Privacy Policy

01

Introduction

ABYTA EMPREENDIMENTOS IMOBILIARIOS LTDA ("ABYTA," "we," "us," or "our") is a real-estate development company incorporated in Brazil under CNPJ 49.932.162/0001-57, with registered offices at Avenida DR Cardoso de Melo, 900, Conjunto 31 e 32, Vila Olímpia, São Paulo – SP. We operate the website available at abyta.site and related landing pages used to present our residential and commercial development projects.

This Privacy Policy applies to all personal information processed through our website, our digital advertising campaigns (including Google Ads), and any direct communications you initiate with us via email, contact forms, telephone, or messaging applications such as WhatsApp. It governs our role as the data controller and describes our obligations and yours.

By using our website or submitting your details through any of our contact channels, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, please refrain from providing us with your personal data or contact us to discuss how we can accommodate your preferences.

02

Information We Collect

We collect only the information that is genuinely necessary to respond to your enquiries, present our developments, and fulfil our legitimate business purposes. The categories below describe what we may collect and the circumstances in which each arises.

Information you provide directly

When you fill in a contact form, request a brochure, schedule a visit, or send us a message via WhatsApp or email, you may provide us with:

• Your full name and preferred form of address.
• Your telephone number, including the country code where applicable.
• Your email address, used for our correspondence with you.
• The city or neighbourhood you are interested in, and any preferences regarding property type, size, or budget that you choose to share.
• Any other information you include in the body of your message or in a free-text enquiry field.

None of our forms require sensitive personal data such as race, ethnicity, health information, religious belief, or political opinion. Please refrain from submitting such information.

Information collected automatically

When you visit our website, certain technical information is collected automatically by the servers that host our site and by the analytics and advertising tools we use. This includes:

• Your IP address and approximate geographic location derived from it (typically at the city level).
• The type of browser and operating system you are using, and your device category (desktop, tablet, or smartphone).
• The URL of the page that referred you to our site, and the pages you navigate to within our site.
• Date and time of your visit, session duration, and interactions with page elements such as buttons and forms.
• Cookie identifiers and similar tracking technologies, described in detail in Section 4 below.

Information from third-party advertising platforms

If you arrive at our website through a Google Ads campaign, Google may share aggregated conversion data with us — for example, that a user who clicked one of our advertisements later submitted a contact form. We receive this information in aggregated or pseudonymised form and do not use it to identify specific individuals without their prior consent. We do not receive your Google account information or any data you have not expressly shared with us.

03

How We Use Your Information

We process your personal data only where we have a lawful basis for doing so. Under the LGPD, the lawful bases we rely upon are: your consent (Art. 7, I), the legitimate interests of ABYTA or a third party (Art. 7, IX), the performance of a pre-contractual step at your request (Art. 7, V), and compliance with legal obligations (Art. 7, II). Under the GDPR, the equivalent bases are provided by Article 6(1).

The specific purposes for which we process your data are:

• Responding to your enquiry. When you submit a contact form or send us a message, we use your name, contact details, and the content of your message to prepare and deliver a tailored response, which may include sending you a brochure, arranging a site visit, or answering questions about a particular development. The lawful basis is the performance of pre-contractual steps.
• Following up on expressed interest. If you have provided your contact information and indicated interest in one of our projects, we may contact you proactively on one or more occasions to share updates relevant to that project — such as the launch of a new phase, a change in availability, or an upcoming event. The lawful basis is our legitimate interest in maintaining meaningful communication with prospective customers, balanced against your right not to receive unsolicited contact. You may opt out at any time.
• Improving our marketing and website. We use aggregated analytics data to understand which pages generate the most interest, which advertising campaigns drive qualified enquiries, and where our website may be improved for usability. This processing does not involve making decisions about individual visitors; it is carried out on the basis of legitimate interests.
• Measuring advertising effectiveness. We use conversion tracking provided by Google Ads to understand whether users who see our advertisements subsequently take actions on our website, such as submitting a contact form. This helps us allocate our advertising budget responsibly. The lawful basis is legitimate interests, subject to your cookie consent choices.
• Complying with legal obligations. We may be required to retain or disclose certain information by Brazilian law, judicial order, or regulatory authority. We will process data for this purpose regardless of your consent, as required.

We do not sell your personal data, rent it to third parties for their own marketing, or use it for purposes incompatible with those stated above. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects for you.

04

Cookies & Tracking Technologies

Our website uses cookies — small text files stored in your browser — and similar technologies such as pixel tags and local storage. Cookies help our site function correctly, allow us to remember your preferences across visits, and enable us to understand how visitors interact with our content.

Categories of cookies we use

• Strictly necessary cookies. These are essential for the website to operate. They enable basic functions such as page navigation and access to secure areas. You cannot opt out of these cookies through our cookie tool because the site cannot function properly without them. They do not collect information about you that could be used for marketing purposes.
• Analytics cookies (Google Analytics). We use Google Analytics (operated by Google Ireland Limited) to collect anonymised, aggregated data about how visitors use our site — pages visited, time spent, traffic sources, and similar metrics. The data collected is pseudonymised by truncating IP addresses before storage. Analytics cookies require your consent, and you may withdraw it at any time. You may also opt out globally using the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.
• Advertising and conversion cookies (Google Ads). We use the Google Ads conversion tracking tag to measure whether visitors who interact with our advertisements subsequently complete an action on our website, such as filling in a contact form. These cookies also enable us to serve remarketing advertisements — tailored ads shown to previous visitors of our website — on Google's Display Network and YouTube. Advertising cookies require your consent and may be managed through your Google Ad Settings.
• Functionality cookies. These cookies remember choices you make, such as language or region preferences, to provide a more personalised experience. They are not used for tracking across other websites.

