Privacy Policy
1. Who is FROM?
FROM is Arrow Global Portugal’s new B2C platform that enhances the commercialization and activation of its real estate projects and acts as a strategic partner to the Group’s various entities, ensuring an integrated approach across the entire value chain.
FROM respects the privacy of all its employees, business partners, clients, and suppliers, ensuring that their personal data is processed responsibly and in compliance with applicable legislation, in particular with full respect for European and national data protection laws.
For FROM, data protection is a priority. This Privacy Policy aims to inform data subjects about how FROM processes their personal data, as well as the rights available to them under the General Data Protection Regulation (GDPR).
2. What are our legal bases for processing personal data?
The processing of your data by FROM may be based on the following legal bases, pursuant to Article 6 of the GDPR:
- Compliance with a legal obligation;
- Execution of pre-contractual and contractual measures;
- Consent by the data subject;
- Legitimate Interest.
In cases where the legal basis for processing data is the legitimate interest of the organization, a legitimate interest assessment is conducted to ensure that it never overrides the fundamental rights and freedoms of the data subject. Please refer to the table below for FROM’s main processing activities:
| Processing Activity/Purpose | Reason(s) for Processing/Lawful Basis | Justification |
| Real estate services management | Legitimate interest; Compliance with a legal obligation; Execution of pre-contractual and contractual measures. | Account management, in accordance with the contract or under applicable legal obligations. |
| Marketing services management (direct/indirect) | Legitimate interest for statistical analysis aimed at service improvement; Consent for personalization activities supported by tracking technologies or whenever legally required. | Account management, in accordance with the contract or under applicable legal obligations. |
| Statistical analysis management and profiling | Legitimate interest; Consent. | Account management, in accordance with the contract or under applicable legal obligations. |
| Compliance and support for compliance with legal and regulatory obligations | Legitimate interest; Compliance with a legal obligation; Performance of a contract. | Compliance with legal obligations. |
| Training and Quality | Legitimate interest; Compliance with a legal obligation. | Ensuring the quality of services provided. |
| Customer service and market research | Legitimate interest; Compliance with a legal obligation. | Ensuring the quality of services provided for communication purposes and market studies. |
| Recruitment and Human Resources management | Performance of a contract and pre-contractual measures. | Compliance with legal obligations and guaranteeing data protection in processing our employees’ data. |
3. How do we use your personal data?
FROM collects and uses information provided directly by data subjects, which includes a variety of personal data categories relating to each client, namely:
| Data Categories | Description | Source |
| Client identification data | Personal data that can be used to identify the client, including: Full name; Identification number; Tax Identification Number; Date of birth and age; Contacts, including phone number and email. | Data subject during an interaction with FROM or a subcontractor, as well as postal codes via CTT. Names and dates of birth are linked to the Account. Public databases, commercial registries, insolvency reports, and the Central Credit Responsibilities database. |
| Data relating to the Client’s circumstances | Data relating to the personal circumstances of the client may include limited information strictly necessary to ensure accessibility, mobility, or adaptation of service provision to the specific needs of the data subject. The purpose of this information is to ensure that relevant personal dimensions for real estate service delivery are duly considered. | – Data subject during an interaction with FROM or a subcontractor; – Third party, duly mandated to represent the data subject. Personal circumstances will only be recorded with your consent. |
| Financial Data | Financial data collected may include bank account details, data relating to credit cards, mortgages, and other agreements involving credit contracts. | – Data subject during an interaction with FROM or a subcontractor; – Third party, duly mandated to represent the data subject. |
| Public interest data | Public interest data may include: Politically Exposed Persons (PEP) lists, sanction data, to ensure compliance with regulatory requirements (Know Your Client) and other information available from reliable public sources strictly relevant for compliance assessments, fraud prevention, or fulfillment of legal obligations. | Trusted commercial sources: Specialized risk and compliance information providers (PEP and sanction databases); KYC/AML platforms, corporate data aggregators, and media monitoring services (Compliance Assist, Informa DB, Bloomberg); Insolvency lists. |
| Data obtained within the ARROW GLOBAL PORTUGAL group | Data obtained intra-group corresponds to commercial data, including data on potential investors and buyers. | Related group platforms, only where there is a legitimate interest in processing or explicit consent from the data subject. |
| Other data | We produce other data to efficiently manage our databases and ensure your data remains up to date. This management may include linking information (e.g., if a client changes their address, this update may be reflected across multiple databases to ensure data accuracy efficiently). | FROM generates this data from available data sources, including: Internal databases; Communication from the data subject; Corporate data providers (such as Informa DB); KYC/AML platforms (such as Compliance Assist); Public sources (registries and information from judicial channels). |
4. Additional data processing matters
How do we process health data (Special Categories of Data)?
