Privacy Policy

1. Data Controller

Filipe Gonçalo Sousa Macau (sole trader), the data controller for this website.

• Tax number (NIF): 245019731
• Address: Travessa Escola Velha, n.º 4, 3420-136 Midões
• Email for privacy matters: [email protected]
• Phone: +351 930 634 442 (call to national mobile network)

2. Scope and principles

This policy applies to the personal data processed through the website filipemacau.com and related services, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Portuguese Law no. 58/2019. We process data lawfully, fairly and transparently, limiting it to what is necessary.

3. What we collect and why

3.1 Contact form

• Data: name, email, phone (optional) and your message.
• Purpose: to reply to the contact you started.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Retention: up to 12 months after the last interaction, unless the contact leads to a service.

3.2 Quote request

• Data: area(s) of interest, services, project description, urgency/deadline, name, email, phone and company (optional).
• Purpose: to prepare and send you a proposal.
• Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Retention: up to 12 months; if the request leads to a service, billing data is kept for 10 years (Portuguese tax law).

We do not use your data for automated decision-making, profiling or advertising tracking. With your prior consent, we use Google Analytics 4 and Microsoft Clarity to measure aggregate website usage and behaviour (heatmaps and session replay, with text and inputs masked) — the legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. See our Cookie Policy.

4. Where your data is stored

Submissions are stored in this website's database and we are notified by email. Both the hosting and email run on servers located in the European Union (Hostinger). Internal alerts sent via Telegram do not contain your personal data — only a notice that a new message arrived.

5. Sharing with third parties

We never sell or rent personal data. If you contact us via WhatsApp, your data (number, messages and metadata) is also processed by Meta and may be transferred to the USA under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). You can always use email or phone instead.

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability, objection and to withdraw consent at any time (Articles 15–21 GDPR). To exercise them, email [email protected]. We reply within 30 days and may verify your identity first.

7. Complaints

You may lodge a complaint with the Portuguese supervisory authority: CNPD — Comissão Nacional de Proteção de Dados, www.cnpd.pt.

8. Security

We apply appropriate technical and organisational measures: HTTPS/TLS, hashed passwords, two-factor authentication on the admin area, access control and regular backups. In the event of a personal data breach posing a risk, we notify the CNPD within 72 hours (Art. 33 GDPR).

9. Minors

This website is not directed at children under 13. If we become aware that we have collected such data without parental consent, we will delete it (Art. 16 Law 58/2019).

10. Cookies

This website only uses strictly necessary cookies. See our Cookie Policy.

11. Changes

We may update this policy. Material changes will be shown on the website and the date at the top will be updated.