Privacy Policy

This Privacy Policy has been drafted in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and with Portuguese Law No. 58/2019, of 8 August, which ensures the implementation of the GDPR in Portugal.

1. Data Controller Identification

2. Legal Framework

This policy is governed by Regulation (EU) 2016/679 (GDPR), Portuguese Law No. 58/2019 of 8 August (the law implementing the GDPR in Portugal), Portuguese Law No. 41/2004 of 18 August (on privacy in electronic communications, as amended by Law No. 46/2012), and by Article 35 of the Portuguese Constitution. The competent supervisory authority is the Portuguese Data Protection Authority (CNPD).

3. Personal Data We Collect

We collect personal data in the following circumstances:

• Contact form: name, email, phone, company and message content.
• Meeting scheduling: name, email and selected date/time, via the Nextcloud platform.
• Direct contact: data voluntarily provided by email or phone.
• Contractual relationship: data necessary for the performance of service contracts (name, address, tax ID, billing data).
• Browsing data: IP address, browser type, operating system, pages visited, access date/time — collected through cookies and analytics tools (see Cookie Policy).

We do not collect special categories of personal data (sensitive data under Article 9 of the GDPR), such as data on health, ethnic origin, or political or religious beliefs.

4. Purposes and Legal Basis for Processing

5. Data Sharing with Third Parties

Your data may be shared with the following categories of recipients, strictly to the extent necessary:

• Technology service providers: web hosting, email, cloud platforms (acting as processors under Article 28 of the GDPR).
• Public authorities: when required by law or court order.
• Accounting and tax advisory services: for compliance with tax and accounting obligations.

We do not sell, rent or transfer your personal data to third parties for marketing purposes. All processors are bound by data processing agreements in compliance with Article 28 of the GDPR.

6. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). In such cases, we ensure that appropriate safeguards are in place, namely European Commission adequacy decisions, standard contractual clauses approved by the European Commission (Articles 46 and 49 of the GDPR), or other suitable legal mechanisms. You may request information about the safeguards applied by contacting us.

7. Data Subject Rights

Under Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access (Art. 15): obtain confirmation as to whether your data is being processed and access that data.
• Right to rectification (Art. 16): request correction of inaccurate data or completion of incomplete data.
• Right to erasure (Art. 17): request deletion of your data when it is no longer necessary for the purpose that motivated its collection.
• Right to restriction of processing (Art. 18): request restriction of the processing of your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21): object to the processing of your data, including for direct marketing purposes.
• Right to withdraw consent (Art. 7(3)): withdraw your consent at any time, without affecting the lawfulness of processing carried out previously.

To exercise any of these rights, contact us at info@flexispectrum.pt. We will respond within a maximum of 30 days, in accordance with Article 12(3) of the GDPR.

8. Right to Complain to the Supervisory Authority

If you consider that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with the competent supervisory authority:

9. Security Measures

Flexispectrum adopts appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction, including: encryption of data in transit (SSL/TLS), access controls, regular backups, security updates and staff awareness training. In the event of a personal data breach that results in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with Article 34 of the GDPR.

10. Minors' Data

Our services are not directed at minors under the age of 16 (the minimum age of consent in Portugal, under Article 8(1) of the GDPR and Article 16 of Portuguese Law No. 58/2019). We do not intentionally collect personal data from minors. If we become aware that data has been collected from a minor without the consent of the holder of parental responsibility, we will proceed to delete it immediately.

11. Changes to This Policy

This Privacy Policy may be updated periodically to reflect changes in our practices or in applicable legislation. The updated version will always be published on this page, indicating the date of the last revision. We recommend checking this page regularly.