Privacy policy

Luís Correia, sole trader (trading as Estorva), tax number 236404474. For anything about your data: hello@estorva.com. The full address is on the Legal information page.

• Quote requests and enquiries. Name, email, company, phone (if given) and what you tell us about the project. We use this to reply and prepare a proposal. Legal basis: steps taken at your request before a contract (GDPR art. 6(1)(b)).
• Clients. Contact and billing data needed to deliver the project and issue invoices. Legal basis: performance of the contract and legal obligations (art. 6(1)(b) and (c)).
• Technical logs. The server hosting the site logs data such as IP address, date and time and requested page, for security and operation. Legal basis: legitimate interest in keeping the site secure (art. 6(1)(f)).

• We don’t turn on analytics or marketing tools without your consent (see the Cookie policy).
• We don’t sell or share data with third parties for marketing.
• We don’t send newsletters without your explicit consent.
• We don’t make automated decisions that affect you.

If you accept in the cookie banner, we use Google Tag Manager and Google tools (such as Google Analytics) to measure visits and campaigns. Legal basis: your consent (GDPR art. 6(1)(a)), which you can withdraw at any time under “Cookie preferences”. Details are in the Cookie policy.

• Requests that didn’t lead to a project: up to 24 months after last contact.
• Billing records: 10 years, as required by tax law (CIRC art. 123 and CIVA art. 52).
• Server logs: up to 12 months.

We use providers that process data on our behalf, under contract and only for the service they provide: website hosting, email, invoicing and, only with your consent, visit measurement (Google). If any of them processes data outside the European Economic Area, we rely on the safeguards set out in the GDPR, such as adequacy decisions or standard contractual clauses. You can ask us for the current list.

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest (GDPR arts. 15–22). Write to hello@estorva.com. We reply within one month.

If you think we mishandled your data, you can complain to the CNPD: cnpd.pt.

The site uses an encrypted connection (HTTPS) and access to data is limited to those who need it. If a data breach puts you at risk, we notify the CNPD within 72 hours and, where the risk is high, we notify you too (GDPR arts. 33 and 34).

If this policy changes, we publish the new version here with its effective date.