Privacy policy

Luís Correia, sole trader (trading as Estorva), tax number 236404474. For anything about your data: hello@estorva.com. The full address is on the Legal information.

• Quote requests and enquiries. Name, email, company, phone (if given) and what you tell us about the project. We use this to reply and prepare a proposal. Legal basis: steps taken at your request before a contract (GDPR art. 6(1)(b)).
• Clients. Contact and billing data needed to deliver the project and issue invoices. Legal basis: performance of the contract and legal obligations (art. 6(1)(b) and (c)).
• Technical logs. The server hosting the site logs data such as IP address, date and time and requested page, for security and operation. Legal basis: legitimate interest in keeping the site secure (art. 6(1)(f)).

• We don’t use analytics tools, advertising pixels or tracking cookies.
• We don’t sell or share data with third parties for marketing.
• We don’t send newsletters without your explicit consent.
• We don’t make automated decisions that affect you.

• Requests that didn’t lead to a project: up to 24 months after last contact.
• Billing records: 10 years, as required by tax law (CIRC art. 123 and CIVA art. 52).
• Server logs: up to 12 months.

We use providers that process data on our behalf, under contract and only for the service they provide: website hosting, email and invoicing. If any of them processes data outside the European Economic Area, we rely on the safeguards set out in the GDPR, such as adequacy decisions or standard contractual clauses. You can ask us for the current list.

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest (GDPR arts. 15–22). Write to hello@estorva.com. We reply within one month.

If you think we mishandled your data, you can complain to the CNPD: cnpd.pt.

The site uses an encrypted connection (HTTPS) and access to data is limited to those who need it. If a data breach puts you at risk, we notify the CNPD within 72 hours and, where the risk is high, we notify you too (GDPR arts. 33 and 34).

If this policy changes, we publish the new version here with its effective date.