Privacy policy

Who handles the data

Henrique Santiago Carrageis Ribeiro, reachable at [email protected].

What I collect

From someone who only visits, what they write in the contact form: name, business name, email, a phone number if they leave one, and the message. There is no account to create and I don’t ask for payment details on this site. Whoever becomes a client gets an access code to the portal, and what is kept there is in the next section.

The portal and signing contracts

Anyone with a project with me enters a portal with an access code. That is where the messages, the files we exchange and, if there is a contract, the record of the signature are kept: the name and the tax number (NIF) you type, the email it was sent to, the date and time, the network address you signed from, the browser you used and the declarations you made. That record exists because it is what proves who signed what, and the law puts that proof on me. The legal basis is the performance of the contract and compliance with legal obligations.

What it is for

To reply to your request and prepare a quote. I don’t use this data for advertising and I don’t sell it to anyone.

Cookies and statistics

This site sets no advertising or traffic-analysis cookies, and nothing in your browser follows you from one visit to the next. I count visits with a program that runs on my own server, GoatCounter. What it keeps are totals, not visits: how many times each page was opened in each hour, which sites people came from, what kinds of browser and which countries. There is no record per person. The IP address is not stored, there is no browser identifier and no cookies are set; the country is worked out from the address at that moment and the address is not kept anywhere. This data does not leave this server and is not shared with anyone. The hosting logs requests to the server, as any server does, for operation and security.

Who else touches it

The site runs on a server of mine, in Portugal. In front of it is Cloudflare, which handles the DNS, the certificate and the forwarding of the domain’s email, and the form’s emails are delivered by Brevo, based in the European Union. The request you write is kept on that server and also reaches me by email, which I read in Gmail. All of these handle the data on my behalf and only to deliver it.

How long it is kept

Contact requests are kept for 24 months and deleted after that. If you ask for them to be deleted earlier, I delete them as soon as the request arrives.

Signed contracts, signing certificates and invoices are kept for 10 years, which is the period tax law requires, and during that time I cannot delete them on request. Everything else in the portal I delete 30 days after the contract ends and I have handed over the data.

Your rights

You can ask to see, correct or delete the data you sent me, and you can object to its processing. Write to [email protected] and I’ll reply. If you think I didn’t handle the matter as I should have, you can complain to the Comissão Nacional de Proteção de Dados, the Portuguese data protection authority (cnpd.pt).