1. Who is responsible for the data
The controller of the personal data collected through this site is Alba Living Lda. (Portuguese company number 518977897, registered at Rua das Vigandeiras, 76, 1.º, 4750-287 Barcelos, Portugal). Contact: through the contact form.
2. What data I collect
I collect only the data strictly needed to provide the services on this site:
- “Devagar” newsletter: email address and, optionally, name.
- Contact forms: name, email address, content of the message.
- Digital product purchases: name, email, payment details (handled by third parties, see section 5).
- Browsing data: IP address, device type, pages visited (see the Cookie Policy).
3. What I use this data for
- Sending the “Devagar” newsletter (only if you subscribe).
- Replying to messages sent through the forms.
- Processing purchases of digital products (PDFs, ebooks).
- Analysing site traffic in aggregate and anonymously.
- Meeting legal obligations (tax and accounting).
4. Legal basis for the processing
- Consent (Article 6(1)(a) GDPR): newsletter subscription, optional forms.
- Performance of a contract (point (b)): processing purchases.
- Legal obligation (point (c)): keeping invoices for the period the law requires.
- Legitimate interest (point (f)): site security, aggregate traffic analysis.
The forms on this site use Cloudflare Turnstile to tell people apart from automated programs and stop spam submissions. To do that, Cloudflare analyses technical signals from your browser at the moment you submit the form. Cloudflare’s Turnstile Privacy Addendum applies to this processing.
6. How long I keep the data
- Newsletter email: until you unsubscribe.
- Contact messages: up to 2 years after the last exchange, unless the law requires otherwise.
- Invoices and tax records: 10 years (legal obligation).
- Technical logs: up to 12 months.
7. Your rights
Under the GDPR, you have the right to:
- Access your personal data.
- Rectification of data that is wrong.
- Erasure of the data (the “right to be forgotten”), as provided by law.
- Restriction of the processing.
- Portability of your data.
- Objection to the processing.
- Withdrawal of consent at any time (without affecting the lawfulness of processing carried out before then).
To exercise any of these rights, send a message through the contact form. I reply within 30 days.
You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt.
8. Cookies
This site uses cookies that are essential to how it works and, with your consent, analytics cookies. For the detail, see the Cookie Policy.
9. Security
I have put appropriate technical and organisational measures in place to protect your data, including HTTPS encryption, restricted access to systems, and regular backups. Even so, no transmission over the Internet is 100% secure.
10. Changes to this policy
I may update this policy to reflect legal, technical or business changes. When the changes matter, I tell newsletter subscribers by email. The date of the last update is shown at the top.
11. Language of this policy
This policy was originally written in Portuguese. The English version is a translation, provided so that it can be read in English. It has no independent legal effect. If the two versions differ, the Portuguese version prevails.