Privacy Policy

1. Data controller

The controller of the data described in this policy is the entity identified in the company identification section at the bottom of this page, which operates under the WebCastelo brand.

For any privacy question you may use the contact details indicated in that same section.

2. Categories of personal data

Depending on how you interact with us, we may process:

• contact data: name, company, email, telephone and preferred language;
• request content: project description, indicative budget, timelines and answers given in the Find a Solution and Website Analysis tools;
• account data: email address, account status and authentication records for the client portal;
• contractual data: proposals, electronic acceptances with date and time, projects, milestones and approvals;
• billing data: billing details, tax number where applicable, invoices, payment status and payment references;
• support data: tickets, messages and files you send us;
• technical data: IP address, device and browser type, and security and error logs;
• usage data: aggregated browsing statistics, only when you authorise analytics.

3. Source of the data

In most cases the data is provided directly by the data subject, through a form, an email, a portal account or during the execution of a project.

Some technical data is generated automatically by the systems that ensure the website's operation and security.

4. Purposes and legal bases

We process personal data on the following legal bases:

• performance of the contract or pre-contractual steps: responding to requests, preparing proposals, carrying out projects, providing support and managing the client portal;
• legal obligation: issuing and retaining invoices and complying with tax and accounting obligations;
• legitimate interest: system security, prevention of abuse, evidence of contractual acceptances, service improvement and direct commercial communication with existing clients, always with the possibility to object;
• consent: cookies and equivalent analytics and marketing technologies, and marketing communications directed at those who are not clients.

5. Client portal, proposals and payments

The client portal gives access to projects, proposals, invoices, service requests and support tickets. Access is personal and protected by authentication.

When you accept a proposal electronically, we record the account identification and the date and time of acceptance, as proof that the contract was concluded.

Card payments are processed by an external payment provider. Full card details are never received or stored by WebCastelo. We receive only the payment status and the references needed for billing.

6. Uploaded files

Files that you send in service requests or support tickets are stored in association with the relevant case and are accessible only to the team that needs them.

Do not send sensitive personal data or third-party information that you are not authorised to share.

7. Cookies and analytics

The website uses technologies strictly necessary for its operation and, only with your consent, analytics or marketing technologies.

No optional script is loaded before consent exists. Details are set out in the Cookie Policy, where you can also change or withdraw your decision at any time.

8. Recipients and processors

We use providers that act on our behalf and under written instructions, in particular for hosting and database, transactional email delivery and payment processing.

We only list a provider as active when it is actually in use. Analytics and advertising services are only used once configured and authorised by the visitor.

Data may also be disclosed to accountants, auditors or authorities, where required by law.

9. International transfers

We prefer providers that host data within the European Union. Where a provider processes data outside the European Economic Area, the transfer is carried out under a mechanism provided for in the General Data Protection Regulation, such as the European Commission's standard contractual clauses.

10. Retention periods

We retain data only for as long as necessary:

• requests that do not result in a contract: up to twenty-four months;
• contractual and project data: for the duration of the relationship and the applicable limitation period;
• invoices and accounting documents: for the legal retention period applicable in Portugal;
• support tickets: up to five years after closure;
• technical and security logs: normally up to twelve months;
• cookie consent record: up to one year or until you change it.

11. Your rights

Under applicable law, you may exercise the following rights:

• access to your personal data;
• rectification of inaccurate or incomplete data;
• erasure, where there is no basis to continue processing;
• restriction of processing;
• portability of the data you have provided to us;
• objection to processing based on legitimate interest;
• withdrawal of consent at any time, without affecting the lawfulness of prior processing.

12. Complaints

If you consider that the processing of your data does not comply with the law, you may lodge a complaint with the competent supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (National Data Protection Commission). Clients located in other countries may also address their complaint to their local supervisory authority.

We would appreciate it if you contacted us first, so that we can try to resolve the matter directly.

13. Security

We apply technical and organisational measures appropriate to the risk, such as encrypted connections, role-based access control, separation between environments, logging of administrative access and regular updates.

In the event of a personal data breach likely to result in a high risk, we comply with the notification duties set out in the law.

14. Minors

Our services are aimed at businesses and professionals. We do not knowingly collect data from minors.

15. Changes to this policy

This policy may be updated to reflect changes in the services or in the law. The date of the last update is shown at the top of the page.

16. Contacts

To exercise your rights or ask questions about privacy, please use the contact details indicated at the bottom of this page. We may request additional information to confirm your identity before responding.