Privacy Policy

1. Data Controller

• Controller: Paulo Meireles
• Website: paulomeireles.pt
• Email: contacto@paulomeireles.pt

2. Personal Data Collected

This website currently operates in a passive manner regarding personal data:

• “Start a Project” form. The form at /iniciar-projeto collects name, email, subject (optional), message, and consent. This data is used exclusively to respond to your request — see section 5.
• No user accounts. No user registration for visitors. An administrative area (/admin) is restricted to the data controller — see section 6.
• No third-party analytics. Google Analytics, Meta Pixel, or any other audience measurement tools are not used.
• No profiling or advertising cookies. See the Cookie Policy for details.

3. Technical Navigation Data

The servers hosting this website (own infrastructure on a Kubernetes cluster, located in Portugal / European Union) and the proxy layer may log standard technical data required for the operation and security of the service: IP address, request date and time, requested resource, and user agent. These logs:

• Are necessary to provide the service and ensure its security;
• Are not associated with individual profiles or used for marketing;
• Are kept for the strictly necessary period and then deleted.

The legal basis is the controller's legitimate interest (Article 6(1)(f) GDPR) in the protection and stability of the service.

4. Theme Preference (local storage)

The site stores your theme preference (light/dark) in your browser's localStorage. This information never leaves your device and is considered strictly necessary for the user experience — it does not require consent.

5. “Start a Project” Form

The form at /iniciar-projeto allows you to send a contact request. When submitted, the following data is collected and processed:

• Data collected: name, email, subject (optional), and message.
• Purpose: to analyze your request and reply by email with questions or a proposal.
• Legal basis: your consent (Article 6(1)(a) GDPR), given through the privacy policy acceptance checkbox on the form.
• Processing: the submission is received by email at contacto@paulomeireles.pt (OVH hosting) via secure SMTP (SMTPS). Sending credentials are managed in the backoffice and are not publicly exposed.
• Retention: the data stays in the mailbox for the time strictly needed to respond and, thereafter, for the applicable legal retention period for email messages. They are not stored in a separate website database.
• Deletion: you can request deletion of your request at any time by emailing contacto@paulomeireles.pt.

The newsletter is not yet active; when it is, this section will be updated with the relevant details (likely provider: Listmonk).

6. Administrative Area (Backoffice)

The site has an administrative area at /admin, restricted to the data controller and their team, for content management. This area:

• Authentication: uses credentials from the content management system (Directus). Visitors have no access and cannot create accounts.
• Session cookie: authentication is maintained through a signed cookie (pm_admin_session, httpOnly, HMAC-SHA256, valid for 7 days), strictly necessary for the administrative session. See Cookie Policy.
• Backoffice theme preference: stored in localStorage (key pm-admin-theme), only in the administrative area.
• Content management: site content (articles, projects, services) is managed through Directus (headless CMS) with storage in a MariaDB database, own infrastructure located in Portugal / European Union.
• Contact submission data: form submissions are sent by email (SMTPS) and are not stored in a separate website database.

7. Third-Party Sharing

We do not sell or transfer your data to third parties. Any subcontractors (e.g., hosting provider) act as data processors under our instructions and data processing agreements, within the European Economic Area.

8. International Transfers

Data processed by this website is not transferred outside the European Economic Area. If such transfers occur, adequate safeguards will be ensured under Chapter V of the GDPR.

9. Your Rights

As a data subject, you have the following rights:

• Access to your personal data;
• Rectification of incorrect or outdated data;
• Erasure (“right to be forgotten”);
• Restriction of processing;
• Data portability;
• Objection to processing;
• Withdrawal of consent at any time (without affecting the lawfulness of processing already carried out).

To exercise any right, email contacto@paulomeireles.pt. You also have the right to lodge a complaint with the competent supervisory authority in Portugal — Comissão Nacional de Proteção de Dados (CNPD).

Brazil (LGPD): For users in Brazil, the General Data Protection Law (Law No. 13.709/2018 — LGPD) grants rights equivalent to those under the GDPR. The data controller commits to respecting data subjects' rights in Brazilian territory. You may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

10. Security

We apply appropriate technical and organizational measures: HTTPS (TLS) access, encrypted traffic, regular updates, network segmentation, and the principle of least privilege in the infrastructure.

11. Changes to This Policy

We may update this policy whenever data processing materially changes. The “Last updated” date at the top of the page will reflect the current version.

12. Contact

For privacy-related questions: contacto@paulomeireles.pt.