Privacy Policy
This policy describes how ArqWeb processes your personal data when you visit arqweb.pt or contact us. We comply with the EU General Data Protection Regulation (Regulation EU 2016/679 — GDPR) and Portuguese Law 58/2019.
Last updated: June 4, 2026
1. Data controller
ArqWeb, headquartered in Portugal. Contact: geral@arqweb.pt.
2. What we collect
We only collect data you voluntarily provide via the contact form: name, email, phone (optional), company (optional) and the content of your message. We also collect minimal technical data (server logs, IP) for security and abuse prevention.
3. How we use it
Form data is used exclusively to reply to your request and, if there is mutual interest, to prepare a commercial proposal. Technical data is used to keep the site running and prevent spam.
4. Legal basis
We process form data on the basis of your consent (Art. 6(1)(a) GDPR) and/or pre-contractual measures (Art. 6(1)(b)). Technical data is based on our legitimate interest in keeping the site secure (Art. 6(1)(f)).
5. Who has access and sub-processors
Your data is accessed only by ArqWeb staff. We rely on the following sub-processors, all bound by a data processing agreement: site hosting and operation (Vercel Inc., USA); email delivery (Zoho Corporation B.V., Netherlands — ZeptoMail); rate-limiting, abuse prevention and storage of meeting-booking details, which processes an identifier derived from your IP and your booking details (Upstash, Inc., USA); AI generation of the site assistant's replies and of the internal summary of quote requests (Groq, Inc., USA), which processes only the request text and does not retain it for training; scheduling and running meetings via Google Calendar and Google Meet, when you book a meeting with us (Google Ireland Ltd.); and, with consent, measurement and advertising campaigns through the Google tag/Google Ads (Google Ireland Ltd.). Transfers outside the European Economic Area are covered by the EU–US Data Privacy Framework (where the sub-processor is certified) and/or the European Commission's Standard Contractual Clauses. We never sell your data.
6. How long we keep it
Contact messages: up to 24 months, or until you ask us to delete them, whichever comes first. Technical logs: 30 days. Invoicing (if any contractual relationship): 10 years, as required by Portuguese tax law.
7. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data. Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing already carried out. Exercise these rights at geral@arqweb.pt. You may also lodge a complaint with the Portuguese DPA (CNPD — www.cnpd.pt).
8. Cookies
We use essential cookies and, with your consent, measurement and marketing cookies, including the Google tag to measure campaign conversions. You can review the details and manage your preferences at any time in our Cookie Policy at arqweb.pt/cookies.
9. Automated decisions
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, nor do we perform profiling, within the meaning of Article 22 GDPR.
10. Security
The site is served over HTTPS, with modern security headers. Data in transit and at rest is encrypted by our sub-processors.
11. Changes
We may update this policy. The current version is always at arqweb.pt/en/privacy with the last update date.
- ArqWeb
- ArqWeb
- geral@arqweb.pt
- Data protection
- geral@arqweb.pt