Privacy Policy

This policy describes how Seamless Doubt — Sociedade Unipessoal Limitada ("Seamless Doubt", "we") collects, uses and protects your personal data when you visit seamlessdoubt.com or contact us, in compliance with Regulation (EU) 2016/679 ("GDPR") and Portuguese Law 58/2019.

1. Data controller

2. Data we collect

• Contact form: name, email address and the content of the message you send us.
• Technical data: IP address, browser type, operating system and pages visited, logged by our hosting provider for the time strictly required to keep the service running and secure.
• Usage preferences: your light/dark theme choice, stored in a technical cookie on your device.
• Analytics (consent only): anonymised usage statistics, collected only after you accept in the cookie banner.

3. Purposes and legal basis

• Respond to enquiries — pre-contractual measures (Art. 6(1)(b) GDPR).
• Keep the site secure and operational — legitimate interest (Art. 6(1)(f) GDPR).
• Comply with legal obligations (invoicing, accounting) — Art. 6(1)(c) GDPR.
• Analytics and service improvement — consent (Art. 6(1)(a) GDPR), revocable at any time.

4. Retention periods

We keep your data only for as long as necessary for the purposes for which it was collected, or for the legally required period:

• Contact form messages: up to 24 months after the last interaction, unless they lead to a contractual relationship.
• Contractual and invoicing data: 10 years from the end of the fiscal year concerned (Art. 123 Portuguese Corporate Income Tax Code and Art. 40 VAT Code).
• Correspondence relating to legal obligations or defence of rights in proceedings: until the applicable statute of limitations expires.
• Server and security technical logs: 30 days.
• Technical cookies (sd-theme, sd-consent): 12 months on your device.
• Analytics data with consent: up to 14 months or until you withdraw consent, whichever comes first.

Once these periods elapse, data is securely deleted or irreversibly anonymised.

5. Recipients and processors

Your data may be processed by the following sub-processors, always under data-processing agreements:

• Lovable / Cloudflare — hosting and CDN (EU/US, standard contractual clauses).
• Supabase — application database (EU).
• Transactional email provider for replying to enquiries.

6. International transfers

Where sub-processors operate outside the European Economic Area, we ensure transfers are covered by Standard Contractual Clauses approved by the European Commission or other mechanisms set out in Chapter V GDPR.

7. Your rights

As a data subject, and under Articles 15 to 22 of the GDPR, you have the following rights, which you can exercise free of charge:

• Right of access (Art. 15): obtain confirmation of which of your data we process and receive a copy.
• Right to rectification (Art. 16): correct inaccurate data or complete incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): request deletion of your data when it is no longer needed, when you withdraw consent, or when you object to processing — unless a legal retention obligation applies.
• Right to restriction of processing (Art. 18): request suspension of processing in specific cases (contested accuracy, pending objection, etc.).
• Right to data portability (Art. 20): receive your data in a structured, commonly used format, or request its direct transmission to another controller, where technically feasible.
• Right to object (Art. 21): object at any time to processing based on our legitimate interest.
• Right to withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of prior processing. For analytics cookies, simply click "Cookie settings" in the footer and choose "Reject".
• Right not to be subject to automated decisions (Art. 22): we do not carry out processing with legal effects based solely on automated decision-making or profiling.
• Right to lodge a complaint: with the Portuguese Data Protection Authority (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, geral@cnpd.pt.

How to exercise your rights

1. Send a request to geral@seamlessdoubt.com with the subject "GDPR rights request".
2. Clearly state which right you wish to exercise and, where applicable, the data or processing concerned.
3. To confirm the request comes from the data subject, we may ask for an additional verification element (e.g. reply from the email address used in previous contacts). We will not ask for a copy of your ID document unless strictly necessary and proportionate.
4. We respond within a maximum of 1 month from receipt (extendable by 2 further months for complex requests, with prior reasoned notice), under Art. 12(3) GDPR.
5. If you believe processing infringes the GDPR, you may at any time lodge a complaint with the CNPD without needing to contact us first.

8. Marketing communications

The contact form includes a checkbox, unticked by default, through which you can authorise Seamless Doubt to send you news, content and information about our services by email. This authorisation is based on your free, specific, informed and unambiguous consent (Art. 6(1)(a) and Art. 7 GDPR; Art. 13-A of Portuguese Law 41/2004).

• What we send: occasional communications about new services, articles and materials relevant to business groups. We do not share data with third parties for marketing purposes.
• Typical frequency: no more than one message per month.
• Who processes it: Seamless Doubt — Sociedade Unipessoal Limitada, using a transactional email provider under a GDPR data-processing agreement.
• Consent record retention: we keep a record of your authorisation (timestamp and version of the consent text) for the duration of the relationship and up to 3 years afterwards, as evidence under Art. 7(1) GDPR.

How to withdraw consent

You can withdraw consent at any time, free of charge and as easily as it was given:

• Unsubscribe link in the footer of every marketing email — one click is enough.
• Email to geral@seamlessdoubt.com with the subject "Unsubscribe from marketing".

Withdrawal takes effect within a maximum of 10 working days and does not affect the lawfulness of communications sent beforehand. We will still contact you to reply to requests you send us or to fulfil contractual and legal obligations — these service communications do not depend on marketing consent.

9. Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), least-privilege access controls, and periodic reviews of our security practices.

10. Changes

This policy may be updated. The "Last updated" date at the top reflects the version in force. Material changes will be communicated with appropriate prominence.