Privacy Policy

Controller and contact details

TRANSFORMIS is the controller of the personal data covered by this policy. For privacy enquiries or to exercise your rights, please contact us at mail@transformis.pt.

NIPC

504155490

Email

mail@transformis.pt

Contact address

Estrada Nacional 1, Parque Pinheiros, Alto da Serra, 2040-063 Rio Maior, Portugal

Data collected

The form collects your name, email address, company (optional) and message. Your name, email and message are needed to assess and respond to the enquiry; without them, the submission cannot be processed. Please avoid sending sensitive data or unnecessary information about other people. Technical operation involves the IP address and session identifiers to prevent abuse. Server access logs may include the IP address, date and time, requested resources and browser information. Anti-abuse mechanisms use pseudonymised counters and receipts without storing the message content in the website database.

Purposes and legal bases

We use the data to assess and respond to enquiries and follow up the matters raised. Where an enquiry concerns pre-contractual steps requested by the data subject, the legal basis is Article 6(1)(b) GDPR. Other enquiries, including those from company representatives, rely on the legitimate interest in responding to requests and maintaining professional communications under Article 6(1)(f), balanced against the rights of the individuals concerned. Website security and spam and abuse prevention rely on the legitimate interest in protecting the service and communications. Applicable legal obligations rely on Article 6(1)(c). The form does not subscribe visitors to marketing communications or make automated decisions with legal or similarly significant effects, including profiling.

Retention

Received messages are retained in the TRANSFORMIS email system for as long as necessary to assess, respond to and follow up the matter. The criterion is the conclusion of the enquiry and related steps; information no longer needed should be deleted unless a legal retention obligation or a proportionate need to establish, exercise or defend legal claims applies. If the enquiry leads to a contractual relationship, relevant records are subject to the obligations and criteria applicable to that relationship. Anti-abuse counters and receipts have a 15-minute validity window; physical deletion of expired records depends on WordPress housekeeping. Logs and backups should be retained only as necessary for their security and recovery purposes. You may request clarification of the applicable criteria using the contact details in this policy.

Recipients

Access to the data should be limited to authorised TRANSFORMIS personnel and hosting, technical maintenance and email providers, to the extent necessary for their services and subject to applicable data protection obligations. Data may be disclosed to authorities where legally required.

International transfers

The location and processing arrangements of hosting and email providers are relevant to determining whether data is transferred outside the European Economic Area. Information about processing locations and applicable safeguards may be requested at mail@transformis.pt. Any transfers may take place only under the conditions in Chapter V GDPR, including an adequacy decision or appropriate safeguards where required.

Rights and complaints

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction and portability where applicable, and object to processing based on legitimate interests. Sending an enquiry does not depend on permission for marketing. You may exercise your rights at mail@transformis.pt. Additional identification information will be requested only where necessary and proportionate. Requests are normally answered within one month; if a lawful extension is needed, you will be informed within that period. You may lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), without prejudice to other remedies.

Lodge a complaint with the CNPD

Cookies and technical storage

The public website uses only the first-party technical cookie tf_contact_session to associate the session with the form’s CSRF protection and help prevent abuse. It is created when you request a token to submit the form or open its private version without JavaScript; simply visiting the homepage does not create it. It expires after one day. It is HttpOnly, SameSite=Lax and Secure when the connection uses HTTPS. The public website does not use advertising or analytics cookies, localStorage, sessionStorage or tracking tools. Resources and fonts are hosted locally. The browser may retain resources in its normal cache to speed up navigation. You may delete or block cookies in your browser settings; blocking the technical cookie prevents secure form submission, so you may contact us by email instead. The administration area, restricted to authorised users, also uses technical WordPress cookies: a cookie test and language choice for the session; authentication for the session or, with the remember-me option, cookies lasting up to 14 days and 12 hours (normal authentication validity: 14 days); and preferences for up to one year. These cookies are not needed to visit public pages.

Security

The form uses server-side validation, CSRF protection and proportionate controls against spam, abuse and repeated submissions. Website administration requires authentication and appropriate permissions. No system eliminates all risks; avoid including unnecessary information in your message and contact us if you identify a security issue affecting your data.

External links and updates

Links to the map, Electronic Complaints Book and CNPD open external services only when you use them. Processing on those services is subject to the information provided by the respective organisations. This policy may be updated to reflect changes to the website or data processing.