FROM may process data relating to the physical or mental health of data subjects when such information is strictly necessary to adapt our services to the client’s specific needs (for example, mobility difficulties, accessibility needs, or communication conditions).
The processing of this sensitive data is carried out strictly on the basis of the explicit consent of the data subject, collected at the time of interaction with the client (Article 9 of the GDPR).
This data is processed solely to ensure the appropriate provision of our services and will not be used for any other purpose.
Why do we process data related to your profile (Profiling)?
FROM conducts statistical analysis and profiling to personalize our real estate offers, optimize marketing communications, and ensure that the services provided are relevant to each client’s specific needs.
This processing enables us to adapt property suggestions and commercial content to the user’s history of interests and preferences to improve efficiency.
How can you exercise your rights regarding profiling data?
As a data subject, you have the right not to be subject to a decision based solely on automated processing, including profiling, where such a decision produces legal effects concerning you or similarly significantly affects you. You may exercise your right to object to this processing at any time by contacting our DPO as indicated in Section 12.
5. With whom do we share data?
Within the scope of FROM’s economic activity, we only share data when strictly necessary, with the following entities:
- Subsidiary entities of the Arrow Global Portugal Group;
- External entities to the group (partners and subcontractors);
- Supervisory and regulatory authorities in accordance with the law.
Arrow Global Portugal Group entities and/or affiliates:
Collected data may be transmitted to Arrow Global Portugal Group entities and/or related entities to which FROM belongs, within the framework of joint economic activity. Arrow Global Portugal Group entities act as independent controllers, joint controllers, or processors depending on the specific activity performed, with such qualification determined on a case-by-case basis under Articles 26 and 28 of the GDPR. FROM ensures that Arrow Global Portugal Group entities receiving the data fully comply with the GDPR and Law No. 58/2019, including the implementation of internal control mechanisms.
Processors (Subcontractors)
FROM may subcontract marketing and real estate service management to third-party entities designated as Processors. These market-leading partners act on behalf of and under the instructions of FROM regarding Client Account management, and do not act as data controllers. Should this occur, you will be duly informed of the implementation of such outsourcing.
Information Technology Processors
FROM may also engage other external entities to perform tasks on its behalf (including IT service providers and call center service providers) to support business operations. These Processors will always act as FROM’s partners and follow instructions provided to contact data subjects.
Payment Processors
If you choose to make payments by direct debit or credit card, FROM will transmit the necessary information to payment processing entities to enable the transaction.
Supervisory and Regulatory Authorities
FROM may share data with supervisory authorities, legal, and regulatory entities in strict compliance with the legal obligations to which it is subject.
6. Where is personal data stored and transferred?
The processing of our clients’ personal data takes place within the European Economic Area (EEA), protected by European legislation, namely the GDPR. FROM only shares personal data with third parties when legally authorized to do so. In such cases, we implement appropriate contractual provisions and security mechanisms to guarantee data protection and compliance with confidentiality and security standards.
The sharing and/or transfer of data to countries outside the EEA occurs only when that country benefits from an adequacy decision by the European Commission or when relevant “standard contractual clauses” are applied. Such data sharing is conducted intra-group only.
FROM may also share data based on other lawful grounds, namely for compliance with court orders, within the scope of investigative processes, or whenever necessary to safeguard and protect our legal rights.
