier — never to your name or email. Our servers process your IP address to secure the service (for example, to limit abusive requests) and store it when you sign in (with your session), when an error is logged, and when you submit an inquiry or a visit request. We also record in-app activity (searches, listings and areas you view, favorites and saved searches), including before you create an account, to operate and improve the app; as a guest this activity is not linked to your identity, and when you are signed in it is linked to your account. The app does not use your data for advertising, does not track you across other companies' apps or websites, and is set up not to collect your device's advertising identifier, so it does not ask for tracking permission. The app does not currently access your device's location; if a future version offers location-based features, it will ask for your permission first, use your location only for that purpose, and let you turn it off at any time in your device settings.
5. AI assistant
The app's AI assistant is optional and only offered when available. It is for signed-in users, with a limited number of messages per day, and the app asks for your consent before your first message. To answer, we send Microsoft Azure OpenAI Service your messages, the recent conversation and the SCB Imóveis listings and area information used in the answer; it processes them on behalf of SOUTH COAST BRASIL LTDA on SCB Imóveis's Azure subscription, possibly outside Brazil. Your name, email and phone are not sent. Microsoft does not use this content to train its models; content flagged by its abuse monitoring may be kept for a limited period for review. We keep a record of your consent (date and version) until you withdraw it or delete your account. When you use the assistant, we record the use for about 25 hours, only to apply the daily limit. Without your consent nothing is sent to the AI; you can withdraw it at any time in the app, by writing to ola@scbimoveis.com or by deleting your account. Please do not share sensitive personal information in the chat.
6. Notifications and emails
If you allow push notifications in the app, we use your device token to send you updates on your visits and, when these alerts are offered, the other alerts you choose — such as new listings matching your saved searches or price drops on properties you saved — through Firebase Cloud Messaging and Apple Push Notification service. The same updates appear in the in-app Notifications list; you can choose which available types you receive under Profile → Notifications, or turn off push notifications in your device settings. When these alerts are offered, they may also be sent by email if the Email channel is turned on under Profile → Notifications. By email we send service messages: in the app, welcome, email verification and password reset; on the website and in the app, replies to your requests and updates on your visit requests; and, on the website, the sharing link sent to partner brokers who register. On the website, if you turn on email alerts, we will send you new listings and price drops matching your search when these alerts are available. We only send property news from SCB Imóveis by email to people who expressly authorize it — by ticking that option when requesting a visit in the app or on the site's forms — or who turn on alerts; these emails include an unsubscribe link (you just confirm on the page that opens), and you can also ask to unsubscribe at ola@scbimoveis.com.
7. How we use your data
We use your data to: respond to your inquiries and assist you in the real estate brokerage; schedule, confirm, reschedule or cancel visits; assess a request to sell your property; register partner brokers and show, on the pages they share, the name, CRECI, agency and WhatsApp contact they provided; create and manage your app account, personalize the listings you see, provide the assistant, when available; send the notifications, alerts and emails described above; operate, secure, measure and improve the website and the app; measure and optimize our advertising (Google Ads and Meta), including remarketing, and identify the source of a contact, when you accept optional cookies on the website; and comply with legal and regulatory obligations. We do not sell your personal data.
8. Legal bases (LGPD)
We process your data based on: performance of a contract and of preliminary procedures at your request (Article 7, V) — responding to inquiries and visit requests made on the website or in the app, assessing a request to sell your property, and creating and managing your account; our legitimate interest (Article 7, IX) in operating, securing, measuring and improving the services — security, IP address logging, app diagnostics and usage analytics, and the website's own cookieless statistics; your consent (Article 7, I), which you can withdraw at any time — the website's optional cookies (Google Analytics with cookies, Google Ads, the Meta Pixel and sending conversions to Meta) and storing visit-origin data (referring domain, entry page, click identifiers and campaign parameters) in your browser, property alerts and emails, partner-broker registration and the display of your details on shared pages, the AI assistant and push notifications; and compliance with a legal or regulatory obligation (Article 7, II) — for example, identifying the responsible broker on listings, as COFECI rules require, and keeping the access records required by the Marco Civil da Internet. Withdrawing consent does not affect processing carried out before the withdrawal.
