Your data, handled with care.

1. Who is responsible for your data

The data controller is Afazeres Curiosos - Unip, Lda, NIPC 515862789, with registered office at Rua Professor Egas Moniz, n.º 10, 1.º Dto., 2640-477 Mafra, Portugal.

For privacy matters, use the contacts in section 12. Afazeres has not appointed a data protection officer, because the law does not require one for our activity. Privacy requests are handled directly by the management.

2. What data we may process

Depending on the channel and service, we may process:

• identification and contact details: name, email, phone number and tax number;
• information about the company or entity you represent;
• the content of your request, and the technical documents and photographs you send us;
• messages exchanged by email, WhatsApp and on the website;
• the transcript of calls answered by our digital assistant (section 4);
• billing and payment data;
• usage data from the client area and the partner area;
• technical website usage data.

Please avoid including health data, religion, political opinions or other special categories of data in free-text fields or documents. If we receive them without need, we restrict their processing and delete them when the law and the need to preserve evidence allow.

3. Purposes and lawful bases

Where a field is mandatory, we say so and explain what happens if you leave it blank. Without the minimum information, we may be unable to respond or prepare a proposal. Boxes such as «I have read the privacy information» confirm that you were informed. They are not a request for consent.

4. Digital assistants (AI) and decisions

Afazeres uses digital assistants powered by artificial intelligence. For example, Sofia answers on WhatsApp and by phone, and Gabriel on the website. When you talk to one of these assistants, we tell you that you are talking to an AI. The assistants are used to:

• guide your request and organise the information;
• transcribe what you tell us by voice;
• identify what is missing;
• prepare drafts.

The AI models currently used are Google Gemini and OpenAI (section 5). They receive only what each reply needs.

The assistants do not make decisions with legal or similarly significant effects on you. Proposals, prices, acceptance of work and technical deliverables are always validated by a person.

Phone calls. The conversation is processed in real time and transcribed into the record of your request. The audio is not recorded. If we ever start recording, we will tell you at the start of the call and record only where there is an appropriate legal basis.

5. Who we share data with

We share data only to the extent necessary. The entities that process data on our behalf (processors) do so under contract and on our instructions.

We also share data with:

• The telecoms operator of our phone line, which processes call traffic data as an independent controller;
• Technical partners working on your project (engineers, coordinators, installers). They receive only what the work requires, such as the site address and the technical documents. They do not receive your email, phone number or tax number unless that is necessary and we tell you;
• The Portuguese Tax Authority, for reporting invoices;
• Professional advisers and public authorities, when the law requires it.

Our calendar and customer service run on software installed on our own server. No additional providers are involved in that part.

We review this list whenever an integration is switched on or removed.

6. Where data is stored and processing outside the European Economic Area

• Application (requests, cases, client area and partner area): Contabo server in France, where backups are also kept.
• Website (including access logs, kept for 30 days): Contabo server in the European Union.
• Email and one encrypted backup of the application: InterServer, in the United States, under the EU‑U.S. Data Privacy Framework. The backup leaves encrypted and InterServer does not hold the key.
• WhatsApp messages and AI models (and payments, when there are online payments): may be processed in the United States by the providers in section 5.

Transfers to the United States rely on one of these safeguards:

• the European Commission's adequacy decision for the EU‑U.S. Data Privacy Framework, for certified providers;
• the Standard Contractual Clauses approved by the Commission.

You can ask us which safeguard applies in each case, using the contacts in section 12. We do not transfer data to China.

7. How long we keep data

8. Your rights

You may request access, rectification, erasure, restriction, portability or object to processing, depending on the processing and within legal limits. Where processing is based on consent, you may withdraw it without affecting earlier processing.

We usually reply within one month. That period may be extended by two further months for complex or numerous requests, in which case we explain why. We may ask you for information to confirm your identity.

You may also lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) (www.cnpd.pt).

Right to object. You may object at any time to processing based on our legitimate interest.

9. Security

We apply technical and organisational measures appropriate to the risk:

• encrypted connections;
• access control with a second factor for the management;
• encrypted backups;
• monitoring;
• email protection.

Every system carries some residual risk. We review the measures and act when we detect an incident.

10. Cookies and similar technologies

The website has a preferences panel that lets you accept, decline and change cookie options. The information in that panel reflects the technical configuration in force.

11. Updates

We update this policy when our services, providers or legal obligations change. The date of the last update is at the top, and significant changes are highlighted.

12. Contacts

When you write to us about privacy, please put «Privacy» in the subject line. It helps us reply on time.