7. How long is personal data retained?
Your personal data will be retained for the period strictly necessary to fulfill the processing purposes identified in the table above. As a rule, data retention is based on compliance with contractual obligations, and will be retained for the duration of the active contractual relationship with FROM.
Personal data will be retained for different periods depending on the purpose of processing, type of data, applicable legal requirements, and FROM’s need to defend its rights.
In particular, the retention period will be determined based on a set of factors applied to your specific case, considering limitation periods, agreed contractual terms, regulatory requirements, and industry practices, among other applicable criteria.
For accounting and tax purposes, your personal data will be retained in compliance with legal, accounting, and tax obligations under Portuguese law, notably Article 40 of the Commercial Code and Article 52 of the Value Added Tax (VAT) Code.
8. What security measures do we use?
In order to protect your data across all stages of its lifecycle—from collection, storage, and processing, to erasure—FROM adopts a comprehensive set of technical and organizational measures designed to ensure information confidentiality, integrity, availability, and resilience.
In this context, the following technical measures, among others, are implemented:
- Data encryption, both at rest and in transit, to prevent unauthorized access or interception;
- Pseudonymization, where applicable, reducing the possibility of direct identification of data subjects;
- Backup and recovery mechanisms, as well as security testing, ensuring continuity and data recovery in the event of an incident.
Concurrently, FROM applies strict organizational measures, including:
- Definition of access profiles based on the principle of least privilege, ensuring that only duly authorized personnel within the scope of their duties can access information, including multi-factor authentication, periodic access reviews, and privilege segregation where applicable;
- Implementation of internal security and data protection policies, regularly reviewed and updated;
- Awareness and training sessions for employees, fostering a culture of data protection;
- Adoption of control and monitoring procedures, including access logging and incident management, to ensure traceability of data processing operations.
FROM periodically evaluates the effectiveness of these measures to ensure their suitability against evolving risks, technological advancements, and applicable regulatory requirements.
9. What are your rights under the General Data Protection Regulation?
1. Right of Access
The data subject has the right to access their personal data and complementary information retained by us. For this purpose, you may submit a Data Subject Access Request through any of the contacts listed in Section 12 to access the data we hold about you.
2. Right to Rectification
The right to rectification consists of the right to request the correction of personal data concerning the data subject when it is inaccurate, incorrect, or incomplete. Upon receiving personal data, FROM conducts checks to detect errors, although it relies on the accuracy of information provided by suppliers and clients. If you consider that your data is inaccurate or incomplete, you have the right to request its update. Whenever data is proven to be incorrect, FROM will proceed with its due update. You may contact us using the Data Controller details in Section 12.
3. Right to Erasure (“Right to be Forgotten”)
As a data subject, you may request FROM to cease processing your personal data or erase it whenever there is no overriding lawful ground justifying its retention.
4. Right to Restriction of Processing and Right to Object
As a data subject, you have the right to obtain from FROM the restriction of processing. You have the right to object to the processing of your data or withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
However, this is not an absolute right. Your data may continue to be processed if any of the following grounds apply:
- For the establishment, exercise, or defense of legal claims;
- For the protection of the rights of another natural or legal person;
- For reasons of public interest.
FROM will review all restriction requests received and evaluate the applicability of these exceptions to the specific case.
Regarding direct marketing activities conducted by FROM, data subjects enjoy rights under the GDPR and Law No. 41/2004 of August 18. As such, you may object to processing for these purposes at any time or request erasure whenever retention is no longer legally required.
Processing activities and their purposes are detailed in Section 2; therefore, exercising the right to object does not automatically trigger immediate deletion of all data. FROM will conduct an individual review of each request, and if erasure is not legally feasible, the data subject will be duly informed of the rationale behind such impossibility.
5. Right to Lodge a Complaint
As a personal data subject, you have the right to lodge a complaint with the supervisory authority (Comissão Nacional de Proteção de Dados – CNPD) whenever you believe your rights as a data subject are not being respected.
6. Right to Data Portability
As a data subject, you have the right to receive your personal data and transmit it to another Controller.
7. Right Not to be Subject to Automated Decision-Making or Profiling
As a data subject, you have the right not to be subject to any decision based solely on automated processing, including profiling.
