Last updated: [PLACEHOLDER: date of approval]
Looking after people includes looking after their information. This policy explains what personal data ALMA collects, why, and what rights you have under the General Data Protection Regulation (GDPR) and Portuguese law (Law no. 58/2019).
1. Data controller
Raquel Correia Pereira, independent professional, operating under the commercial name ALMA, NIF 268990751, Praceta Irene Lisboa, 1, 2855-397 Corroios, Portugal.
Contact for privacy matters: info@almapersonal.com · +351 910 390 709.
2. What we collect
When you contact us (website form, email or WhatsApp):
- name, email, phone/WhatsApp number, where you are based;
- the kind of support you are looking for and anything you choose to tell us about your request;
- your preferred contact method.
When you become a client, we also collect what we need to help you:
- billing details (name, NIF, address);
- for business clients: the company's details and the name, position and contacts of its representative and contact people;
- addresses where we provide services, how access is arranged for each visit and, if you entrust keys to us, the Key Receipt;
- your preferences, routines, and details of requests and bookings (for example, dates, places, travel details, gift recipients);
- information about other people you ask us to arrange things for (for example, family members or guests), only as needed.
Sensitive information. Some requests may reveal sensitive information, such as dietary requirements, allergies or health-related appointments. We only record it when you give it to us for a specific request, with your explicit consent, and only for that purpose.
We do not collect bank account access, payment details, passwords or credentials, and we will never ask for them. If a task needs a code (for example, a key-safe code), we use it only for that task and do not keep it.
Website. The website does not use cookies. We use Cloudflare Web Analytics, a cookie-free tool that gives us aggregate visit statistics (for example, number of visits and pages viewed) without identifying you or tracking you across other sites.
3. Why we use your data, and the legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Replying to your enquiry and preparing a quote | Steps at your request before a contract (6(1)(b)) |
| Providing the services you request, including coordinating third parties | Performance of a contract (6(1)(b)) |
| Invoicing, accounting and tax obligations | Legal obligation (6(1)(c)) |
| Remembering your preferences so we don't have to ask twice | Performance of a contract (6(1)(b)) |
| Sensitive data given for a specific request | Explicit consent (9(2)(a)) |
| Contact details of business clients' representatives and contact people | Legitimate interest (6(1)(f)) |
| Handling complaints and defending legal claims | Legitimate interest (6(1)(f)) |
We do not use your data for marketing without your consent, and we never sell it.
4. Who we share it with
- Raquel Correia Pereira and Ivo Alexandre Silva Lopes, the two people working at ALMA, under confidentiality obligations.
- Third parties we coordinate on your behalf (restaurants, hotels, suppliers, technicians, professionals): only the information each one needs for your request, and only with your agreement.
- Service providers that help us operate:
- Google (email and secure file storage for client notes)
- WhatsApp / Meta (messaging)
- Netlify (website hosting and contact form)
- Cloudflare (website analytics, without cookies)
- Authorities, when required by law.
International transfers. Some of these providers may process data outside the European Economic Area, for example in the United States. Where they do, transfers rely on adequate safeguards, such as the EU–US Data Privacy Framework or Standard Contractual Clauses. [PLACEHOLDER: safeguards per provider to be confirmed by the lawyer]
5. How long we keep it
- Enquiries that don't become a service: 12 months after our last contact.
- Client data (preferences, requests, service records): while you are a client and for 2 years after the service ends, unless you ask us to delete it sooner and there is no legal reason to keep it.
- Invoices and accounting records: for the period required by Portuguese tax law, currently 10 years.
- Sensitive data: deleted once the specific request is complete, unless you ask us to keep it for future requests.
6. Your rights
You have the right to:
- access your data;
- rectify it;
- erase it;
- restrict or object to its processing;
- data portability;
- withdraw consent at any time, without affecting processing already carried out.
To exercise any of these rights, contact info@almapersonal.com. We reply within one month.
You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
7. Security
We keep your information secure and limit access to the people who need it to help you. Client notes are kept in a shared Google Drive folder accessible only to Raquel and Ivo, protected by two-step verification. We don't keep client information on paper or in loose phone notes.
8. Children
Our services are for adults. We only process data about children when a parent or guardian asks us to arrange something that involves them, and only as needed.
9. Changes
We may update this policy. The current version is always available on our website, with its date.