// en/privacy-policy
Privacy Policy
Which personal data this site processes, why, for how long and how to exercise your rights (GDPR).
Last updated:
This policy explains how the personal data of people who visit this website or contact me through it is processed, under the General Data Protection Regulation (Regulation (EU) 2016/679 — “GDPR”) and Portuguese Law no. 58/2019 of 8 August.
1. Data controller
The controller of personal data is:
| Field | Details |
|---|---|
| Name | Daniel Jesus — sole trader (self-employed) |
| Tax number (NIF) | 222537914 |
| Address | R. Eng. José Bastos Xavier, 16, C.C. Diana, LJ 1.07, 3750-144 Águeda |
| [email protected] | |
| Phone | +351 919 573 821 (call to a Portuguese mobile network) |
No data protection officer (DPO) has been appointed, as one is not required for this activity. For any question about personal data, contact [email protected].
2. What data we process, why and on what legal basis
Only the data needed for each purpose is processed. The table below reflects the features actually enabled on this site.
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Answering contact requests and preparing proposals | Name and e-mail; phone and company (optional); subject, indicative budget, message, page and visit source (referrer/UTM), IP address and browser (security and anti-spam), date of consent | Pre-contractual steps at your request (Art. 6(1)(b)) and legitimate interest in replying and preventing abuse (Art. 6(1)(f)) | Up to 24 months after the last contact, unless it leads to a contract |
| Managing offers for and purchases of domain names and communicating with you during the negotiation | Name and e-mail; phone and company (optional); offer amount and message, negotiation history, hashed IP address and browser, date of consent | Pre-contractual steps and performance of the contract (Art. 6(1)(b)); legitimate interest in security (Art. 6(1)(f)); after a sale, legal invoicing obligations (Art. 6(1)(c)) | Automatically anonymised after 24 months without activity; invoicing data for a sale for the legally required period |
| Collecting and publishing client reviews (testimonials) | Name, e-mail (never published), company, role, rating, text, photo (optional), hashed IP address, date of consent | Consent (Art. 6(1)(a)), which you can withdraw at any time | Until you withdraw consent |
| Asking clients for reviews by e-mail | Client name, e-mail, company and project; date sent, opened and reminder | Legitimate interest in the relationship with existing clients (Art. 6(1)(f)) | The link expires after 30 days; the request record is kept until deleted or until you request deletion |
| Download statistics and abuse prevention | IP address as a daily hash, country (when provided by the proxy), referring domain, summarised browser and OS, device type | Legitimate interest (Art. 6(1)(f)) | 365 days (automatic deletion) |
| Measuring site usage with Google Analytics | Cookie identifiers, page views and events, technical device and browser data, approximate location derived from the IP address | Consent (Art. 6(1)(a)) and Article 5 of Portuguese Law no. 41/2004 | Cookies up to 2 years; data in Google Analytics for the retention period set in the account |
| Recording and evidencing your cookie choices | Random identifier, choices per category, policy version, date, IP address as a daily hash | Legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR) | For as long as needed to demonstrate consent |
| Site security (firewall, rate limiting, abuse blocking) | IP address, request method and path, browser, rule triggered | Legitimate interest in network and information security (Art. 6(1)(f)) | 90 days (firewall logs); temporary blocks until they expire |
| Service and sales contracts, invoicing and tax obligations | Identification, tax number, address, contact details, invoicing and payment data | Performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) | For the duration of the contract and then for the period required by tax and accounting law |
In forms, mandatory fields are marked; without them the request cannot be answered. Optional fields can be left blank.
- The contact form uses a “proof-of-work” anti-spam check computed in your browser — no cookies and no third-party services.
- Anyone making an offer for a domain receives a personal, signed link by e-mail to follow the negotiation, with no account needed. The controller is notified by e-mail of each offer.
- Reviews are only published after approval. Your e-mail is never published; you can choose not to show your name. Review requests are e-mailed to clients, with at most one reminder.
- The site’s own statistics are aggregated daily counts (page views, referring domain, language, device type): they use no cookies and store no IP address or identifier, so nobody can be identified.
- CV downloads are only counted in aggregate (per day and language), without IP addresses.
3. Recipients and processors
Data is not sold or shared with third parties for marketing. To operate, the site relies on the following providers, which process data on the controller’s behalf under appropriate safeguards (Art. 28 GDPR):
- Hetzner (Alemanha) — hosting of the site and its database.
- Cloudflare — content delivery network and protection (reverse proxy): traffic, including the IP address, passes through Cloudflare to deliver and protect the site.
- email-smtp.eu-west-1.amazonaws.com — sending e-mail messages, confirmations and notifications.
- Google — Google Analytics: usage statistics, only after you give consent.
- YouTube (Google) — embedded videos; they only receive data when you play a video.
Data may also be disclosed to public authorities (for example, the tax authority or the courts) where required by law.
The site’s editorial content (page texts) may be translated using an artificial intelligence service. No visitor data or received messages are sent.
4. International transfers
Some of the providers listed (Google and Cloudflare) may process data outside the European Economic Area, notably in the United States. In such cases the transfer relies on a European Commission adequacy decision — such as the EU-US Data Privacy Framework, for certified organisations — or on standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).
5. Your rights
Under Articles 15 to 22 GDPR, you have the right to:
- Access — know which of your data is processed and obtain a copy;
- Rectification — correct inaccurate or incomplete data;
- Erasure (“right to be forgotten”) — when the data is no longer needed or you withdraw consent;
- Restriction of processing — in certain circumstances;
- Portability — receive the data you provided in a structured, commonly used format;
- Objection — object to processing based on legitimate interest;
- Withdraw consent at any time, without affecting the lawfulness of prior processing (cookies can be managed via the “Cookie settings” link).
How to exercise your rights
Send a request to [email protected]. You will get a reply without undue delay and within one month at most (extendable by two further months for complex requests, with notice). Exercising your rights is free of charge; additional information may be requested to confirm your identity.
Complaint to the supervisory authority
You have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or with the supervisory authority of the Member State where you live or work.
6. Automated decision-making
No decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you are made (Art. 22 GDPR). The forms’ anti-spam filters may automatically classify a message as spam; this has no legal effect and you can always get in touch directly by e-mail.
7. Children
This site and the services it presents are aimed at adults and businesses. We do not knowingly collect data from children; if you become aware that a child has sent us data, contact us so that it can be deleted.
8. Security
Technical and organisational measures appropriate to the risk are in place (Art. 32 GDPR), including:
- Encrypted communications (HTTPS/TLS) across the whole site;
- IP addresses stored in hashed form (daily keyed hash) whenever the full IP is not needed;
- Application firewall, rate limiting and anti-spam protection;
- Restricted access to the management area, with protected sessions and two-factor authentication available;
- Service credentials and keys stored encrypted.
9. Cookies
The use of cookies and local storage in your browser is described in the Cookie Policy. You can change your choices at any time via Cookie settings.
10. Changes to this policy
This policy is updated whenever the processing carried out on the site changes. The date of the last change is shown at the top of the page.