9. Professionals' data shown on listings
Property pages show the name and CRECI registration number of our responsible broker and, on pages shared by a partner broker, also that broker's name and CRECI, because the advertising rules of Brazil's Federal Council of Real Estate Brokers (COFECI) require that identification; the legal basis is compliance with a legal or regulatory obligation. Partner brokers who register on the website also authorize the display of their name, CRECI, agency and WhatsApp contact on the pages they share. If you are one of these professionals and want to correct your details or object to their display, write to ola@scbimoveis.com or to our data-protection officer (encarregada) at privacidade@scbimoveis.com; a listing, however, cannot remain published without the required identification.
10. Data sharing
We share data only with the providers and partners below, under their own data-protection commitments: Microsoft (Azure hosting of the website and our servers and, in the app, Azure OpenAI Service); MongoDB Atlas (database); Google (on the website, Google Analytics, Google Ads — conversion measurement and remarketing, only with your acceptance — and Google Workspace, which hosts the mailbox where our team receives requests; in the app, Firebase Analytics, Crashlytics, Cloud Messaging and Authentication, and Google Maps); Meta (on the website, the Meta Pixel and conversion reporting, only with your acceptance); Apple (Sign in with Apple and push notifications in the app); and our email provider (MailerSend). The website's maps are loaded from CARTO, which receives your IP address from your browser when it serves the map images. Requests made on the website reach our team by email. If you contact us on WhatsApp — or a partner broker, through the link they shared — that conversation is also subject to WhatsApp's terms. We may disclose data when required by law or by a competent authority. We do not sell your personal data.
11. International transfers
Some of these providers — including Google and Meta, as regards the website's measurement and advertising data — process data outside Brazil, notably in the United States, where the website and our servers are hosted; Azure OpenAI Service may process requests to the app's assistant in any region where the model is available. For these transfers, we rely on the grounds in Article 33 of the LGPD that apply in each case — for example, a transfer necessary to perform a contract or preliminary procedures carried out at your request and, for the measurement and advertising data sent to Google and Meta, your consent (Article 33, VIII) — and on the contractual data-protection safeguards offered by these providers, including, where applicable, standard contractual clauses.
12. Retention
On the website, data from property inquiries, visit requests, requests to sell a property and partner-broker registrations is kept for as long as necessary to handle your request and any resulting brokerage relationship, and to meet legal and regulatory obligations; after that, it may be kept for up to 5 years after the last contact, only for the regular exercise of rights in judicial, administrative or arbitration proceedings (Brazilian Consumer Protection Code, Article 27; LGPD, Article 7, VI, and Article 16), and is then deleted or anonymized. Data used to send property alerts and emails is kept until you unsubscribe or withdraw your consent. Google (Analytics and Ads) and Meta data follow those services' retention periods; the visit-origin data (click identifiers, campaign parameters, referring domain and entry page) we keep in your browser expire after 90 days — or earlier, if you decline cookies — and, when attached to a contact, follow the retention period of that request's data; and other data kept in your browser's local storage stays on your device until you clear it. In the app, we keep your data while your account is active and only as long as needed for the purposes of this policy. Some app records have fixed limits: error and diagnostic logs (which include your IP address, device or browser user agent and, when you are signed in, your account identifier) are deleted automatically after 30 days; technical server request logs, used for diagnostics, are kept for 14 days (the access records required by the Marco Civil da Internet, described below, are kept separately for 6 months); sign-in sessions expire after 30 days, and the IP address stored with each session is deleted at the next sign-in or when the account is deleted; and assistant usage records are deleted after about 25 hours. Firebase Analytics and Crashlytics data follow Google's retention for those services. To comply with Article 15 of Brazil's Internet Civil Framework (Marco Civil da Internet, Law No. 12.965/2014), we keep access records of the website and the app — date and time of use, IP address and technical request data such as the page or resource accessed and the browser, and, in the app, the internal account identifier — for 6 months, confidentially and in a controlled, secure environment; they are disclosed only under a court order and are deleted automatically at the end of that period, unless the police, an administrative authority or the Public Prosecutor's Office requests that they be kept longer (Article 15, § 2).
