Privacy policy
1. Controller
The controller of personal data collected through this website is Voixa Consultors S.L., trading as BCA Portugal (details above). For any privacy matter write to info@bcaun.pt with «Privacy» in the subject.
2. What we collect, why, and on what basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Contact form: name, email, country, service of interest, message | Answering your enquiry and preparing a quote | Art. 6(1)(b) — steps at your request before a contract | 24 months after the last contact if no engagement follows |
| Email and WhatsApp correspondence you start | Same | Art. 6(1)(b) and (f) | Same |
| Client identification and engagement documents | Delivering the service; anti-money-laundering checks | Art. 6(1)(b) and (c) — Spanish Law 10/2010 and Portuguese Lei 83/2017 | 10 years after the end of the relationship, as those laws require |
| Invoices and accounting records | Tax and accounting obligations | Art. 6(1)(c) | The statutory period, generally 6 years |
| Technical data: IP address, browser, time of request | Delivering and securing the website | Art. 6(1)(f) — security and operation | Short-lived server logs held by our hosting provider |
| Usage statistics, only if you accept analytics: pages viewed, scrolls, outbound clicks, approximate location, device | Understanding which content is useful | Art. 6(1)(a) — consent, withdrawable at any time | Event data 14 months in Google Analytics |
We do not use your data for automated decisions or profiling, we do not sell it, and we do not add you to a mailing list unless you ask us to.
3. Who processes it for us
- Cloudflare, Inc. — hosting and security of the website. Processes technical data; may involve transfer to the United States under the EU–US Data Privacy Framework and standard contractual clauses.
- FormSubmit (formsubmit.co) — delivers contact-form messages to our mailbox. The content of the form passes through its servers, which may be outside the EU. If you prefer, email us directly instead.
- Google Ireland Ltd. — the website loads its typefaces from Google Fonts, which means your browser sends your IP address to Google when a page loads. If you accept analytics, Google also processes usage data through Google Analytics 4; Google may transfer data to the United States under the EU–US Data Privacy Framework.
- Our email provider and, if you choose to write on WhatsApp, WhatsApp Ireland Ltd.
- Within the BCA group and to our professional partners, only to the extent needed to deliver a service you have engaged us for, under confidentiality obligations.
4. Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Where processing is based on consent you may withdraw it at any time. Write to the address above; we answer within one month. You may also complain to the Spanish data protection authority (AEPD), our lead authority, or to the Portuguese authority (CNPD) if you live in Portugal.
5. Security
The website is served only over HTTPS. Client documents are kept in access-controlled systems and shared only on a need-to-know basis.
6. Changes
We update this policy when our processing changes. The date at the top shows the version in force.