Política de Privacidade | Kleya - Relocação, Reforma, Investimento e Mudança para Portugal

Privacy, Safety and Data Protection Policy

Kleya is committed to protect the privacy of its Clients and the Users of its websites. In this context, this Privacy, Safety and Data Protection Policy was prepared to affirm this commitment and respect for the rules of privacy and protection of personal data.

Thus, and when in this Privacy Policy we refer to Kleya, we are referring to a consultant who can be trusted by foreign nationals that wish to retire, live or invest in Portugal.



We want our clients and users to know the general rules regarding privacy and the handling of the data that we store in strict respect and compliance with European legislation, specifically the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 - GDPR).

Kleya seeks to respect best practices in matters of safety and the protection of personal data, through the promotion of actions and improvements to systems that ensure the protection of the data provided by our Clients and Users.

The use of our websites, products and digital services, the completion of our forms and providing data directly, imply the knowledge of this privacy and safety policy and the acceptance of the General Terms, Policies and Conditions of Use and of other specific terms, policies and conditions of the subscribed services. Upon subscribing to our services, carefully read the respective terms and conditions. Upon providing your personal data, you authorize the registration, handling, use and disclosure of these in accordance with the rules defined herein.


Who is responsible for data management?

References in this Privacy Policy to "Kleya", "we", "us" or "our" shall mean the following entity:

  • Kpl - Kleya Premium Living, Unipessoal Lda

Address: Praça Príncipe Perfeito n°2, 1990-278 Lisboa

Tax Number: 513502416

Contact: +351 211 214 983


This entity will be the data controller in accordance with the General Data Protection Regulation.


Kleya provides this service and within this context adequately decides, always in strict compliance with the Personal Data Protection Law, which data will be recorded, the means for handling this data and the format and purpose for which these are used.

Kleya may record your data by telephone, in writing or through its website and applications. As a rule, personal data are recorded when Client registers for one of our products or services, or when an order or contact is made through our website or through our Customer Service Centre.

The supply of some personal data is obligatory because it is necessary for the performance of the contract, and in the event that this data is lacking or is insufficient, Kleya may not render the service or supply the product in question. In these cases, the Client or user will be duly informed regarding the obligatory nature of this data to continue the process.

The recorded personal data are handled electronically and in strict compliance with the Personal Data Protection Law, and these are stored in specific databases created for this purpose.


What are personal data?

Personal data includes any information collected by us, or supplied by the Client or user, regardless of the means used for such collection, including sound and images, for individuals which allow themselves to be identified.

Personal data is considered to be any information about an individual who is identified, or becomes identifiable, by means of such information, and whose identification can occur directly or indirectly, specifically through an identification number, name, date of birth, telephone, e-mail, address or other elements.

All personal information that Kleya may collect when the Client or user visit the website are: (i) necessary for the performance of the contract/relationship to which the client is party or in order to take steps at the request of the client prior to entering into a contract/relationship; (ii) collected with prior consent from the Client or user; (iii) necessary for compliance with a legal obligation to which Kleya is subject (iv) necessary for the purposes of the legitimate interests pursued by the controller or by a third party. All of the data are treated in conformance with GDPR and the Portuguese law (Lei nº 58/2019, de 08 de Agosto). The present data protection policy is in line with the guidelines by which Kleya is governed, actively committed to respect the privacy of its clients and users.


What type of personal data do we process?

Kleya records and handles personal data which is required for the rendering of services and/or the registration for features, products, services, or communication, including in this scope data such as:

  • Your name, identification and contact details (email address, telephone number and postal address)

Some personal data is mandatory and, in case of lack or insufficiency of such data, Kleya will not be able to provide the product or service in question. In such cases, the Customer or user will be duly informed of the obligation to provide such data. Applicable when you subscribe to a plan or create an Account on our sites.

  • Data concerning the subscribed plan of services such as client number, gender, profession, recreational activities, education data, vehicle data...

Some personal data is mandatory and in case of lack or insufficiency of such data Kleya will not be able to provide the product or service in question. In such cases the Customer or user will be duly informed of the obligation to provide such data. Applicable when subscribing to a plan.

  • Information about other people (including children)

When providing data to third parties, you should ensure that you have been authorized by them to provide us with their personal data, as well as inform them of the way in which Kleya processes personal data in accordance with this Policy.

When subscribing products, we may process personal data of the household or other people included in the service, which has been provided to us by the plan owner.

Kleya is particularly concerned with the protection of the rights of minors and therefore the collection of personal data of people under 18 years of age is subject to the consent of their parents/guardians. For this purpose, when collecting data from minors, the consent of the parents/guardians of the minors will be requested.

  • Information about your transaction, including financial data

In order for us to process the services payments.

  • Communications that you exchange with us (for example, your emails, letters, phone calls to the Contact Center or communications by Whatsapp)

Applicable when you contact Kleya or are contacted by Kleya.

  • Your opinion about us

Applicable when you participate in our satisfaction surveys/questionnaires.

  • Information about how you use our websites or applications

Applicable when you use our websites or applications in accordance with our Terms and Conditions of Use of Tracking Technologies (cookies).

  • When you make a complaint

In order for us to process your complaint.


Kleya also records traffic and localization data with prior consent from the Client or user, without prejudice to the fulfilment of legal standards.


For what purposes are personal data used?

The personal data supplied or collected are generally used to:

  • Sign up a new private account on Kleya’s website (legal basis: performance of a contract or steps prior to entering into a contract)
  • Provide our products and services, during the rendering of contracted, registered or reserved services (legal basis: performance of a contract or steps prior to entering into a contract)

We use your above information to provide our products and services.

