Who we are (the controller)
DIGITALTUGA ("we", "us") is a Portuguese digital studio that designs and builds websites, online stores, landing pages, backends and custom software, and provides maintenance for them. Legal identification: [COMPANY LEGAL NAME], tax number [COMPANY TAX ID], registered at [COMPANY ADDRESS], Portugal. We are the controller of the personal data described in this policy.
For any privacy matter — questions, requests, objections — write to geraldigitaltuga@gmail.com. This is our only official address; we never contact you from any other email.
The two situations this policy covers
- You came to us — through this website, our contact form, email, or as a client. Sections A below.
- We came to you — we called or wrote to your business to offer our services (B2B prospecting). Sections B below. There is also a short plain-language page about this: Why we contacted you.
A. When you contact us or work with us
What we collect
- Contact form: name, email, company (optional), the service you are interested in and your message. Provided voluntarily so that we can reply.
- Email and messaging: whatever you choose to send us.
- Clients: the identification, contact and billing details needed to prepare proposals, sign contracts, issue invoices and deliver the work.
- Analytics, only with your consent: anonymous, aggregated statistics. Currently no analytics tool is active on this site — see the cookie policy.
Why, and on what legal basis
- Replying to your enquiry and preparing a proposal — Article 6(1)(b) GDPR (steps taken at your request before a contract).
- Performing the contract and delivering the project — Article 6(1)(b).
- Invoicing and accounting records — Article 6(1)(c), legal obligation under Portuguese tax law.
- Ordinary business correspondence — Article 6(1)(f), legitimate interest.
- Analytics, if ever enabled — Article 6(1)(a), your consent through the cookie banner.
B. When we contact your business (prospecting)
Where your contact details come from
We build our own contact lists exclusively from public sources:
- your business's public listing on Google (Google Business Profile / Google Maps);
- OpenStreetMap — business directory data © OpenStreetMap contributors, available under the ODbL licence;
- official commercial registries and public business directories;
- your own public website or public social pages.
We never buy contact lists from data brokers, and we never use leaked or scraped private data. If you ask on the phone where we got your number, the honest answer will be one of the sources above.
What we hold about prospects
Only what a public listing shows and what our conversation adds: business name, sector, publicly listed phone/email/address, the name and role of the person we speak with, notes of the conversation, and — where recording applies — the call recording (see below). We deliberately hold nothing more.
Legal basis and your right to say no
Our legal basis is legitimate interest — Article 6(1)(f) GDPR, with Recital 47, which recognises direct marketing as a possible legitimate interest — limited to relevant, business-to-business offers made by a human caller, one call at a time. We do not use automated calling systems, robocalls or mass messaging. We check the applicable do-not-call / opposition lists of each country before campaigns.
Your right to object (Article 21) is absolute for direct marketing. Say "don't call again" during the call, or email geraldigitaltuga@gmail.com, and your number goes on our permanent exclusion list. No justification needed, no discussion. Details and a one-step opt-out on the page Why we contacted you.
Call recording
- You are told at the start of the call whenever a call is recorded. If you object, we do not record.
- Purpose: quality assurance, training of our agents, and keeping an accurate record of what was proposed and agreed.
- Storage: recordings are stored in access-controlled systems (Supabase, hosted in the European Union, and Google Drive), accessible only to the people who need them.
- Retention: recordings are kept for a maximum of 90 days and then deleted. If the call results in a contract, the recording may be kept until the end of that contract plus the applicable legal limitation periods, as evidence of what was agreed.
Who processes data on our behalf
We do not sell, rent or share personal data for third-party marketing. We use a small set of service providers, acting on our instructions under data-processing terms:
| Provider | What for | Where |
|---|---|---|
| Supabase | Operational database and call-recording storage | European Union |
| Google (Workspace, Drive, Gmail) | Email, documents and file storage | EU/US — EU–US Data Privacy Framework and Standard Contractual Clauses |
| Cloudflare | Hosting and serving this website | EU/US — Data Privacy Framework and Standard Contractual Clauses |
| FormSubmit | Forwarding contact-form submissions to our inbox | Per provider policy |
| Payment-link providers | Processing client payments (we never see or store card numbers) | Per provider policy |
Our sales agents are independent contractors in several countries. Each agent sees only the minimum data needed for their own assigned market, under confidentiality obligations, through access-controlled systems.
International transfers
Our core data lives in the European Union. Where a provider or agent involves a transfer outside the EU/EEA, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, plus access controls that limit each person to the minimum they need.
How long we keep data
- Prospects with no interaction: deleted after at most 24 months.
- Prospects who said "don't contact me": only the minimum needed (number/email) stays on the exclusion list, permanently — that is what stops us calling again.
- Call recordings: maximum 90 days, as above.
- Enquiries: while we are talking or a collaboration is realistically on the table.
- Client and billing records: as required by Portuguese tax law (in general 10 years for invoicing records).
Your rights
Under the GDPR you may ask us to access, correct, delete, restrict or export your data, you may object to processing (absolute right for direct marketing), and you may withdraw consent at any time where consent is the basis. Email geraldigitaltuga@gmail.com and we will act within 30 days at the latest.
You also have the right to complain to a supervisory authority — in Portugal, the CNPD, Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority of your own EU country.
Security
The site is served over HTTPS with strict security headers. Access to our inbox, database and project systems is limited to the people who need it and protected by two-factor authentication. Recordings and the contact database are never published or placed on public infrastructure.
Children
This site and our services are aimed at businesses. We do not knowingly collect data from anyone under 16.
Changes
If this policy changes, the date at the top changes with it, and material changes are flagged on the site.