Personal data,
with a legal basis.

Data controller

JANELAMBICIOSA, UNIPESSOAL LDA is the controller for personal data collected through this website and in the course of client and supplier relationships. Privacy contact details are at the end of this page.

The company has not appointed a data protection officer, as the conditions in Article 37 GDPR are not met. A dedicated contact for these matters exists nonetheless.

What data, and on what basis

Contact and booking requests. Name, email, phone, company, country and the content of the message. Basis: pre-contractual steps at the data subject’s request, or consent where the request is not pre-contractual. Retention: 24 months from last contact.

Service delivery. Identification data for clients, their representatives and beneficial owners. Basis: performance of the contract and compliance with legal obligations, notably anti-money-laundering. Retention: for the applicable statutory periods, counted from the end of the relationship.

Invoicing and accounting. Tax data and supporting documents. Basis: legal obligation. Retention: ten years.

Website security. Technical server logs, including IP address, for abuse detection and rate limiting. Basis: legitimate interest in the security of the service. Retention: 30 days.

This website uses no non-essential cookies, has no third-party analytics and performs no profiling.

Who it is shared with

Data is shared only with processors necessary to operations — hosting, email, accounting — all bound by an agreement under Article 28 GDPR. We do not sell data, do not release it for third-party marketing and do not transfer it outside the European Economic Area without appropriate safeguards.

The current list of subprocessors is available on request.

Your rights

You have the right to access your data, to have it rectified or erased, to restrict or object to processing, and to data portability. Where the basis is consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.

We respond within one month. If a request is complex, we tell you about the extension and the reason within that same month.

You may also lodge a complaint with the supervisory authority: the Portuguese Data Protection Authority (CNPD).

Record of processing activities

We maintain the record required by Article 30 GDPR, listing purposes, categories of data subjects and data, recipients and retention periods. It is provided to institutional clients who request it as part of due diligence.