Privacy Policy

The controller of the personal data collected through the alturys.dev website is Guilherme André Cabral, a sole trader (self-employed professional registered with the Portuguese Tax and Customs Authority), trading under the brand name Alturys, in Portugal.

The business consists of providing digital services: bespoke websites, process automation, artificial intelligence chatbots, artificial intelligence voice agents, visual identity and rebranding, and paid advertising management.

For any privacy or data protection matter, please write to [email protected]. The tax identification number is not published on this page, but will be provided to anyone who requests it at that address.

The website operates without user accounts and, for the time being, without forms of its own. The only point at which you submit data directly is when booking a meeting. In total, the data processed is as follows:

• Booking contact details. Name, email address, telephone number and the answers you give on the booking platform when you schedule a meeting.
• Technical browsing data. IP address, browser type and device, recorded automatically when you access the website.
• Device identifier. A unique code stored in the identity cookie, which makes it possible to recognise the same browser on repeat visits. It is explained in detail in the section on cookies.
• Video viewing statistics. The vsl-booking and vsl-who_we_are cookies record only whether you watched certain videos on the website to the end.

We do not collect special categories of data, we do not create user accounts or profiles, and we do not ask for more information than is needed to respond to your enquiry.

Each processing activity relies on a legal basis under the GDPR:

• Responding to meeting requests and preparing proposals. Processing necessary to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• Statistics and improving the website. Understanding which pages and videos perform best. This relies on non-essential cookies and is therefore based on your consent (Article 6(1)(a) GDPR and Article 5 of Law No. 41/2004, the Portuguese electronic communications privacy law), given through the cookie notice shown on your first visit.
• Recognising the device between visits. Distinguishing new visits from repeat visits and remembering each visitor's state, likewise based on the consent given through the cookie notice: the identifier is only calculated after you accept.
• Website security. Preventing abuse and protecting the infrastructure, based on legitimate interest.

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal, by deleting the cookies in your browser (the notice will reappear on your next visit) or by writing to [email protected]. You may object to processing based on legitimate interest as described in the Your rights section.

The website uses a small set of first-party cookies and some third-party cookies (YouTube, Business Hub and Cloudflare). A cookie notice is shown on your first visit: cookies that are not strictly necessary are only set after you accept it, and your answer itself is stored in the cookies-accepted cookie. The full list, with the purpose and duration of each cookie, and how to manage or delete them, can be found in the Cookie Policy.

The identity cookie stores, as its name suggests, a unique identifier for your device and browser. After you accept the cookie notice, the open source FingerprintJS library analyses technical characteristics of your browser, locally and without sending anything to third parties, and calculates that identifier, which is then stored in the cookie. If you delete the cookie, the identifier is recalculated in the same way on your next visit, so the value is likely to reappear. It is used to recognise repeat visits, for usage statistics and to remember your state between visits. It is not shared with third parties or used for advertising, and you may object to this processing by writing to [email protected].

Your data is never sold. It is shared only with the providers that make the service possible:

• Business Hub (Savvy Growth). The management platform on which meeting bookings run, embedded in the website via an iframe. The data you submit there (name, email address, telephone number and answers) is processed on that platform on behalf of the controller, acting as processor.
• Google (YouTube). The videos on the website are embedded from YouTube. When you play a video, Google processes technical data about your connection.
• Cloudflare. The website infrastructure is served through Cloudflare, which processes traffic for security and performance purposes.
• Providers essential to the business. Hosting, email and invoicing services, to the extent necessary for the business to operate.

At present, the website does not maintain databases of its own: browsing state is held in cookies in your browser, and the data you submit when booking a meeting remains on the Business Hub platform, under the conditions described in the Data sharing section.

When we begin storing data directly (for example, contacts and requests received through the website), that storage will take place on servers located in Switzerland. This choice is deliberate: Switzerland has a revised Federal Act on Data Protection (in force since 1 September 2023) offering a level of protection comparable to the GDPR, and it benefits from an adequacy decision of the European Commission under Article 45 GDPR. In practice, this means that storing data in Switzerland is legally equivalent to storing it within the European Economic Area, with no need for additional safeguards.

The location of the servers does not alter any of your rights: you may continue to exercise them as described in the Your rights section, and this policy will be updated, with details of the data concerned, once such storage is in place.

Google and Cloudflare may process data outside the European Economic Area. Where this occurs, transfers rely on safeguards provided for in the GDPR: standard contractual clauses approved by the European Commission and adequacy decisions, including the EU-US Data Privacy Framework where applicable.

• Booking and contact data. Retained for the duration of the business relationship and for as long as the negotiation of a proposal continues. Once that relationship ends, it is deleted or anonymised.
• Data relevant for tax purposes. Where invoicing takes place, the documents and the data supporting them are retained for 10 years, as required by law.
• Cookies. Valid for 400 days, renewed on each visit, as detailed in the Cookie Policy.

The GDPR gives you the rights of access, rectification, erasure, restriction of processing, data portability and objection in respect of your personal data. Where processing is based on consent, such as device recognition and usage statistics, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, send an email to [email protected] stating what you are requesting. You will receive a reply within the maximum period of one month laid down in the GDPR. If the request is particularly complex, that period may be extended as permitted by law, and you will be informed of this within the first month.

Security measures are proportionate to the size of the business and the data processed: all website traffic is encrypted over https, and access to the platforms used in the business is protected by strong authentication and restricted to the controller.

Should a personal data breach nevertheless occur that poses a risk to your rights, the CNPD (the Portuguese data protection authority) will be notified and, where required by law, you will be informed directly.

If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, at www.cnpd.pt. Before doing so, we would be grateful if you wrote to us at [email protected]: most issues can be resolved that way.

The conditions under which the services are provided, including the resolution of consumer disputes, are set out in the Terms of Service.

This policy may be revised when the services, suppliers or the law change. Changes are published on this page, with the revision date shown at the top, and apply from the date of publication.

Related documents: Terms of Service and Cookie Policy.