Privacy Policy

1. Scope

This Privacy Policy describes how personal data is collected, processed and protected when you visit the PFC Consulting website (pfcconsulting.pt) or use its contact form, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Portuguese Law No. 58/2019 of 8 August. It applies to all visitors of this website.

2. Data controller

PFC Consulting, Lda.
VAT: PT516223771
Registered office: Avenida Natália Correia, 6A, 2910-735 Setúbal, Portugal
Contact: through the contact form of this website.

3. Personal data collected

• Data you provide through the contact form: name, email address, subject and the content of your message.
• Data recorded automatically: IP address, browser type, pages visited and the date and time of the visit, recorded by the server that hosts the website, for security and operation.

We do not collect special categories of personal data (GDPR Article 9).

4. Purposes and legal basis

• Answering your contact request: legitimate interest (GDPR Article 6(1)(f)) and, where the request aims at entering into a contract, pre-contractual steps (Article 6(1)(b)).
• Security and operation of the website: legitimate interest (Article 6(1)(f)).
• Compliance with legal obligations: legal obligation (Article 6(1)(c)).

We do not rely on consent to process personal data on this website.

5. Data retention

• Contact requests: up to 12 months after the last interaction, unless a contractual relationship justifies a different period.
• Security records: up to 6 months, or longer when needed to investigate an incident.

6. Data sharing

We do not sell or transfer personal data. Data is shared only with the categories of providers strictly necessary to operate this website, acting as processors on our behalf and bound by a data processing agreement under GDPR Article 28:

• Hosting provider
• Email providers, which deliver and receive the messages of the contact form

No personal data is shared with any other third party, unless required by law.

7. International transfers

The server that hosts this website and keeps the messages of the contact form is located in the United States, and some of the providers listed in section 6 may process data outside the European Economic Area. In those cases the transfer is protected by appropriate safeguards recognised under the GDPR (Articles 45 to 49), such as adequacy decisions of the European Commission or standard contractual clauses.

8. Cookies

This website uses no analytics, advertising or tracking cookies. The server's protection may store a strictly necessary cookie to tell visits apart from automated attacks, which does not depend on consent. See the Cookie Policy.

9. Your rights

Under the GDPR, you have the right to:

• access the data we hold about you (Article 15);
• have inaccurate or incomplete data corrected (Article 16);
• have your data erased (Article 17);
• restrict the processing (Article 18);
• receive your data in a structured, machine-readable format (Article 20);
• object to processing based on legitimate interest (Article 21).

To exercise any of these rights, please use the contact form of this website. We will answer within 30 days.

10. Links to third-party websites

This website may contain links to other websites. We are not responsible for their privacy practices or content and encourage you to read their own privacy policies.

11. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration, including encryption, access controls and regular security reviews.

12. Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt.

13. Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. The date at the top of this page shows the latest revision.