1. Data controller
The controller is the Entrepreneurial Project of José Carlos Oliveira Paiva (237578395).
For privacy questions and to exercise your rights, contact [email protected]. The general commercial contact is [email protected].
2. Scope of this policy
This policy covers the corporate website and personal-data processing in contacts, information requests, applications and the contracting or delivery of InSouto services.
Registration, accounts and application operations take place in the InSouto Platform. The portal’s Privacy and Security policy explains registration and business-process data use. Opening that environment does not automatically transfer fields completed on this website.
3. Data we may process and its source
For enquiries, we process the data you provide: name, company, email, topic, plan or service of interest, subject, message and documents you choose to send. Applications or services may also require professional data, project requirements and billing information.
When you select ‘Send message’, required fields are sent to the website server, validated and forwarded by email to [email protected]. The form does not store messages in a website database. The received message and data needed to reply are handled in InSouto’s email service. If direct sending is unavailable, you may use your email application.
The hosting infrastructure receives technical data needed for connection, including IP address, requested resource and browser information, and may process logs for operation and security. Interface preferences are stored in your browser as described in the Cookie Policy.
While a need is being handled, data may also be supplied by your company representative or suppliers involved in the response. Share only necessary information you are authorised to disclose, avoiding sensitive or unjustified third-party data.
4. Purposes and legal bases
We use data to reply to enquiries, explain solutions and prices, assess applications, prepare proposals and provide requested services. Pre-contractual steps and performance of a contract support necessary processing where the individual is a party; for company representatives, legitimate interest in managing the professional relationship may apply where necessary and proportionate.
Billing data and records required for tax, accounting or other legal obligations are processed on those grounds. Limited technical-data processing may be required under legitimate interest to operate and protect the website.
Where processing relies on consent, consent is requested for the specific purpose and may be withdrawn. A contact request is not a subscription to promotional communications, and this form does not automatically add visitors to a newsletter.
5. Sharing with suppliers and project participants
When you request research, a quotation, negotiation or project, necessary information may be shared with suppliers or partners involved in the response so they can assess requirements, establish contact and prepare commercial terms.
For multi-supplier needs, each participant should receive only the requirements and information relevant to its contribution. Participation in a private Digital Cluster does not authorise indiscriminate disclosure of personal data or documents.
Public profiles and commercial materials are prepared within the service and must respect applicable permissions. Data received to answer an enquiry is not published in a profile merely for that reason.
6. Service providers, payments and external links
Hosting, email, accounting and other resources used to operate the service may involve providers acting within their function and applicable confidentiality and data-protection duties. We may also disclose data where required by law or a competent authority.
Product or supply payment terms are agreed directly with the suppliers. The corporate form does not collect payment-card data. Contracting and billing for InSouto services are separate from payments between the company and supplier.
Opening your email application or an external link means using services with their own policies. InSouto does not control the independent processing of those providers or companies you choose to engage.
If necessary processing involves a transfer outside the European Economic Area, GDPR conditions and safeguards must be observed. You may request information about relevant recipients and safeguards through the privacy contact.
7. Data retention
Contact data is retained for the time needed to assess and answer the request and complete related follow-up. For a proposal or contract, retention considers the relationship, legal duties and the need to establish, exercise or defend rights.
Invoices and records subject to tax or accounting duties are kept for legally required periods. When no retention basis remains, data should be deleted or anonymised. A deletion request may not cover information that must be kept by law or to defend rights.
Completed fields remain on the page while you prepare the request and the form is cleared after acceptance. On failure, fields remain so the email alternative can be used. Temporary session and submission identifiers and short-window attempt counters support security and duplicate prevention; they do not include message content. Browser preferences can be removed in browser storage settings.
8. Security and confidentiality
InSouto is committed to protecting personal data through technical and organisational measures appropriate to the information and processing risk, limiting use to the purposes and people that require it.
No system or transmission is risk-free. Protect your credentials, do not share them and report unauthorised access immediately. Do not send unnecessary confidential information; for sensitive projects, agree the channel and sharing rules before sending.
9. Your rights and how to exercise them
You may request access, rectification, erasure, restriction, objection or portability where applicable through [email protected]. Consent may be withdrawn at any time without affecting earlier lawful processing. You may object to marketing at any time.
To protect data, strictly sufficient information may be required to confirm the requester’s identity. Rights are exercised under the GDPR and may be subject to its conditions or exceptions.
A reply is normally provided within one month of receiving a request. Where complexity or request volume justifies it, this may be extended by two months, with notice and reasons provided within the initial period.
If you believe processing infringes your rights, you may complain to Portugal’s National Data Protection Commission (CNPD), without prejudice to other legal remedies.
10. Required data, cookies and automated decisions
Name, email, contact type, subject and message are required to send a contextual request with a reply channel. Company is optional. You may contact InSouto directly by email instead of using the form.
The corporate website does not make decisions based solely on automated processing that produce legal or similarly significant effects. Platform AI features support research; they do not replace business decisions.
The site uses local and session storage for essential interface preferences and a necessary session cookie to validate form submissions and prevent duplicates. No external analytics or marketing tools are installed in this version. See the Cookie Policy and use ‘Cookie preferences’ in the footer.
11. Updates and further information
The last revision date appears on this page. The policy is updated when purposes, channels or processing conditions change; additional information and consent will be provided where necessary.
To understand how a specific request, application or project will be handled, contact [email protected] before sending further information. Read this policy with the Terms and Conditions and the privacy information in the platform you use.