Privacy
policy.

Data controller

JANELAMBICIOSA, UNIPESSOAL LDA, tax number 519545737, registered at Rua Sacadura Cabral, n.º 16, 3.º, 6300-751 Guarda, Portugal.

Contact for data protection matters: privacidade@janelambiciosa.pt

The company has not appointed a data protection officer, as the conditions in Article 37 GDPR are not met. The address above is the dedicated channel for these matters.

Principle

We collect the minimum needed for each purpose, keep it for a defined period, and do not use it for anything not described here.

This website uses no non-essential cookies, has no third-party analytics, performs no profiling and loads no resources from external servers. Typefaces are served from our own domain precisely so that your visit is not reported to third parties.

Processing, by purpose

Contact, booking and documentation requests

Data: name, email, phone, company, country, service of interest, project size and the content of the message. Basis: pre-contractual steps at the data subject’s request (Article 6(1)(b) GDPR) or, where the request is not pre-contractual, your consent (point (a)). Retention: 24 months from last contact. The data is deleted at the end of that period.

Service delivery

Data: identification of the client, its representatives and beneficial owners, including copies of documents where required by law. Basis: performance of the contract (point (b)) and compliance with a legal obligation (point (c)), notably Portuguese Law 83/2017. Retention: for the periods imposed by law, counted from the end of the business relationship.

Invoicing and accounting

Data: name or company name, address, tax number and transaction data. Basis: legal obligation (point (c)). Retention: ten years.

Website security

Data: technical server logs, including IP address, request time and requested path. Basis: legitimate interest in the security of the service and prevention of abuse (point (f)). Retention: 30 days.

Strictly necessary cookies

This website only sets cookies when someone signs in to the administration area — a session cookie and a cross-site request forgery token. No cookies are set for visitors. See the Cookie Policy.

Recipients

Data is shared only with processors necessary to operations: website hosting, email service and accounting. All are bound by contract under Article 28 GDPR.

We do not sell personal data, do not release it for third-party marketing and do not use it for automated decisions with legal effects.

The current list of processors is available on request.

International transfers

The services we use host data within the European Economic Area. Should a transfer to a third country arise, it will be made under an adequacy decision or appropriate safeguards under Chapter V GDPR, and this policy will be updated.

Your rights

You have the rights of access, rectification, erasure, restriction of processing, objection and data portability. Where the basis is consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, write to privacidade@janelambiciosa.pt. We respond within one month; if the request is complex, we inform you of the extension and the reason within that period.

You may lodge a complaint with the supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD) Av. D. Carlos I, 134 – 1.º, 1200-651 Lisbon, Portugal www.cnpd.pt

Security

We apply appropriate technical and organisational measures: encryption in transit and at rest, two-factor authentication, access limited to those working on the project, and tested backups. In the event of a personal data breach posing a risk to data subjects, we notify the CNPD within 72 hours and inform those affected without undue delay.

The controls are described in detail in the Trust Center.

Changes

This policy may be updated. The date of the last revision appears at the top of the page. Material changes will be communicated to active clients.