Privacy policy

1. Data controller

1.1. The controller of personal data collected through www.hugorosa.pt is Hugo Rosa, who may be contacted on all data protection matters at contacto@hugorosa.pt.

1.2. Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, «GDPR») and Portuguese Law no. 58/2019 of 8 August.

2. Categories of data processed

2.1. Contact form: name, email address and the content of the message sent by the data subject.

2.2. Client Area: name, email address, password stored as a cryptographic hash, and the date of the last sign-in.

2.3. Browsing data: IP address, date and time of the request and equivalent technical information, logged automatically by the hosting server for security and diagnostic purposes.

2.4. No analytics, behavioural advertising or third-party tracking tools are used.

3. Purposes and lawful bases

3.1. Responding to enquiries and preparing quotations: steps taken at the request of the data subject prior to entering into a contract (article 6(1)(b) GDPR) and, where applicable, consent (article 6(1)(a)).

3.2. Managing the Client Area and delivering contracted content: performance of a contract (article 6(1)(b) GDPR).

3.3. Ensuring the security of the Website and preventing unauthorised access: legitimate interests of the controller (article 6(1)(f) GDPR).

3.4. Compliance with legal obligations to which the controller is subject (article 6(1)(c) GDPR).

4. Retention periods

4.1. Messages received through the contact form: up to 12 months after the last communication, unless a contractual relationship arises.

4.2. Client account data: for the duration of the contractual relationship and thereafter for the applicable statutory retention periods, or until the right to erasure is exercised.

4.3. Server logs: for the period determined by the hosting provider, typically no longer than six months.

5. Recipients and processors

5.1. Data is not sold, assigned or otherwise disclosed to third parties for marketing purposes.

5.2. Data is hosted on the infrastructure of the web hosting provider, acting as processor within the meaning of article 28 GDPR, with servers located in the European Union.

5.3. Fonts and other graphical resources are served from the Website's own infrastructure, so no data is communicated to external providers by reason of a mere visit.

5.4. Should the data subject choose to play embedded audiovisual content, data may be communicated to the hosting platform, subject to that platform's privacy policy.

6. International transfers

6.1. No transfers of personal data to third countries or international organisations outside the European Economic Area are envisaged.

7. Rights of the data subject

7.1. Under articles 15 to 22 GDPR, the data subject has the rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

7.2. These rights are exercised by written request to contacto@hugorosa.pt and will be answered within one month, extendable under article 12(3) GDPR.

7.3. The data subject also has the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or with the supervisory authority of their place of residence.

8. Security measures

8.1. The controller implements technical and organisational measures appropriate to the risk, pursuant to article 32 GDPR, including storage of passwords as cryptographic hashes, protection of private areas by authentication with temporary lockout after repeated failed attempts, encrypted transmission of data, and storage of original files outside the publicly accessible directory, access to which is mediated by a permission check.

9. Automated decision-making

9.1. No decisions based solely on automated processing, including profiling, producing legal effects concerning the data subject are taken.

10. Minors

10.1. Where services involve photographing minors, this is preceded by authorisation from the holder of parental responsibility, who likewise authorises any public disclosure of the images.

11. Amendments

11.1. This policy may be updated; the version in force is the one published on the Website, indicating the date of the latest update.