Your data,
treated with respect.

1. Data controller

The controller of the personal data collected through the website impact-origin.com is Impact, represented by João Santos.

For questions related to the processing of your data, contact: [email protected]. We are not legally required to designate a Data Protection Officer (DPO), all questions are handled directly by management.

2. Definitions

For the purposes of this policy, the definitions of Article 4 of the GDPR apply. In particular:

• Personal data: any information that identifies or makes an individual identifiable.
• Processing: any operation performed on personal data (collection, recording, storage, consultation, transmission, deletion, etc.).
• Data subject: the individual to whom the data refers (you).
• Processor: entity that processes data on behalf of the controller.
• Consent: freely given, specific, informed, and explicit expression of will.

3. Data we collect

We collect only the data strictly necessary for the stated purposes. Data categories:

• Contact data provided voluntarily (meeting booking form, newsletter, email): name, email address, phone, company, website, and any other information you choose to share.
• Business data provided voluntarily: approximate revenue, goals, project description, and notes you share with us so we can assess fit.
• Technical data: IP address, session identifier, user-agent (browser and device), language, pages visited, basic navigation events.
• Communication data: email history, exchanged messages, and scheduled appointments.

We do not collect special categories of data (health, ethnic origin, political opinion, etc.) and we do not purchase third-party databases.

4. Purposes and legal bases

Processing of your data occurs for the following purposes, always with an appropriate legal basis (Article 6 GDPR):

• Response to commercial inquiries and bookings, performance of a contract or pre-contractual steps (Art. 6(1)(b)).
• Provision of contracted services, performance of a contract (Art. 6(1)(b)).
• Compliance with legal obligations (invoicing, accounting, tax), legal obligation (Art. 6(1)(c)).
• Newsletter and commercial communications, consent (Art. 6(1)(a)), revocable at any time.
• Website security and fraud prevention, legitimate interest (Art. 6(1)(f)).
• Aggregated analysis and service improvement, legitimate interest with aggregated/anonymised data.

5. Retention period

• Bookings and commercial contacts: up to 5 years after last contact.
• Project documentation and contracts: 10 years (legal SAF-T / accounting period).
• Invoices and tax documents: 10 years (DL no. 28/2019).
• Newsletter: until consent is withdrawn (unsubscribe).
• Website technical logs: 90 days, unless incident investigation is required.

After these periods, data is deleted or anonymised. You may request early deletion under the terms of Article 17 of the GDPR.

6. Processors

To operate the service, we rely on suppliers acting as processors (Article 28 GDPR), always bound by contractual data protection obligations:

• Vercel (USA, with standard contractual clauses), website hosting.
• Cloudflare (USA, with standard contractual clauses), CDN, DNS, and attack protection.
• Convex (USA, with standard contractual clauses), database and backend.
• Resend (USA, with standard contractual clauses), transactional email delivery.
• Stripe Payments Europe (Ireland), payment processing.
• Clerk (USA, with standard contractual clauses), user authentication in the reserved area.
• Google LLC (Ireland/USA), operator's calendar and email (Google Workspace), where applicable.

List updated on April 26, 2026. You may request an updated list and a copy of the contractual clauses by email.

7. International transfers

Some processors operate outside the European Economic Area (EEA), namely in the USA. These transfers always occur with appropriate safeguards under Chapter V of the GDPR:

• Adequacy decisions of the European Commission, when applicable.
• Standard contractual clauses (SCCs) approved by the European Commission.
• Additional technical and organisational measures to mitigate risks.

8. Your rights

Under Articles 15 to 22 of the GDPR, you have the following rights:

• Access, know what data we hold about you and obtain a copy.
• Rectification, correct inaccurate or outdated data.
• Erasure ("right to be forgotten"), request deletion of your data, under legal conditions.
• Restriction of processing in specific situations.
• Portability, receive your data in a structured format, or request direct transmission to another controller.
• Objection to processing based on legitimate interest.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Not be subject to automated decisions with significant effects (we do not perform automated profiling).

To exercise any of these rights, send a request to [email protected]. We respond within the legal period of 1 month (extendable by 2 more months in case of complexity, with prior notice).

9. Cookies and similar technologies

Our website only uses strictly necessary cookies for the operation of the service (session management, dark/light theme preference, security).

We do not use tracking, advertising, remarketing, or profiling cookies. We have no Facebook pixels or advertising networks on the public website. We use anonymous, aggregated visit statistics, without cookies and without storing anything on your device, telling us how many people visit each page and where they come from, never who they are. Because nothing is stored on your device, they do not require consent under Article 5(3) of the ePrivacy Directive. If we ever adopt a tool that stores information on your device, we will ask you first.

You may configure your browser to refuse cookies; some features may stop working. This section complies with Article 5(3) of the ePrivacy Directive and DL no. 4/2024.

10. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration:

• Encryption TLS (HTTPS) across the entire website.
• Encryption at rest in the database.
• Principle of least privilege in internal access.
• Two-factor authentication on all critical internal tools.
• Periodic audit of access and logs.
• Continuous software dependency update policy.

In case of a personal data breach that poses a high risk, we will notify the CNPD within 72h and affected subjects without undue delay (Articles 33 and 34 GDPR).

11. Privacy of minors

Our services are intended for professionals and companies and are not directed at minors under 18 years of age. We do not intentionally collect data from minors. If you become aware that a minor has shared personal data with us, contact us so we can proceed with deletion.

12. Complaints to the CNPD

Without prejudice to other avenues, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD):

• Website: www.cnpd.pt
• Address: Av. D. Carlos I, 134, 1st floor, 1200-651 Lisbon, Portugal
• Phone: +351 213 928 400

13. Changes to this policy

We may update this policy to reflect changes in our services or in legislation. The version in force is always the one published on this page. Material changes will be communicated by email to active clients and newsletter subscribers.

14. Contact

For any question about privacy or exercise of rights:

• Email: [email protected]
• Phone: +351 963 054 947
• Website: impact-origin.com

For the general Terms & Conditions, see the page Terms & Conditions.