Privacy Policy
This policy explains how Smart Demand Unipessoal Lda collects, uses and protects personal data, and what rights you have. It is written to meet Regulation (EU) 2016/679 (the GDPR) and Portuguese Law n.º 58/2019.
1. Who is responsible for your data
The data controller is Smart Demand Unipessoal Lda, Avenida Cidade de Bratislava, 7, 1950-440 Lisboa, Portugal, NIPC 517368625.
For any privacy question or to exercise your rights, write to privacy@smartdemand.xyz. We are not required to appoint a Data Protection Officer and have not appointed one; the address above reaches the person responsible for data protection.
2. What we collect and why
If you contact us
Your name, email address, telephone number if you give it, the name of your organisation and the content of your message. We use it to answer you and to assess whether we can work together. Legal basis: our legitimate interest in responding to business enquiries (Article 6(1)(f)), and steps taken at your request before entering a contract (Article 6(1)(b)).
If you become a client
Contact details for the people we work with at your organisation, correspondence, project records, and any access credentials you provide. We use these to deliver the services and manage the relationship. Legal basis: performance of a contract (Article 6(1)(b)), or our legitimate interest in administering a client relationship where the contract is with your employer (Article 6(1)(f)).
Billing and payment
Billing name and address, VAT number, invoice records and payment status. Card details are entered directly on Stripe's hosted payment pages and never reach our systems; we receive only a confirmation, the last four digits and the card type. Legal basis: performance of a contract (Article 6(1)(b)) and compliance with our legal obligations in tax and accounting law (Article 6(1)(c)).
When you visit this website
This site uses no analytics, no tracking and no advertising technologies, and we set no cookies of our own.
The site is served through Cloudflare, which records standard server logs, and which may set a strictly necessary security cookie (__cf_bm) to distinguish human visitors from automated traffic. These logs may include your IP address, the page requested, the time and your browser's user agent. Legal basis: our legitimate interest in the security and integrity of the site (Article 6(1)(f)). Because no non-essential cookies are set, no consent banner is required.
3. Who we share data with
We do not sell personal data and we do not share it for advertising. We use a small number of service providers who process data on our instructions under a written contract:
- Stripe Payments Europe, Ltd. (Ireland) — payment processing and invoicing.
- Business email and productivity provider — email, calendar and document storage.
- Cloudflare, Inc. (United States) — hosting, DNS and email routing for this website.
- Cloud infrastructure providers established in the European Union — the infrastructure on which we run client projects.
- Our certified accountant (contabilista certificado) in Portugal — statutory bookkeeping and tax filing.
We will name the specific providers in use on request. Clients who need a named sub-processor list receive one as an annex to the data processing agreement.
We also disclose data where we are required to do so by law, by a court or by a competent authority, and to our professional advisers where necessary to establish or defend a legal claim.
4. Transfers outside the EEA
The cloud infrastructure on which we run client projects is provided by companies established in the European Union, so client project data stays within the European Economic Area.
Two of our providers are outside the EEA or may transfer data outside it. This website is served by Cloudflare, Inc., which is established in the United States and operates a global network. Our payment processor, Stripe Payments Europe, Ltd., is established in Ireland but may transfer data to Stripe, Inc. in the United States. Where any transfer outside the EEA takes place, we rely on an adequacy decision of the European Commission, or on the European Commission's Standard Contractual Clauses together with any additional safeguards the transfer requires. You can request a copy of the safeguards in place by writing to privacy@smartdemand.xyz.
5. How long we keep it
- Enquiries that do not lead to work: up to 12 months from the last contact.
- Client records and project material: for the duration of the engagement and 5 years afterwards, to handle questions and defend legal claims.
- Invoices and accounting records: 10 years, as required by Portuguese commercial and tax law.
- Server logs: up to 90 days.
When a retention period ends we delete the data or irreversibly anonymise it.
6. Your rights
Under the GDPR you have the right to request access to your personal data; to have inaccurate data corrected; to have data erased; to restrict processing; to receive data you gave us in a portable format; and to object to processing carried out on the basis of legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting processing already carried out.
To exercise any of these, write to privacy@smartdemand.xyz. We respond within one month and will tell you if we need longer. There is no charge unless a request is manifestly unfounded or excessive.
If you are not satisfied with how we have handled your data, you may lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt, or with the supervisory authority of the EU member state where you live or work.
7. Personal data inside client projects
When we build or operate systems for a client, we may process personal data held in those systems. For that data the client is the controller and we act as a processor on the client's documented instructions, under a data processing agreement that meets Article 28 of the GDPR. We do not use that data for our own purposes. If you are an individual whose data sits in a client's system, please direct your request to that client; we will assist them in responding.
8. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, access control on a least-privilege basis, multi-factor authentication on business accounts, encrypted devices and a limited number of people with access. No system is completely secure, but we take these obligations seriously and review them regularly. Where a personal data breach is likely to result in a risk to your rights, we will notify the CNPD within 72 hours and inform you where the law requires it.
9. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
10. Changes to this policy
We may update this policy. The current version and its date are always shown at the top of this page. If a change is significant, we will tell affected clients directly.
11. Contact
Smart Demand Unipessoal Lda, Avenida Cidade de Bratislava, 7, 1950-440 Lisboa, Portugal · privacy@smartdemand.xyz