Privacy Policy
Last updated: February 2026
Sparksoft, Lda. (“we”, “our”) is committed to protecting the privacy of visitors to this website. This privacy policy explains what personal data we collect, how we use it, and what your rights are under the General Data Protection Regulation (GDPR) and Portuguese Law no. 58/2019.
1. Data controller
The controller responsible for processing personal data is Sparksoft, Lda., with its registered office in Porto, Portugal.
Contact email: [email protected]
2. Personal data collected
We collect the following personal data in the operation of this website:
| Data | Purpose | Legal basis | Third party | Retention |
|---|---|---|---|---|
| IP address, browsing data | Traffic analysis (Google Analytics 4) | Consent | Google LLC (EU-US Data Privacy Framework) | 14 months |
| Name, email, message | Responding to contact requests | Consent | Sparksoft Email API | Until resolution + legal retention |
| IP address | Spam protection (Cloudflare Turnstile) | Legitimate interest (security) | Cloudflare, Inc. | Session duration |
| Font metadata | Loading typefaces (Google Fonts) | Legitimate interest | Google LLC | Session duration |
3. Purposes and legal basis for processing
Personal data is processed for the following purposes:
- Website usage analysis, to understand how visitors interact with our site and to improve the experience. Legal basis: consent (Art. 6(1)(a) GDPR).
- Responding to contact requests, to process and reply to messages sent through the contact form. Legal basis: consent (Art. 6(1)(a) GDPR).
- Website security, to protect the website against abuse and automated attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Technical operation, for the correct loading of typefaces and other technical resources. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
4. Recipients of the data
Personal data may be shared with the following recipients:
- Google LLC: analytics and font services
- Cloudflare, Inc.: spam protection
- Sparksoft Email API: processing of contact emails
Data is not sold, rented or transferred to third parties for marketing purposes.
5. International data transfers
Some of our service providers (Google LLC, Cloudflare, Inc.) are based in the United States of America. Data transfers to these providers are covered by the EU-U.S. Data Privacy Framework, which ensures an adequate level of protection for personal data as recognised by the European Commission.
6. Retention periods
Personal data is retained only for the period necessary for the purposes for which it was collected:
- Analytics data: 14 months from collection
- Contact form data: until the request is resolved, plus any applicable legal retention period
- Security data (Turnstile): session duration
7. Data subject rights
Under the GDPR, you have the following rights in relation to your personal data:
- Right of access: to obtain confirmation that your data is being processed and to access it
- Right to rectification: to request correction of inaccurate data
- Right to erasure: to request the deletion of your data (“right to be forgotten”)
- Right to restriction of processing: to restrict the processing of your data in certain circumstances
- Right to data portability: to receive your data in a structured, commonly used format
- Right to object: to object to the processing of your data based on legitimate interests
To exercise any of these rights, contact us at [email protected].
8. Withdrawal of consent
Where data processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can manage your cookie preferences in your browser settings.
9. Right to lodge a complaint
If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
Comissão Nacional de Proteção de Dados / CNPD (Portuguese data protection authority)
Av. D. Carlos I, 134, 1.º
1200-651 Lisbon
www.cnpd.pt
10. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or alteration. These measures include encryption in transit (HTTPS/TLS), access controls and security monitoring.
11. Changes to this policy
This privacy policy may be updated from time to time. Any changes will be published on this page with the date of the update. We recommend that you review this page regularly.
12. Contact
For any questions relating to this privacy policy or to the processing of your personal data, contact us at [email protected].
HubSpot (CRM and marketing automation)
We use the HubSpot Ireland Ltd platform (sub-processor, data centres in the European Union via the eu1 portal) for lead management, meeting scheduling and follow-up email automation. When you submit the contact form or book a meeting, the data you share (name, email, phone, company, message) is processed by HubSpot under the GDPR and the EU Standard Contractual Clauses.
HubSpot sets the following cookies for analysing visitor behaviour:
hubspotutk: unique visitor identifier (13 months)__hstc: tracking session (13 months)__hssc: current session (30 minutes)__hssrc: session restart flag (session)
You can opt out through your browser’s cookie settings. More information at legal.hubspot.com/privacy-policy.