1. Scope and data controller
LTWS - Lusitec Web Services is Lusitec's web development subsidiary. The data controller is Lusitec - Serviços de Internet e TI, Unipessoal Lda., company number PT 518914100, with registered office at Rua do Mourato, N.º 70A, Correio 86, 9600-224 Ribeira Seca, Ribeira Grande, Azores, Portugal.
The Data Protection Officer can be contacted at [email protected].
2. Personal data we may collect
We only collect data appropriate to the requested contact or necessary for website operation and security.
- Contact data: name, email, company or organisation and information included in the message.
- Project data: requested service, goals, requirements and any other information voluntarily submitted.
- Technical data: IP address, date and time, browser, operating system, requested page and server security logs.
- Contract and invoicing data if the enquiry develops into a commercial relationship.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering enquiries and preparing proposals | Pre-contractual steps at the data subject's request and legitimate interest in answering professional contacts |
| Performing contracts and providing services | Performance of a contract |
| Invoicing and accounting obligations | Compliance with a legal obligation |
| Security, abuse prevention and technical logs | Legitimate interest in protecting the website, systems and users |
| Marketing communications, where applicable | Prior, specific and withdrawable consent |
4. Contact form
Data submitted through the form is used solely to review and answer the enquiry, prepare a potential proposal and take steps requested by the data subject. Confirming that the policy has been read is not treated as consent for marketing.
Required fields are necessary to identify the enquiry and provide an answer. Company and service type may be optional.
5. Recipients and service providers
Access is limited to staff and providers who need the data for the stated purposes. We may use hosting, email, security, maintenance, invoicing and technical support providers subject to confidentiality and data protection duties.
We do not sell personal data. Data is only disclosed to authorities or third parties when required by law, necessary for a contract or supported by another lawful basis.
6. International transfers
We favour processing within the European Economic Area. Where a provider involves a transfer to a third country, we apply an appropriate legal mechanism such as an adequacy decision or Standard Contractual Clauses and assess the relevant safeguards.
7. Retention periods
| Category | Indicative period |
|---|---|
| Enquiries that do not lead to engagement | Up to 12 months after the contact is closed |
| Project and support data | For the contractual relationship and up to 3 years after completion, unless another duty or legitimate need applies |
| Invoicing and tax data | 10 years under applicable legal requirements |
| Technical and security logs | Usually up to 6 months, except in the event of an incident or legal duty |
| Marketing | Until consent is withdrawn or the data is no longer required |
8. Data subject rights
Where applicable, you may exercise the following rights by writing to [email protected]. We may request information necessary to confirm the requester's identity.
- Access and a copy of personal data.
- Correction of inaccurate or incomplete data.
- Erasure where no basis for retention remains.
- Restriction of processing.
- Data portability where applicable.
- Objection to processing based on legitimate interests.
- Withdrawal of consent without affecting prior processing.
- The right not to be subject to solely automated decisions with significant effects.
9. Security
We apply technical and organisational measures appropriate to risk, including secure connections, access control, updates, backups, monitoring and incident response procedures. No system is completely invulnerable, but measures are reviewed regularly.
10. Children and automated decisions
This website and our business services are not directed at children under 16. We do not use data collected through this website for solely automated decisions or profiling with legal effects.
11. Complaint to a supervisory authority
Without prejudice to contacting us first, you have the right to complain to the Portuguese Data Protection Authority at www.cnpd.pt or another competent supervisory authority.
12. Changes and contact
This Policy may be updated to reflect legal, technical or service changes. The current version and date will be published on this page.
Privacy questions and rights requests: [email protected]. General LTWS project enquiries: [email protected].