Privacy policy

1. Data controller

The data controller is [[PREENCHER: denominação social]], NIF (tax number) [[PREENCHER: NIF]], with registered office at [[PREENCHER: morada da sede]], Alenquer. For any question about your data, write to ola@casacomposta.pt.

2. What data we process

We process only the data needed for each purpose:

• Visit and partnership requests: name, email, phone number, area, description of the work and any photographs you choose to send.
• Clients: identification and billing details, property address, project documents (proposals, contracts, plans, invoices), project photographs, messages and payment records.
• Client area: login email, records of sign-ins and of relevant actions (for example, accepting a proposal), including date, time and IP address.
• Website browsing: only if you give consent, usage statistics collected by Google Analytics.

3. Purposes and legal bases

• Responding to visit, contact and partnership requests — pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Preparing proposals and entering into and performing construction contracts, including the client area — performance of a contract (point (b)).
• Invoicing and compliance with tax and legal obligations — legal obligation (point (c)).
• Email notifications about your project — performance of a contract (point (b)); WhatsApp notifications — consent (point (a)), which you may withdraw at any time.
• Security of the website and client area, prevention of misuse and audit logging — legitimate interest (point (f)).
• Publishing a project in the portfolio — express, written consent (point (a)).
• Website usage statistics — consent (point (a)), given through the cookie panel.

4. How long we keep it

• Visit requests that do not lead to a project: [[PREENCHER: prazo — proposta: 24 meses]] after the last contact.
• Client data and project documents: for the duration of the project and the warranty period, plus [[PREENCHER: prazo — proposta: 1 ano]].
• Invoices and tax documents: 10 years, as required by law.
• Consents: while they remain in force and for as long as necessary to demonstrate that they were given.

5. Who has access to your data

Your data is accessed only by the members of the Casa Composta team who need it. The specialists we coordinate receive only the information needed for the work, are bound by a duty of confidentiality and do not keep copies.

We use the following service providers (processors), under contracts that guarantee the protection of your data:

• Platform and database hosting: [[PREENCHER: fornecedor do servidor]], in a data centre in Spain.
• File storage: Wasabi Technologies, in a data centre in France.
• Email and digital signature: our own services, hosted on our own infrastructure.
• Drafting of contracts: Anthropic (Claude API), which receives the proposal and project data solely to generate the draft, which is always reviewed by a person at Casa Composta. Transfer to the USA under standard contractual clauses.
• WhatsApp messages, where consented to: WhatsApp (Meta Platforms).
• Website statistics, where consented to: Google Analytics (Google Ireland), with transfers under the EU–US Data Privacy Framework.

6. Security

Sensitive data (addresses, notes, descriptions) is stored encrypted. Files are held in private storage and can be accessed only through temporary links, once authorisation has been verified. Access to the administration area requires two-factor authentication. Uploaded photographs are stripped of location data.

7. Your rights

You may at any time request access to your data, or its rectification, erasure, restriction of processing or portability, and object to processing based on legitimate interest. You may also withdraw consent, without affecting the processing carried out up to that point.

To exercise these rights, write to ola@casacomposta.pt. We reply within one month.

You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority (www.cnpd.pt).