Privacy policy
What personal data the 93creative.pt website collects, what it is used for, how long it is kept and how to exercise your rights under the GDPR.
This policy explains what personal data the 93creative.pt website collects, what it is used for, how long it is kept and what rights you have over it, in line with the General Data Protection Regulation (GDPR).
Who is the data controller?
The controller is Carlos Gonçalves (93creative), IET Tâmega Park, Edifício Mercúrio, Fração AC, 4600-758 Amarante, Portugal. For any question about personal data, write to carlos@93creative.pt.
What data do I collect and why?
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact and review form | Name, email, website, area of interest and message | Replying to your request and preparing a proposal | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) |
| Email and phone | The details you choose to send | Replying and following up | Pre-contractual steps or legitimate interest in replying |
| Visit statistics (Google Analytics 4) | Pages viewed, traffic source, device, approximate location, cookie identifiers | Understanding how the site is used and improving it | Consent, given in the cookie banner |
| Behaviour analysis (Microsoft Clarity) | Clicks, scrolling and anonymised session recordings | Finding usability problems | Consent, given in the cookie banner |
| Site security | IP address, browser and requests made to the server | Protecting the site against attacks and unauthorised access | Legitimate interest in site security |
| Consent record (Complianz) | Choices made in the cookie banner and the date | Demonstrating the consent given | Legal obligation |
I do not sell personal data, I do not use it for advertising and I do not make automated decisions or build profiles based on it.
Which cookies does the site use?
The site uses strictly necessary cookies (for example, to remember your language and your cookie choices) and, only if you consent, statistics cookies from Google Analytics and Microsoft Clarity. You can accept, refuse or change your choice at any time in the cookie banner. Refusing does not stop you from using the site.
Who has access to the data?
The data is processed by me. To run the site, I use providers that process data on my behalf and under my instructions:
- The hosting company for the website and email, where site data and received messages are stored.
- Google (Google Analytics), for visit statistics, only with consent.
- Microsoft (Clarity), for usability analysis, only with consent.
- Patchstack, to protect the site against attacks.
- WP Umbrella, for backups and site monitoring.
Google and Microsoft may process data outside the European Union, notably in the United States. These transfers are covered by the EU-US Data Privacy Framework and by the standard contractual clauses approved by the European Commission.
How long do I keep the data?
- Contact requests that do not lead to a project: up to 2 years after the last contact.
- Client data: for the duration of the business relationship and then for the period required by tax and accounting law.
- Google Analytics statistics: 14 months.
- Site security and email logs: up to 12 months.
- Cookie consent record: 12 months, or until you change your choice.
What are your rights?
You can ask at any time for access to your data, its rectification or erasure, restriction of or objection to processing, and data portability. Where processing is based on consent, you can withdraw it whenever you want, without affecting processing carried out before that. To exercise any of these rights, write to carlos@93creative.pt. I reply within one month at most.
If you believe your data is not being handled properly, you can lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or with the authority in your own EU country.
How do I protect the data?
The site always runs over HTTPS and has a firewall, regular updates, least privilege access and backups. No system is completely immune to failures, but if a data breach puts you at risk, you will be informed and the CNPD will be notified within the legal deadlines.
Links to other sites
The site links to third party sites, such as LinkedIn or client websites. Those sites have their own privacy policies, for which I am not responsible.
Changes to this policy
This policy may be updated when the site or the law changes. The date of the last update is shown at the end of the page.
Last updated: 9 October 2026.
