Legal information
Privacy policy
Last updated: October 6, 2026
01Data controller
The controller of the personal data collected through the criatima.pt website is CRIATIMA, UNIPESSOAL LDA, NIPC 519343417, with registered office at Ed. Fonte Nova, R. 13 de Maio 35A, 2495-414 Fátima, Portugal. Criatima has not appointed a data protection officer, as it is not required to do so under Article 37 of the GDPR. For any question about your personal data, please contact us by email at [email protected] or by telephone on +351 920 789 307.
02Scope and legal framework
This policy explains which personal data we process when you visit the website, request a quote or contact us, for what purposes and on what legal bases, for how long, and what your rights are. It is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), Portuguese Law no. 58/2019 of 8 August, which implements it in Portugal, and Portuguese Law no. 41/2004 of 18 August on privacy in electronic communications. The date of the last update is shown at the top of this page.
03Contact and quote form
When you fill in the contact or quote request form, we collect your name, your email address, your telephone number (optional), the service you are interested in, the message you write, confirmation that you have read this policy (consent checkbox) and the language in which you are browsing the website. Required fields are marked; without them we cannot respond to your request. The content of the form is sent to us by email at [email protected] through an email-sending service provider.
04Origin of the visit
Only if you have accepted analytics or marketing cookies, the form also includes information about the origin of your visit: the campaign parameters in the web address (utm_*), ad click identifiers (gclid, fbclid), the first page you visited on the website and the domain of the website that referred you. This information helps us understand which channels generate contact requests. If you decline those cookies, the origin of the visit is not collected.
05Spam protection
To protect the form against automated submissions, we use a hidden field (honeypot), which people should not fill in, and we limit the number of submissions per IP address. For this purpose, the IP address is kept only in the server’s memory for a short period of a few minutes and is not stored in any database.
06Server technical logs
Whenever you visit the website, the server automatically records technical data: the IP address, the date and time of the request, the address of the requested page (URL) and the browser identification (user agent). These logs are used exclusively to keep the website secure and working properly, detect abuse and diagnose errors, and are kept for a maximum of 14 days.
07Contact by email, telephone and WhatsApp
If you contact us directly by email, telephone or WhatsApp, we process the data you provide — such as your name, contact details and the content of the communication — to reply to you and, where applicable, to prepare a proposal or perform a contract. Messages exchanged via WhatsApp are also subject to that service’s terms and privacy policy. Data collected through cookies is described in the Cookie policy.
08Purposes and legal bases
We process your data on the following legal bases under Article 6(1) of the GDPR: steps taken at your request prior to entering into a contract, and performance of a contract, to answer quote requests, prepare proposals and provide the contracted services (point (b)); legitimate interest, to keep the website secure through technical logs, prevent spam, reply to general messages and defend our rights (point (f)); compliance with legal obligations, in particular invoicing, accounting and tax obligations (point (c)); and consent, for analytics and marketing cookies and for the Google Maps map (point (a)), together with Article 5 of Portuguese Law no. 41/2004.
09Retention periods
We keep data only for as long as necessary: quote requests that do not lead to a contract, 24 months after the last contact; client data, for the duration of the contract and thereafter for the statutory periods, with accounting and tax documents kept for 10 years; server technical logs, 14 days; your cookie choice, stored in your browser until you change it or clear your browsing data; analytics data, 14 months in Google Analytics and, in Microsoft Clarity, 30 days for session recordings and 13 months for heatmaps and aggregate data. At the end of these periods, data is deleted or anonymised.
10Processors and recipients
Data may be processed by the following providers, acting as processors bound by contract to follow our instructions and keep the data secure or, where the law so provides, as controllers of their own processing: the hosting provider of the website’s server; the email-sending service provider; Cloudflare, Inc., which delivers the website’s images (cdn.criatima.pt); Google Ireland Limited and Google LLC (Google Tag Manager, Google Analytics, Google Ads where used, and Google Maps); and Microsoft Ireland Operations Limited and Microsoft Corporation (Microsoft Clarity). Data may also be disclosed to public authorities where required by law. We do not sell personal data.
11International transfers
Some of these providers, or companies in the same group, are based in the United States of America, so data may be transferred outside the European Economic Area. These transfers rely on the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, for certified companies, and/or on standard contractual clauses adopted by the European Commission, in accordance with Articles 45 and 46 of the GDPR.
12Automated decisions
We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 of the GDPR.
13Your rights
Under Articles 15 to 21 of the GDPR, you have the right to access your data, to have it rectified or erased, to restrict its processing, to receive the data you provided to us in a structured, commonly used format (portability) and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal; for cookies, simply use the “Manage cookies” link in the footer.
14How to exercise your rights
To exercise your rights, send a request to [email protected]. We may ask you for additional information to confirm your identity. We reply within one month of receiving the request; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you within the first month, in accordance with Article 12 of the GDPR. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
15Complaint to the CNPD
If you consider that the processing of your data infringes the applicable law, you have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, at www.cnpd.pt. You may also contact us first so that we can try to resolve the matter.
16Minors
Criatima’s services are intended for businesses and adults. Children under 13 should not submit personal data through the website: under Article 16 of Portuguese Law no. 58/2019, a minor’s consent to information society services is only valid from the age of 13. If you become aware that we have received data from a younger child, please contact us so that we can delete it.
17Security
We apply appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or disclosure, such as encryption of communications with the website (HTTPS), access to data limited to those who need it and the choice of providers offering sufficient security guarantees.
18Changes to this policy
This policy may be updated to reflect legal, technical or service changes. The version in force is always the one published on this page, with the date of the last update shown at the top. In the event of any discrepancy between the Portuguese, French and English versions, the Portuguese version prevails.