Privacy Policy

Last updated: October 16, 2026

Welcome to Contos por Carta (“we”, “our”, or “us”). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you visit our website, www.contoscarta.pt (the “Website”).

We are committed to respecting your privacy and processing your personal data transparently, in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese data protection laws.

1. Data Controller

Contos por Carta

If you have any questions about this Privacy Policy or how we process your personal data, please contact us using the details above.

2. Information We Collect

Depending on how you interact with our Website, we may collect the following categories of personal data.

a) Information You Provide Directly

When you contact us, submit a form, subscribe to communications, purchase or request a product or service, or otherwise interact with the Website, we may collect:

  • Name;

  • Email address;

  • Postal address, where necessary;

  • Telephone number, where applicable;

  • Messages, correspondence, or other content you submit;

  • Transaction and order information, where applicable;

  • Any other personal data you voluntarily provide.

Please only provide personal information that is necessary for your interaction with us.

b) Automatically Collected Information

When you browse the Website, certain technical information may be collected automatically, including:

  • IP address;

  • Browser type and version;

  • Device information and operating system;

  • Pages visited and interactions with the Website;

  • Date, time, and duration of visits;

  • Referring website or source;

  • URLs accessed;

  • Cookie identifiers and similar tracking information, where applicable.

c) Analytics Data

If analytics tools are used on the Website, we may process information about how visitors interact with our pages to understand Website usage and improve its functionality.

Non-essential analytics technologies will only be used where the required consent has been obtained.

3. How We Use Your Information

We may use your personal data for the following purposes, as applicable:

  • To operate, maintain, and provide access to the Website;

  • To respond to questions, requests, and messages;

  • To manage orders, subscriptions, or services, where applicable;

  • To send administrative or service-related communications;

  • To improve the Website, its content, and user experience;

  • To understand Website traffic and usage patterns, where permitted;

  • To send newsletters or promotional communications where legally permitted;

  • To comply with applicable legal and regulatory obligations;

  • To protect the Website against fraud, misuse, and security threats.

We will not use your personal data for purposes that are incompatible with the purposes for which it was collected without an appropriate legal basis.

4. Legal Basis for Processing (GDPR)

We process personal data only when a valid legal basis applies. Depending on the circumstances, these legal bases may include:

  • Consent: When you have freely agreed to a specific use of your personal data, such as receiving marketing communications or accepting non-essential cookies.

  • Contract: When processing is necessary to provide a product or service you have requested or to take steps before entering into a contract.

  • Legal obligation: When processing is required to comply with applicable laws.

  • Legitimate interests: When processing is necessary for our legitimate interests, such as maintaining Website security, provided those interests do not override your rights and freedoms.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Cookies and Tracking Technologies

The Website may use cookies and similar technologies to:

  • Ensure essential Website functionality;

  • Remember preferences;

  • Measure Website traffic and performance, where permitted;

  • Improve navigation and user experience.

Strictly necessary cookies may be used where required to provide the Website's requested functionality. Non-essential cookies, including analytics or advertising cookies where applicable, will only be activated after obtaining consent where required by law.

You can manage your cookie preferences through the Website's cookie settings, if available. You may also manage cookies through your browser settings, although disabling certain cookies may affect Website functionality.

Withdrawing consent should be as straightforward as giving it.

6. Sharing of Information

We do not sell your personal data.

We may share personal data with third parties where necessary and lawful, including:

  • Website hosting and technical service providers;

  • Email, newsletter, or communication service providers;

  • Payment processors, where applicable;

  • Analytics providers, where applicable and permitted;

  • IT maintenance and security providers;

  • Professional advisers, auditors, or legal representatives;

  • Public authorities or other recipients where required by law.

Third-party service providers may only process personal data in accordance with the applicable legal requirements and, where necessary, our documented instructions and contractual safeguards.

7. International Data Transfers

Some service providers may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we will ensure that the transfer complies with the GDPR and that appropriate safeguards are in place where required. These may include:

  • Transfers to countries covered by an applicable European Commission adequacy decision;

  • Standard Contractual Clauses approved by the European Commission, together with any additional measures required;

  • Other lawful transfer mechanisms permitted under applicable data protection law.

Further information about the safeguards applicable to a particular transfer may be requested using our contact details.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account applicable legal requirements.

Retention periods may depend on:

  • The nature of the information and the purpose of processing;

  • The duration of any ongoing correspondence, subscription, or contractual relationship;

  • Applicable tax, accounting, or other statutory retention obligations;

  • The need to establish, exercise, or defend legal claims.

When personal data is no longer necessary, it will be deleted or anonymised, where appropriate and technically feasible.

9. Your Rights Under the GDPR

Subject to the conditions and limitations established by applicable law, you may have the right to:

  • Access: Obtain confirmation of whether we process your personal data and request a copy.

  • Rectification: Request correction of inaccurate or incomplete personal data.

  • Erasure: Request deletion of your personal data where the legal conditions are met.

  • Restriction: Request restriction of processing in certain circumstances.

  • Data portability: Receive certain personal data in a structured, commonly used, machine-readable format and request its transfer where applicable.

  • Object: Object to processing based on legitimate interests and, at any time, to processing for direct marketing.

  • Withdraw consent: Withdraw consent where processing is based on consent.

  • Lodge a complaint: Submit a complaint to the competent data protection supervisory authority.

To exercise your rights, contact us using the details provided in Section 1. We may need to verify your identity before responding.

In Portugal, the national data protection supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD). You can find further information at https://www.cnpd.pt.

10. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access.

However, no method of t