13. Deleting your account and your data
You can delete your app account at any time under Profile → Delete account. Deletion is permanent and cannot be undone: we erase your account and the personal data linked to it — profile, preferences, favorites, saved searches, activity history, visit requests (upcoming visits are cancelled and our team is notified), notifications, device tokens, error logs linked to your account and assistant records (consent and usage) — and the link between your sign-in and Apple or Google is removed from our systems; to remove SCB Imóveis from the list of apps connected to your Apple or Google account, use that account's settings; you can later register again with the same email. Firebase Analytics events already sent, linked to the internal account identifier, are not erased by deletion and follow Google's retention periods. Access records required by the Marco Civil da Internet are not erased when the account is deleted: they are kept for the legal period of 6 months and then deleted automatically, unless a competent authority requests that they be kept longer. Deletion does not cover messages you exchanged with us on WhatsApp or by email, or emails our team received about your requests; to have those deleted, write to ola@scbimoveis.com. Visits that already took place or that you missed, and visits our team booked directly, are kept as internal SCB Imóveis records, without your contact details. Data sent through the website is not linked to an account: to ask for its deletion, write to ola@scbimoveis.com or to our data-protection officer (encarregada) at privacidade@scbimoveis.com. We will act on the request, subject to the retention cases set out in Article 16 of the LGPD.
14. Security
We protect your data with reasonable technical and organizational measures, such as encryption in transit (HTTPS) on the website and in the app and, in the app, hashed passwords. No system is completely secure; if an incident may cause you relevant risk or harm, we will notify you and the ANPD as required by law.
15. Your rights
Under the LGPD you may request confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed based on your consent; information about the entities we share data with and about the possibility of refusing consent and its consequences; and withdrawal of consent. Withdrawing consent does not affect processing carried out before it. You may also object to processing based on our legitimate interest and request a review of decisions made solely by automated processing that affect your interests — our services make no such decisions: suggestions, price labels, estimates and assistant answers are for information only. Requests are free of charge, and we answer requests for confirmation of processing or access to your data within 15 days. Write to our data-protection officer (encarregada), Claudia Anahi Paez (privacidade@scbimoveis.com), or to ola@scbimoveis.com — we may need to confirm your identity. You can also change your cookie choice under “Cookie preferences” in the website footer, unsubscribe from emails through the link in each message and, in the app, withdraw the assistant consent and choose your notifications in your Profile. Finally, you may lodge a complaint with the National Data Protection Authority (ANPD).
16. Minors
The website and the app are intended for adults aged 18 or over and are not directed to minors. If you believe a minor has sent us personal data, write to privacidade@scbimoveis.com so that we can delete it.
17. Changes to this policy
We may update this policy; the date shown at the top of this page identifies the current version. When we make material changes — for example to the purposes of processing, data sharing or the use of AI — we will notify you in advance by appropriate means, such as a notice on the website or in the app or an email, and, where processing relies on your consent, we will ask for your consent again. This policy is available in several languages; the Portuguese (Brazil) version prevails in case of discrepancy.
18. Contact
For privacy questions or to exercise your rights, contact our data-protection officer (encarregada), Claudia Anahi Paez, at privacidade@scbimoveis.com or +55 48 99141-6615. General contact: SOUTH COAST BRASIL LTDA (CNPJ 66.894.484/0001-78) — Estrada Dom João Becker 2000, Ed. Mirante Home Club, Ingleses do Rio Vermelho, Florianópolis/SC, Brasil. Email: ola@scbimoveis.com · WhatsApp: +55 48 99141-6615.