Privacy Policy

1. Data controller

The controller responsible for personal data on this website is:

2. Data processed

The following data may be processed:

• name, email address and message provided through the contact form or by email;
• technical browsing data needed to operate and secure the website, such as IP address, access date and time, requested pages, browser and device type, and server logs.

The form does not directly send or store data in a website database. Submitting it creates a message in the visitor's email application; data is only sent when that person chooses to send the email.

3. Purposes and legal bases

• Replying to messages, enquiries and quote requests — legitimate interests in managing communications and professional opportunities (Article 6(1)(f) GDPR) and, where an enquiry concerns hiring services, pre-contractual steps requested by the data subject (Article 6(1)(b)).
• Operating, protecting and securing the website — legitimate interests in providing a secure website and preventing misuse (Article 6(1)(f)).
• Measuring traffic and improving content through analytics cookies or similar technologies — prior consent (Article 6(1)(a)), which may be refused or withdrawn at any time without affecting the lawfulness of earlier processing.

4. Cookies and Google Analytics

The website does not currently use Google Analytics or activate analytics or marketing cookies. Only technologies strictly necessary for operation and security may be used; these do not require consent when limited to that purpose.

If Google Analytics is installed in the future, it will not load before the visitor gives consent through a dedicated banner. This policy will be updated with the cookies, data, duration and settings actually used. Google Ireland Limited will provide the service; processing may occur in the United States under applicable transfer mechanisms, including the EU–US Data Privacy Framework and/or Standard Contractual Clauses, as applicable.

5. Recipients and international transfers

Data may be processed by providers strictly necessary to deliver the service and subject to confidentiality and data-protection obligations: the email provider used to receive messages and Vercel Inc., which hosts and serves the website.

Vercel may process data in the United States and other countries where it operates. Under its terms, it uses appropriate international-transfer mechanisms, including the EU–US Data Privacy Framework and Standard Contractual Clauses approved by the European Commission. Data is not sold.

6. Retention

• Enquiries and quote requests: for as long as needed to reply and follow up, up to 24 months after the last communication, unless a contractual relationship or legal duty requires longer retention.
• Technical logs: for the period set by the hosting provider and only as long as necessary for security, diagnostics and service operation.
• Future analytics data: for the period disclosed in the banner and this policy before analytics is activated.

7. Your rights

Where applicable, data subjects may request access, rectification, erasure, restriction and portability of their data, object to processing based on legitimate interests, and withdraw consent. These rights can be exercised through hello@alexandrabarbosa.pt. Information needed to confirm identity may be requested.

You may also lodge a complaint with the Portuguese Data Protection Authority (CNPD).

8. Security and changes

Technical and organisational measures appropriate to the risk are used to protect data against unauthorised access, alteration, disclosure or loss. However, no online transmission or storage can guarantee absolute security.

This policy may be updated to reflect legal, technical or service changes. The date of the latest version will always appear at the top of this page.