Privacy Policy

Last updated: 29 October 2026

1. Who is responsible

Cristovão Gonçalo Miguel dos Reis, self-employed sole trader (empresário em nome individual), Portuguese tax number (NIF) 228839114, with mailing address at Rua Castilho 14C, 5.º andar, 1250-069 Lisboa, Portugal, who runs WebVigia, is the controller ("we"). Privacy contact: contact@webvigia.com.

2. Business outreach

This section is for the businesses we contact by email with a website proposal.

• Who we contact: only companies: in Portugal (legal persons), in Ireland (companies registered with the Companies Registration Office) and in the United Kingdom (companies and LLPs registered at Companies House), at a generic email address the company has made public (for example geral@ or info@, or the email the company shows on its public listing, as long as it does not contain a person's name). In none of these countries do we send this kind of email to sole traders, self-employed people or partnerships, or to personal addresses. In Portugal, before each send we check the opt-out list of the Portuguese Directorate-General for Consumers (Law 41/2004, art. 13-B) and do not contact the companies on it. In Ireland and the UK, we do not contact businesses that have already objected. Every email identifies the sender and gives a simple, free way to ask us to stop (Ireland: S.I. No. 336/2011, reg. 13; UK: Privacy and Electronic Communications Regulations 2003, regs. 22 and 23).
• What data we use: the company's legal and trading name, company number, sector, municipality, generic email address, the public page where we found it (and the date), the public aggregate rating (for example «4.8 ★ from 36 reviews»), and the contact history (when we wrote, whether the company replied and any request to stop). We do not collect review texts, names or photos of reviewers, or employee names.
• Where it comes from: public sources checked manually: the company's public listing (for example on Google), for the email and aggregate rating; the Portuguese Ministry of Justice's official company publications (publicacoes.mj.pt) or the permanent certificate, to confirm the company number and legal form; in Ireland, the Companies Registration Office public register; in the UK, the Companies House public register; and the Portuguese opt-out list. We do not buy lists.
• Why and on what basis: to send the company one email with a website proposal and, at most, one follow-up. Basis: our legitimate interest in promoting our service to businesses (GDPR and UK GDPR, art. 6(1)(f)) and, depending on the country, Portuguese Law 41/2004, art. 13-A(3), Irish S.I. No. 336/2011, reg. 13, or PECR, reg. 22. We have balanced this interest against the rights of the people involved, and you can ask us for a copy of that assessment.
• Demos: if we prepared a private demo site, it is deleted after 14 days, or as soon as the company replies «no» or asks for deletion.
• How long: if you do not reply, we delete the data 6 months after our last email. If you reply, we keep the conversation while there is a negotiation; if you become a customer, the contract period and the tax period (10 years for invoices) apply. If you ask us to stop, we keep only the email address and/or domain, the date and the source of the request, in an opt-out list, for as long as we do outreach, so we never contact you again.
• Right to object: you can object at any time, free of charge and without giving reasons (GDPR and UK GDPR, art. 21(2) and (3); Portuguese Law 41/2004, art. 13-A). Just reply to our email (for example with «no»). We stop the same day.

3. Messages you send us, and customers

• Emails you send us: to reply to you. Basis: our legitimate interest in replying. We keep them only as long as needed.
• Customers: the data needed for the contract, invoicing and support, including, where the customer is an individual (sole trader or self-employed), their name, tax or VAT number, business address and business client declaration (business and activity code); where the customer is a consumer resident in Portugal, their name, tax number, home address, consumer client declaration and, where applicable, their express request to start the service and any cancellation notice or complaint. Basis: performance of the contract and legal obligations (invoices: 10 years, art. 52 of the Portuguese VAT Code). For customers outside Portugal we also keep the proof that the VAT number (or Companies House number) was valid. If the customer's site collects data about the customer's own clients, we sign a data processing agreement (GDPR, art. 28). In those cases we process that data only on the customer's behalf and instructions; the customer is the controller.

