Privacy policy

1. Data controller

João Dias Gaiteiro, trading as JoaoDG, Portuguese tax number (NIF) 257842250, address Vila Nova de Gaia, Portugal, who can be reached at [email protected]. No data protection officer (DPO) has been appointed; any question about your data is handled through this email.

2. What data we process, why and on what legal basis

• Contact and proposal requests (contact form, email or WhatsApp): name, email, telephone (optional), the service chosen and the message. Used to answer your request and, if you ask for it, to prepare a proposal. Legal basis: pre-contractual steps at your request (Article 6(1)(b) GDPR) and, for questions not aimed at a contract, our legitimate interest in answering those who write to us (Article 6(1)(f)).
• Clients: identification, billing and communication data needed to provide the contracted service and to invoice. Legal basis: performance of the contract (Article 6(1)(b)) and compliance with legal obligations, namely tax obligations (Article 6(1)(c)).
• Visit statistics (on joaodg.pt only): aggregated page view counts through GoatCounter, without cookies and without storing the IP address. Legal basis: legitimate interest in knowing which pages are useful (Article 6(1)(f)).
• Server logs: IP address, date, page requested and browser, for security and to diagnose errors. Legal basis: legitimate interest in the security of the website (Article 6(1)(f)).

The form data are those needed to answer you: without a valid email we cannot do so. We do not take automated decisions or carry out profiling.

3. Retention periods

• Contact and proposal requests: 24 months after the last contact, unless you become a client in the meantime.
• Client and billing data: 10 years from the end of the year to which they relate (tax obligation).
• Server logs: 14 days.
• Statistics: kept in aggregated form only, without identifying who visited.

4. Processors and recipients

Your data are not sold or disclosed for marketing. They are processed on our behalf, under a data processing agreement, by:

• Hetzner Online GmbH (Germany): servers hosting the website, the client area that receives the forms (app.joaodg.pt) and email.
• Cloudflare, Inc. (USA): content delivery and protection network through which the website traffic passes.
• Plus Five Five, Inc. (Resend) (USA): sending the notification emails for requests received.
• GoatCounter (Hetzner servers in Finland and Germany): visit statistics.
• Stripe Payments Europe, Ltd. (Ireland): payments made in the client area.

If you ask to see the Instagram posts on the home page, your browser connects directly to Behold (behold.so), which receives your IP address. If you contact us via WhatsApp, the message also passes through Meta, under WhatsApp's privacy policy. For the social media management service, the data obtained through Meta are described in the social media privacy policy.

5. Transfers outside the European Economic Area

Cloudflare and Resend are in the USA. Both are certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, in addition, their data processing agreements include the European Commission's standard contractual clauses.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection (in particular to processing based on legitimate interest). Where the legal basis is consent, you may withdraw it at any time, as easily as you gave it. To exercise any right, write to [email protected]; we reply within one month. You also have the right to lodge a complaint with the CNPD, the Portuguese data protection authority (www.cnpd.pt).

7. Cookies

What this website stores on your device is listed, item by item, in the Cookie policy.