  • Communicate and manage our relationship with you, including complaints or suggestions management (legal basis: performance of a contract or steps prior to enter into a contract)

Occasionally, we may contact you by e-mail, phone call or SMS for administrative or operational reasons, for example, in order to send you confirmation of your payments as well as to inform you about complaints processing. As these communications are not undertaken for marketing purposes, you will continue to receive them even if you have opted out of marketing communications. We will also use your personal data to respond to your requests, suggestions or contacts, to improve our services and your customer experience.

  • Inform you about news and offers of interest to you (legal basis: consent)

We may send you marketing communications if you have indicated that you wish to receive them. If you agree to receive marketing communications, we will send you newsletters with news from us, such as new products you may be interested in or offers you may like. Please note that we do not share your personal data with other companies for marketing purposes unless we have your consent to do so. If you do not wish to receive further marketing communications from us, simply click the unsubscribe link at the bottom of any Kleya marketing communication.

  • Improve our services and meet our business and administrative goals (legal basis: legitimate interests)

The business purposes for which we use your information include accounting, billing and auditing, security, legal and procedural purposes, statistical studies, as well as systems development and maintenance.

  • Comply with our legal obligations (legal basis: compliance with a legal obligation)

In particular, the obligation to provide your personal data to the Tax Authority.


For how long is your personal data stored?

The personal data collected is treated in strict compliance with the applicable legislation, and is stored in specific databases created for this purpose. The period for which the data is stored and retained varies according to the purpose for which the information is used. The data necessary for the provision of the subscribed products and services will be kept for as long as you maintain your relationship with us, unless we are obliged by legal requirements to keep the data for a longer period.

With regard to the processing of personal data for which your consent is required (i.e. marketing), the data will be kept until you revoke your consent.


What are the Data Subjects Rights?

In accordance with the provisions of the GDPR, the owner of the data is guaranteed, at any time:

  • The right to be informed - The data subject has the right to receive information about the terms of processing of his or her personal data at the time of collection of the data or, if the data is not collected from the data subject himself or herself, within a reasonable time after obtaining the personal data, unless exceptions provided in the GDPR.
  • The right to access - The data subject has the right to obtain confirmation as to whether or not personal data are being processed and, where appropriate, the right to access his/her personal data, as well as information regarding the purposes of processing, the categories of personal data concerned, the recipients of the data, and the expected period of retention, among others.
  • The right to rectification - You have the right to obtain, without undue delay, the rectification or updating of inaccurate personal data concerning you.
  • The right to erasure - The data subject has the right to obtain the erasure of his or her personal data, without undue delay, within the limits provided by law.
  • The right to restriction of processing - The data subject has the right to obtain the limitation of processing if one of the conditions in the GDPR applies.
  • The right to data portability - The data subject has the right to receive the personal data concerning him/her that he/she has provided in a structured, commonly used, and machine-readable format.
  • The right to object - The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her, in particular where his or her data are processed for the purposes of direct marketing.
  • The right not to be subject to a decision based solely on automated processing - The data subject shall have the right not to be subject to a decision taken solely on the basis of the automated processing of his or her personal data, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

You may request, at any time, the exercise of the rights listed above (with the exception of data strictly necessary for the provision of the service) by e-mail to privacidade@kleya.eu.

Without prejudice to any other administrative or judicial appeal, the data subject has the right to lodge a complaint with the CNPD or other supervisory authority competent under the law, if he or she considers that his or her data is not being legitimately processed by Kleya, in accordance with applicable law and this Policy.


Under what circumstances is there data communication with other entities?

Kleya may utilize other entities for the rendering of specific services. Eventually these services may imply access by these entities to the personal data of Clients and/or users.

Thus, any entity subcontracted by Kleya will handle the personal data of our Clients and/or users, in the name of and on behalf of Kleya, under strict obligation to adopt the measures required to ensure the protection of the personal data from destruction, whether accidental or illicit, accidental loss, change, disclosure or unauthorised access, and from any other form of illicit handling.

Kleya seeks to ensure that these processors are carried out with the highest guarantees in terms of safety and reputation.

The Client or user data may need to be preserved and communicated for the use of the competent authorities, in compliance with legal obligations, in the event that Kleya is notified by these entities to supply these, always in strict compliance with GDPR.


In what circumstances can your personal data be transferred?

The rendering of specific services by Kleya may result in the transfer of your data out of Portugal. 

In such a case, Kleya will rigorously comply with the applicable legal dispositions in respect to the protection of personal data and the applicable requirements to such transfers, namely by informing the Client or user.


What are the security measures adopted by Kleya?

Kleya is committed to ensure the confidentiality, protection and security of its clients' personal data by implementing appropriate technical and organizational measures to protect their data against any form of improper or illegitimate processing and against any accidental loss or destruction of such data.

Because we recognize the sensitivity of this subject, we have drawn up and disclosed a Personal Data Protection Policy to all our employees, in order to ensure that they are aware of the obligations imposed on them in this regard. To ensure the ongoing awareness of our employees, we have also developed training sessions for them, who undertake to not disclose to third parties or use for purposes contrary to law, any personal information of Kleya customers that they learn while performing their work duties.

In this context, Kleya has also appointed a Data Protection Officer ("DPO") to monitor compliance with applicable policies and standards on personal data protection.


How can I clarify any doubt about data protection?

You may contact the Data Protection Officer ("DPO") of Kleya at dpo@kleya.eu. For further information about the actual processing of your Personal Data, as well as any questions related to the exercise of your rights under applicable law, and in particular those referred to in this Policy, you may contact the Controller by e-mail at privacidade@kleya.eu

How can I be informed of any changes of this Policy?

Kleya reserves the right to make changes or updates to its Privacy, Safety and Data Protection Policy at any time, and these changes will be duly updated on this page. We suggest that you regularly consult it to be aware of any eventual changes.


Date: 22/06/2022