Managing your cookie preferences

On your first visit, you are presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You may change your preferences at any time by clicking the "Cookie Preferences" link in the website footer. In addition, most browsers allow you to control cookies through their settings menus. Please be aware that disabling certain cookies may affect the functionality of our website. For detailed guidance on managing cookies in your specific browser, visit www.aboutcookies.org.

05

Sharing With Third Parties

We do not sell or trade your personal information to any third party. We may share your data in the limited circumstances described below, and only to the minimum extent necessary.

• Service providers acting as data processors. We engage carefully selected technology service providers who process data on our behalf in accordance with our instructions and under data processing agreements that bind them to equivalent standards of protection. These include our website hosting provider, our email delivery platform, and the providers of the analytics and advertising tools described in Section 4. Current principal processors include Google Ireland Limited (Google Analytics and Google Ads) and Meta Platforms Ireland Limited (where applicable for social media advertising).
• Legal and regulatory disclosure. We may disclose personal data if required to do so by applicable law, a court order, a regulatory body such as Brazil's Autoridade Nacional de Proteção de Dados (ANPD), or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of ABYTA, our clients, or the public.
• Business succession. In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data we hold may be transferred to the acquiring entity, provided that entity agrees to be bound by the commitments set out in this policy.
• With your explicit consent. We may share your information with a third party — for example, a partner sales broker acting in relation to a specific development — where you have explicitly consented to this disclosure before it takes place.

When we transfer personal data outside Brazil or the European Economic Area, we ensure that appropriate safeguards are in place, such as standard contractual clauses approved by the relevant authority or the adequacy of the recipient country's data protection framework.

06

Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to honour our contractual commitments, or to comply with applicable legal obligations. The specific retention periods we apply are as follows:

• Enquiry and contact records. Information submitted through contact forms or provided via WhatsApp or email is retained for up to 5 years from the date of last meaningful contact. This period reflects the statute of limitations applicable to consumer and civil claims under Brazilian law, ensuring we can respond to any dispute or complaint that may arise.
• Analytical and behavioural data. Data collected via Google Analytics (aggregated and pseudonymised) is retained in our Google Analytics account for a period of 26 months, after which it is automatically deleted. Raw server log files, which may contain IP addresses, are retained for 90 days for security purposes before deletion.
• Advertising conversion data. Conversion data associated with individual Google Ads campaigns is retained for the period specified in our Google Ads account settings, typically no longer than 90 days for individual conversion events.
• Legal obligation records. Where we are required by law to retain information — for example, financial transaction records subject to Brazilian fiscal legislation — we will retain such data for the period prescribed by the relevant statute, which may be up to 10 years.

When personal data is no longer required, we delete it securely or, where deletion is not technically possible, anonymise it so that it can no longer be linked to any individual.

07

Data Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures designed to protect it against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• All data transmitted between your browser and our website is encrypted using TLS (Transport Layer Security), indicated by the padlock icon and HTTPS prefix in your browser's address bar.
• Access to personal data stored in our internal systems is restricted to employees and service providers who need it to carry out their duties, and is controlled through role-based access permissions and password policies that require regular updates.
• Our hosting infrastructure is maintained by providers that hold recognised security certifications (including ISO 27001), and physical access to data centres is subject to strict controls.
• We review our data security practices periodically and update our measures in response to emerging threats or changes in technology.

Despite these measures, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority (ANPD in Brazil) and, where required, the affected individuals, in accordance with applicable timescales under the LGPD.

08

Your Rights

Depending on your country of residence, you may hold a range of rights in relation to the personal data we hold about you. Under the LGPD (Art. 18) and the GDPR (Art. 15–22), these rights include the following:

How to exercise your rights

To exercise any of the rights described above, please send a written request to contato@abyta.site, identifying yourself clearly and specifying the right you wish to exercise. We will respond within 15 business days, as required by the LGPD. In complex cases or where we receive a high volume of requests, we may extend this period by a further 15 business days and will notify you accordingly.

We may ask you to verify your identity before acting on your request, to ensure that we are not disclosing or altering data at the request of an unauthorised person. We will not charge a fee for handling your request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to respond, providing our reasons.

ANPD contact: www.gov.br/anpd

09

Children's Privacy

Our website and services are directed exclusively to adults who are interested in purchasing or investing in real estate. We do not knowingly collect personal data from individuals under the age of 18. Our contact forms do not ask for date of birth, but by submitting your details you represent that you are at least 18 years old.

If you are a parent or guardian and you believe that a child under your care has provided us with personal data without your consent, please contact us immediately at contato@abyta.site. We will take prompt steps to verify the situation and, if confirmed, to delete the relevant information from our records.

10

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing activities, new services or technologies we adopt, or updates to applicable law. When we make changes, we will revise the "Last updated" date at the top of this page.

If the changes are material — for example, if we begin processing your data for a new purpose or sharing it with a category of third parties not previously disclosed — we will take additional steps to inform you, such as displaying a prominent notice on our website or, where we hold your email address, sending you a direct notification. We will not change the purposes for which we use your data in a way that is incompatible with those stated here without first seeking your consent where required by law.

We encourage you to review this policy each time you interact with our website, particularly after any material change has been announced. Your continued use of our website following an update constitutes your acknowledgement of the revised policy, though it does not constitute consent to any new processing that requires explicit consent.

11

Contact & Data Controller Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please do not hesitate to get in touch. We are committed to resolving any issues promptly and transparently.

The data controller responsible for processing your personal information is:

If you are located in the European Union and wish to raise a concern with a supervisory authority, you may contact the data protection authority in your member state of residence. If you are located in Brazil and are not satisfied with our response to your request, you may escalate your complaint to the ANPD at www.gov.br/anpd.