# Privacy Policy

Sparksoft, Lda. (“we”, “our”) is committed to protecting the privacy of visitors to this website. This privacy policy explains what personal data we collect, how we use it, and what your rights are under the General Data Protection Regulation (GDPR) and Portuguese Law no. 58/2019.

## 1\. Data controller

The controller responsible for processing personal data is **Sparksoft, Lda.**, with its registered office in Porto, Portugal.

**Contact email:** [geral@sparksoft.pt](mailto:geral@sparksoft.pt)

## 2\. Personal data collected

We collect the following personal data in the operation of this website:

| Data | Purpose | Legal basis | Third party | Retention |
| --- | --- | --- | --- | --- |
| IP address, browsing data | Traffic analysis (Google Analytics 4) | Consent | Google LLC (EU-US Data Privacy Framework) | 14 months |
| Name, email, message | Responding to contact requests | Consent | Sparksoft Email API | Until resolution + legal retention |
| IP address | Spam protection (Cloudflare Turnstile) | Legitimate interest (security) | Cloudflare, Inc. | Session duration |
| Font metadata | Loading typefaces (Google Fonts) | Legitimate interest | Google LLC | Session duration |

## 3\. Purposes and legal basis for processing

Personal data is processed for the following purposes:

-   **Website usage analysis**, to understand how visitors interact with our site and to improve the experience. Legal basis: consent (Art. 6(1)(a) GDPR).
-   **Responding to contact requests**, to process and reply to messages sent through the contact form. Legal basis: consent (Art. 6(1)(a) GDPR).
-   **Website security**, to protect the website against abuse and automated attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
-   **Technical operation**, for the correct loading of typefaces and other technical resources. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

## 4\. Recipients of the data

Personal data may be shared with the following recipients:

-   **Google LLC**: analytics and font services
-   **Cloudflare, Inc.**: spam protection
-   **Sparksoft Email API**: processing of contact emails

Data is not sold, rented or transferred to third parties for marketing purposes.

## 5\. International data transfers

Some of our service providers (Google LLC, Cloudflare, Inc.) are based in the United States of America. Data transfers to these providers are covered by the EU-U.S. Data Privacy Framework, which ensures an adequate level of protection for personal data as recognised by the European Commission.

## 6\. Retention periods

Personal data is retained only for the period necessary for the purposes for which it was collected:

-   Analytics data: 14 months from collection
-   Contact form data: until the request is resolved, plus any applicable legal retention period
-   Security data (Turnstile): session duration

## 7\. Data subject rights

Under the GDPR, you have the following rights in relation to your personal data:

-   **Right of access**: to obtain confirmation that your data is being processed and to access it
-   **Right to rectification**: to request correction of inaccurate data
-   **Right to erasure**: to request the deletion of your data (“right to be forgotten”)
-   **Right to restriction of processing**: to restrict the processing of your data in certain circumstances
-   **Right to data portability**: to receive your data in a structured, commonly used format
-   **Right to object**: to object to the processing of your data based on legitimate interests

To exercise any of these rights, contact us at [geral@sparksoft.pt](mailto:geral@sparksoft.pt).

## 8\. Withdrawal of consent

Where data processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can manage your cookie preferences in your browser settings.

## 9\. Right to lodge a complaint

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority:

**Comissão Nacional de Proteção de Dados / CNPD (Portuguese data protection authority)**  
Av. D. Carlos I, 134, 1.º  
1200-651 Lisbon  
[www.cnpd.pt](https://www.cnpd.pt)

## 10\. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or alteration. These measures include encryption in transit (HTTPS/TLS), access controls and security monitoring.

## 11\. Changes to this policy

This privacy policy may be updated from time to time. Any changes will be published on this page with the date of the update. We recommend that you review this page regularly.

## 12\. Contact

For any questions relating to this privacy policy or to the processing of your personal data, contact us at [geral@sparksoft.pt](mailto:geral@sparksoft.pt).

## HubSpot (CRM and marketing automation)

We use the **HubSpot Ireland Ltd** platform (sub-processor, data centres in the European Union via the `eu1` portal) for lead management, meeting scheduling and follow-up email automation. When you submit the contact form or book a meeting, the data you share (name, email, phone, company, message) is processed by HubSpot under the GDPR and the EU Standard Contractual Clauses.

HubSpot sets the following cookies for analysing visitor behaviour:

-   `hubspotutk`: unique visitor identifier (13 months)
-   `__hstc`: tracking session (13 months)
-   `__hssc`: current session (30 minutes)
-   `__hssrc`: session restart flag (session)

You can opt out through your browser’s cookie settings. More information at [legal.hubspot.com/privacy-policy](https://legal.hubspot.com/privacy-policy).