4. Domains registered in customers' names

Each customer's domain is registered in the customer's name, and the customer is the registrant. To register and manage it, we send the registrar (the company through which we register the domain: Cloudflare, Inc., via Cloudflare Registrar) and the registry for the extension (DNS.PT for .pt, EURid for .eu, IEDR for .ie and Nominet for .uk; for .com, registrant details are usually held only by the registrar, and Verisign mainly receives technical data) the registrant and contact details they require: name, address, email, telephone and, for .pt, the Portuguese tax number.

• Basis: performance of the contract with the customer (GDPR and UK GDPR, art. 6(1)(b)) or, for contact persons named by a company, our legitimate interest in performing that contract (art. 6(1)(f)).
• Who decides about that data once sent: the registrar and the registry process it as controllers, under their own rules and privacy policies, and may publish part of it in WHOIS/RDAP databases (usually less for individuals).
• Transfers: .pt, .eu and .ie registries are in the EU and .uk in the UK (covered by an EU adequacy decision). The registrar (Cloudflare, Inc.) and, for .com, Verisign are in the USA; in that case the transfer is necessary to perform the registration the customer asked for (GDPR, art. 49(1)(b)) or relies on the safeguards in section 5.
• How long: we keep this data while we manage the domain; when the contract ends we hand over the transfer code and stop processing it, except what tax law requires us to keep.

5. Who processes data for us

• Cloudflare, Inc. (USA): hosting of this site, the demos and customers' sites, a database with the anonymous daily totals of the site measurement (section 6), and receiving and forwarding emails sent to our addresses (Email Routing), and registrar for customers' domains (Cloudflare Registrar).
• Zoho (EU data centre, zoho.eu): the @webvigia.com mailbox from which we send prospecting emails, one by one, to the companies described in section 2.

Emails you send us arrive in a Gmail mailbox: Google (Gmail) handles them as an independent controller, under its own Privacy Policy. We do not use tracking pixels or click tracking.

Cloudflare and Google process data in the USA. The transfer relies on the EU–US adequacy decision (Implementing Decision (EU) 2023/1795, «Data Privacy Framework»), under which Cloudflare and Google are certified, and, as a fallback, on the standard contractual clauses approved by the European Commission (GDPR, arts. 45 and 46). For UK data, the UK Extension to the Data Privacy Framework applies. Personal data of people in the UK is processed in Portugal under the UK's adequacy regulations for the European Economic Area. You can ask us for a copy of these safeguards using the contact in section 1.

6. Cookies and site measurement

This site uses no cookies, stores nothing on and reads nothing from your device (not even browser local storage), and uses no measurement scripts or third-party analytics tools. To know how the site is used, we count visits to each page on the server that hosts the site (Cloudflare), from the request your browser already makes to open the page. From each visit we only use the page, the language and, if the address has one, the campaign label (for example ?src=dir-hotfrog; these labels show where a visit came from, never who made it), and we only keep daily totals, which identify no one. We do not count clicks. The browser type is used only to leave robots out of the count and is not recorded. To prevent abuse, we briefly keep in memory a code derived from the IP address, which is only usable for one minute and is never written to our database; the IP address itself is not stored by us. The daily totals are kept in our database at Cloudflare (section 5). Legal basis: our legitimate interest in knowing, in aggregate, how the site is used and in protecting the site against abuse (GDPR, article 6(1)(f)). As with any website, Cloudflare receives your IP address in order to deliver the pages and protect its network; the technical data it processes for those purposes of its own, and how long it keeps it, are governed by Cloudflare's privacy policy. We do not keep access logs.

7. Your rights

You can ask for access, rectification, erasure, restriction or objection, and portability where applicable, by writing to contact@webvigia.com. We reply within one month. You can complain to the Portuguese data protection authority, CNPD (www.cnpd.pt), or to the supervisory authority where you live or work (for example the Data Protection Commission in Ireland or the ICO in the UK).

We do not make decisions based solely on automated processing with legal or similarly significant effects (GDPR, art. 22).

8. Changes

We update the date at the top when this policy changes. The Portuguese version has the same content.