8. Right to be Informed
Data subjects have the right to be informed about how we collect and use their personal data. This privacy policy serves this objective. As a data subject, you also have the right to be notified of a personal data breach likely to result in a high risk to your rights and freedoms.
Timeframe for exercising your rights:
FROM responds to data subject rights requests within a maximum period of 1 month, which may be extended up to 3 months in complex cases under the GDPR. The data subject will always be informed of the status of the request and any need for additional information.
10. How do we use Cookies?
To improve your browsing experience, analyze site traffic, and personalize content, we use cookies and similar technologies.
What are cookies?
Cookies are small text files that our website saves on your computer or mobile device through your browser when you visit us. These files allow the website to remember your actions and preferences (such as username, chosen language, or shopping cart) to ensure faster, more efficient, and personalized navigation without requiring re-entry of information upon return.
How are consent and preferences managed?
When accessing our website for the first time, a consent banner will be displayed. This banner allows you to accept all cookies, decline non-essential cookies, or manage your preferences via our Preference Center. The processing of non-essential cookies will only begin upon your prior and explicit consent.
You may alter or withdraw your consent at any time by revisiting the Preference Center available in our website footer.
Which Categories of Cookies do we use?
- Strictly Necessary Cookies: Automatically activated and essential for website functionality.
- Analytical Cookies: We use tools like Google Analytics to understand how you interact with the website and improve performance. These cookies collect anonymized statistical data (pages visited, visit duration, traffic origin). Processing depends on prior consent.
- Marketing Cookies: We use technologies such as LinkedIn Insight Tag and Meta Pixel to measure campaign effectiveness and deliver targeted advertising based on prior visits. These cookies enable retargeting (displaying targeted ads on LinkedIn and Facebook Ads Manager) and their processing is dependent upon prior consent.
For more information regarding the privacy policies of the tools used, you may directly consult Google and LinkedIn privacy documentation.
11. What Artificial Intelligence tools do we use?
To increase efficiency and quality in service delivery, we utilize Artificial Intelligence (AI) tools, specifically Microsoft Copilot in an enterprise context and an internal tool (internal GPT).
Why do we use AI?
We use AI to support our operational activities, notably for information analysis, synthesis, and internal workflow optimization. Only strictly necessary data required for the intended purpose is entered into AI systems, applying the principles of data minimization and necessity under the GDPR.
What is the legal basis?
Data processing in this context is based on our legitimate interest in improving productivity and service quality, ensuring that such processing does not override the fundamental rights and freedoms of data subjects.
What safeguards exist in the use of AI?
- Human oversight and validation: In using AI systems, we guarantee human oversight and validation throughout the process. AI operates strictly as a support tool; no automated decisions producing legal or significant impacts on data subjects are taken without human intervention and control.
- Secure processing environment: Data processed by enterprise Microsoft Copilot and internal GPT remains confined to the company’s secure environment and is not used to train or improve external global AI models outside the organization.
For further information regarding Copilot in an enterprise setting, please consult Microsoft’s privacy policy.
12. Who can I complain to if I am dissatisfied with the use of my personal data?
The Data Controller is FROM ADVISORY, UNIPESSOAL LDA (FROM) with registered office at Avenida Almirante Gago Coutinho, nº 30, Floor 30, 1000-017 Lisbon, Portugal.
Should you have questions, concerns, or queries regarding this policy or personal data processing by FROM, or wish to exercise any rights listed in Section 9, you may contact our Data Protection Officer, Laura Oliveira, via:
- Email: DPO@from.pt
- Address: FROM ADVISORY, UNIPESSOAL LDA (FROM), Avenida Almirante Gago Coutinho, nº 30, Floor 30, 1000-017 Lisbon, Portugal.
Data subjects may also lodge a complaint directly with the National Data Protection Commission (Comissão Nacional de Proteção de Dados – CNPD) via the channels provided by this supervisory authority.
Last updated: July 30, 2026.
FROM Public Document. Version 7: Approved by DPO | Date: July 2026