Privacy Policy

1. Controller and contact

Genwinit unipessoal, Lda, trading as GenwinIT, is the controller for the processing described here. Contact us at geral@genwinit.pt or at the published contact address: Rua Serpa Pinto, nº 74, 1º, 2350-552 Torres Novas, Portugal. We will update this notice when purposes, providers or other material aspects of processing change.

geral@genwinit.pt

2. Data we receive

We receive information you provide through the form, by email or through a representative of your organisation. Name, email address and message are required in the form; without them you cannot submit the request. Telephone and company are optional. We also receive the language and context of the enquiry, such as interest in a demonstration or plan.

You can browse without providing this information. Limit messages to what is necessary and avoid credentials, customer documents or sensitive data. The website and security services receive your IP address and technical information about the request, browser and device.

With your analytics permission, data includes pages visited, referral sources, browser identifiers, interactions, performance and errors. Hotjar uses heatmaps and session recordings; contact-form content is marked for suppression in those recordings.

3. Purposes and legal bases

We use contact details and messages to reply, prepare quotations, arrange demonstrations and follow up on the request. For business representatives, the basis is our legitimate interest in responding to requested correspondence (GDPR Article 6(1)(f)). When an individual requests steps towards a contract with us, Article 6(1)(b) applies. Sending a message does not subscribe you to marketing.

Serving pages and preventing spam and abuse rely on our legitimate interest in keeping the website and communications secure. An automatic security check may prevent form submission; you can retry or email geral@genwinit.pt. This process does not make solely automated decisions with legal or similarly significant effects on you.

Usage analytics, session recordings and performance diagnostics require consent (Article 6(1)(a)). The separate advertising choice uses the same basis for Google Signals, demographic and interest insights and personalised advertising. Google may associate visits with signed-in users who have permitted that association.

4. Recipients and transfers

Authorised GenwinIT staff receive and follow up on enquiries. Dominios.pt provides hosting and email; Cloudflare Turnstile checks for abuse; Amazon Web Services receives and validates the form; Resend delivers the message. With the corresponding permissions, Google Analytics / Google Signals, Hotjar and New Relic receive usage data; Google Tag Manager manages analytics tools. The table below explains each service.

The form-receiving service is in Paris. Resend stores data in the United States and its agreement incorporates EU Standard Contractual Clauses. Hotjar documentation identifies hosting in Ireland; these locations do not guarantee that all access and processing remain within the European Economic Area.

Other providers offer international-transfer terms, but coverage for our accounts and all processing countries have not yet been confirmed. You can request information or copies of safeguards at geral@genwinit.pt. We do not present this outstanding verification as a guarantee of exclusively European processing.

5. Retention

We currently keep received emails indefinitely, without automatic age-based deletion. The necessity of retaining every enquiry indefinitely has not yet been documented; applicable erasure rights remain available. Hosting log and backup retention have not been confirmed.

Resend retains emails and delivery logs for 30 days and backups for 7 days. Technical logs for the form-receiving service have a configured retention of 14 days. These periods do not determine how long we keep the received email.

Google Analytics retains events for 2 months and user data for 14 months; the user-data period restarts with new activity, and most aggregate reports are outside these limits. Hotjar publishes 365 days for recordings and heatmaps. New Relic browser events and errors have an 8-day retention, which does not extend to every metric.

6. Cookies and privacy choices

Optional tools load only after an affirmative choice. “Analytics and experience” and “Personalisation and advertising” are independent options, initially unchecked. You can refuse both and continue browsing and sending enquiries. Turnstile checks form security independently of these options.

The choice stored in your browser is valid for 180 days; we then ask again. You can change it using “Privacy preferences”. Withdrawing permission stops the corresponding tools but does not erase data already sent or automatically remove existing cookies. Withdrawal does not affect the lawfulness of earlier processing.

The table lists services and documented storage durations. Provider defaults are labelled as such: the actual inventory of cookies and storage for this installation has not yet been confirmed.

7. Rights and complaints

Under the conditions in the GDPR, you can request access, rectification, erasure, restriction and portability, withdraw consent, and object to legitimate-interest processing because of your particular situation. Some rights depend on the basis and context of processing; legal retention obligations may limit erasure.

Send requests to geral@genwinit.pt. We will only ask for proportionate identification needed to handle them. We normally respond within one month, subject to GDPR extensions. You may complain to the Portuguese Data Protection Authority (CNPD) and seek a judicial remedy.

Portuguese Data Protection Authority (CNPD)

8. Provider and storage reference

Cookie durations below are published defaults, not a confirmed inventory of this website. Settings, activity and browser restrictions can change them. Server retention differs from storage on your device.