Privacy Policy

The controller responsible for processing your personal data is Obraatelier 230, Unipessoal Lda., trading as Alma de Luce, with registered office in Joane, Portugal, and taxpayer number PT509444598.

For any matter related to your personal data or to the exercise of your rights, you may contact us at bdm@almadeluce.com.

We may collect the following categories of personal data:

• Identification and contact data: full name, professional email, phone or WhatsApp number, country, company name and professional role.
• Project information: any details, drawings, renders, technical files or attachments you voluntarily share through our contact form.
• Navigation and technical data: IP address, device and browser information, pages visited, referral source, UTM parameters and other data collected through cookies and similar technologies.

We process personal data for the following purposes and on the following legal bases:

• Responding to your enquiries and preparing commercial proposals — pre-contractual measures taken at your request (Article 6(1)(b) GDPR).
• Managing the commercial relationship and contractual obligations — performance of a contract (Article 6(1)(b) GDPR).
• Compliance with legal, tax and accounting obligations — legal obligation (Article 6(1)(c) GDPR).
• Website analytics and performance measurement — your consent and our legitimate interest in improving our services (Article 6(1)(a) and (f) GDPR).
• Direct marketing communications to existing clients, where permitted, with the right to object at any time — legitimate interest (Article 6(1)(f) GDPR).

The Website uses cookies and equivalent technologies to ensure proper functioning, to measure audience and to improve user experience. We rely on the following third party tools:

• Google Tag Manager / Google Analytics — to manage tags and analyse aggregated website traffic.
• Contentsquare — to understand how visitors interact with our pages and improve user experience.

You can manage or withdraw your consent at any time by changing the cookie settings of your browser. Disabling cookies may affect the functionality of certain features of the Website.

Alma de Luce does not sell or rent personal data. Your data may be shared with the following categories of recipients, strictly to the extent necessary:

• service providers that support our IT, hosting, email, analytics and CRM operations, acting as data processors under our instructions;
• professional advisors (accountants, lawyers, auditors) when required;
• public authorities, when there is a legal obligation to do so.

Some of these providers may be located outside the European Economic Area. In such cases, transfers are made on the basis of adequacy decisions of the European Commission or appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission.

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations:

• Project enquiries that do not lead to a contract: up to 24 months from the last contact.
• Contractual and accounting records: for the periods established by Portuguese tax and commercial law, generally up to 10 years.
• Analytics and cookie data: for the periods defined for each cookie, as detailed in the corresponding tool.

Under the GDPR, you have the right to:

• access your personal data and obtain a copy;
• request the rectification of inaccurate or incomplete data;
• request the erasure of your data, where the conditions are met;
• request the restriction of processing or object to it;
• request the portability of the data you have provided to us;
• withdraw, at any time, the consent given, without affecting the lawfulness of prior processing.

You may exercise these rights by contacting us at bdm@almadeluce.com. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), available at www.cnpd.pt.

Alma de Luce implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or destruction, including encrypted connections, restricted access and regular review of security practices.

This Privacy Policy may be updated to reflect changes in our practices or in applicable law. The most recent version will always be available on this page, identified by the “Last updated” date above.