Privacy

1. Controller

Questions and data protection requests may be sent through the contact form, using “Data protection” as the subject. The personal address receiving internal site notifications is not disclosed to users.

2. Data we process

Depending on how you use the website and portal, we may process:

• contact details such as name, email, telephone, organisation and message subject;
• account and authentication data supplied by Auth0, including account identifier, name, email, email verification, profile image and language;
• request and project information such as location, building type, description, participants, messages, decisions, proposals, changes, payments and history;
• technical documents and metadata, including file names;
• professional details supplied by project engineers applying to the platform;
• technical and security data such as IP address, date and time, server requests and error logs, where recorded by the infrastructure.

Do not submit special-category personal data or third-party personal information that is not needed for the project. When naming participants or sharing documents, you must be authorised to do so.

3. Purposes and legal bases

General enquiries

Responding to questions and managing communications, based on the legitimate interest in answering and keeping a record of the enquiry.

Proposal requests and contracting

Reviewing requirements, preparing proposals and taking requested pre-contractual steps; where a contract exists, performing it.

Account, portal and collaboration

Authenticating users, controlling access and managing organisations, participants, documents and communications needed to provide the service and secure the platform.

Projects, payments and obligations

Delivering contracted services, recording decisions, processing payments and complying with tax, accounting and legal obligations.

Security and legal claims

Preventing abuse, investigating incidents, retaining evidence and exercising or defending rights, based on legitimate interests and applicable legal duties.

The website does not use this information for solely automated decisions, commercial profiling or unsolicited marketing. Any incompatible future purpose will be notified in advance and use its own legal basis.

4. Required data

Fields marked as required are needed to answer an enquiry, create an account or assess and manage a request. Without them, the requested feature may not be available. Other fields are optional.

5. Access, providers and transfers

Access is limited to the controller and people authorised for the request or project. Where necessary, data may also be processed by: Clever Cloud for hosting and storage; Auth0 for identity and authentication; MailPace and Google for delivering and receiving messages; IfThenPay when electronic payment is available; and the controller's local technical worker for receiving and processing requests. Invited participants see only work to which they have been granted access.

Some providers may use entities or infrastructure outside the European Economic Area. Where an international transfer occurs, applicable safeguards such as an adequacy decision or Standard Contractual Clauses will be used. Further information may be requested through the contact form.

Information may also be disclosed to accountants, advisers, authorities or courts where required by law or needed to defend legal rights. We do not sell personal data.

6. Retention

• general enquiries with no follow-up: up to 12 months after the matter is closed;
• proposal requests that do not lead to an engagement: up to 24 months after the last interaction;
• accounts with no associated project or obligation: while active and up to 24 months after closure;
• contracted project data and documents: during delivery and then for up to 10 years where needed for contractual or professional obligations, evidence or legal claims;
• accounting and tax-relevant records: 10 years, or a longer special period where legally required;
• technical and security logs: normally up to 12 months, unless an incident or obligation justifies longer retention;
• session cookie: 12 hours; language preference: up to 1 year.

At the end of the applicable period, data is deleted or anonymised unless it must be retained for a legal duty, pending dispute or the exercise of rights.

7. Your rights

Where applicable, you may request access, rectification, erasure, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier processing. You may also lodge a complaint with the Portuguese Data Protection Authority. We may need to verify your identity before completing a request.

8. Cookies

The website currently uses only first-party necessary or functional cookies: “hvac_session” for session, authentication and request protection for 12 hours; and “locale” to retain the selected language for up to 1 year. There are currently no advertising or behavioural analytics cookies. If non-essential cookies are added, consent will be requested before use.

9. Security, changes and scope

Controls include authentication, request- and organisation-based authorisation, session protection, file restrictions and limited access. No system is entirely risk-free; incidents will be handled under applicable law.

This notice applies to the public website, portal, forms, proposals and project collaboration. It may be updated when services or providers change. The version and date below identify the notice in force.