Privacy and Personal Data Protection Policy

This is a courtesy translation. In case of any discrepancy, the Spanish version prevails.

1. Who we are

Andrea Fabiana Barrios, hereinafter “Cupertino Negocios Inmobiliarios” or “the company”, tax ID (RUT) 150516800011, domiciled in Punta del Este, Maldonado, Uruguay, is the controller of the database described in this policy. The company is registered with the Ministry of Tourism under No. 2158.

The processing of personal data is governed by Law No. 18,331 on the Protection of Personal Data and Habeas Data Action, its Regulatory Decree No. 414/009, articles 37 to 40 of Law No. 19,670 and Decree No. 64/020.

2. What data we process

We only process the data you provide when you contact us or do business with us:

• Identification data: first and last name, identity document, nationality, address, phone number and email.
• Commercial data: the property or search profile you are interested in, the history of your inquiries, the viewings carried out and the status of the process.
• Economic and financial data: the details of the real estate transaction and the documentation on the source of funds that Law No. 19,574 requires us to collect as a reporting entity.

We do not process sensitive data within the meaning of article 4, letter E of Law No. 18,331. Please do not send us information about your health, beliefs, political or union affiliation or any other sensitive data, as we do not need it and will not record it.

3. What we use it for

• Answering your inquiries and following up on them.
• Presenting properties that match what you are looking for and arranging viewings.
• Managing our intermediation in the sale or lease, including the related documentation, and invoicing our services.
• Complying with the due diligence, record-keeping and reporting obligations imposed on us by Law No. 19,574.
• Sending you market news and properties that may interest you, only if you have consented to it and always with the option to unsubscribe.

4. Legal basis

The processing is based on your prior, informed and express consent, given when you send us the contact form, write to us on WhatsApp or do business with us. When the processing responds to a legal obligation —in particular the one arising from Law No. 19,574— the basis is that obligation and not your consent.

Giving your consent is voluntary, but without some of this data we cannot answer you or provide our service.

5. Who we share your data with

We do not sell or transfer your data for commercial purposes. We share it, free of charge and only to the extent strictly necessary, with:

• The notary public involved in the transaction.
• The counterparty to the transaction, with your knowledge.
• The financial institutions involved, when the transaction requires it.
• SENACLAFT and other competent public authorities, when the law requires us to.

In addition, technology service providers process your data on our behalf and under our instructions: our web hosting provider, Google —email, storage and notifications— and Meta, for WhatsApp messaging.

6. International transfers

Our systems are hosted on servers located in the United States, and the Google and Meta services we use also operate from that country. The United States is not on the list of countries with an adequate level of protection recognized by the Personal Data Regulatory and Control Unit (URCDP).

By accepting this policy you expressly consent to that international transfer, in accordance with article 23 of Law No. 18,331. We require our providers to make contractual commitments of confidentiality and security regarding the information they process on our behalf.

7. How long we keep it

We keep your data for as long as the business relationship lasts. Once it ends, we keep it for five years, the period that Law No. 19,574 requires of reporting entities. If your inquiry does not lead to a transaction, we keep your data for twenty-four months, unless you ask us to delete it earlier.

8. How we protect it

We apply technical and organizational measures to protect the confidentiality, integrity and availability of your information: access through individual credentials with differentiated permissions, two-factor authentication, encryption of communications and storage, automatic backups, audit logging and confidentiality clauses with our staff and agents.

If a security breach occurs that significantly affects your rights, we will inform you and notify the Personal Data Regulatory and Control Unit within 72 hours, in accordance with Decree No. 64/020.

9. Your rights

You have the right to access, rectify, update, include or delete your data. You may also object to receiving commercial communications at any time.

To exercise these rights, write to us at info@cupertino.uy, proving your identity. The procedure is free of charge. We will answer your access request within five business days, and if rectification or deletion is appropriate, we will carry it out within the following five business days.

If you believe we have not handled your request, you may file a complaint with the Personal Data Regulatory and Control Unit, at Liniers 1324, 4th floor, Montevideo, or through www.gub.uy/unidad-reguladora-control-datos-personales.

10. Minors

Our services are intended for people over 18 years of age. We do not knowingly collect data from minors. If we detect that we have received data from a minor without authorization from the person exercising parental authority, we delete it.

11. Cookies

This site uses first-party cookies, necessary for its operation, and third-party cookies for analytics and advertising purposes that are only activated if you accept them. You can accept them, reject them or change your choice at any time from the cookie notice, and you can also block them from your browser settings.

12. Changes to this policy

We may update this policy when our services or the applicable regulations change. The version in force is always the one published on this page, with its last updated date.