Privacy Policy

1. Data Controller

The controller responsible for processing your personal data is:

2. Data We Collect

We only collect data that you actively provide to us or that is strictly necessary to operate the website and our services:

• General contact form: name, email, company and message content.
• Budget Wizard / budget calculator: name, company, contact details, selected services, engagement scope and the estimated budget range generated.
• CRM (Admin): client company data, contact persons, proposals, invoices, projects and communications history — processed on behalf of client organisations under contract.
• Client Portal: authentication credentials, projects associated with the client, and documents shared by our team.
• Technical data: language preference cookie (pt/en), the cookie_consent cookie storing your consent choice, and the authentication session cookie set by our backend provider (Supabase) for logged-in Admin and Portal users.
• Analytics data, only after consent: pages viewed, approximate location, device/browser information, referral source and interactions such as successful contact or budget requests. We do not send names, email addresses, form contents or other directly identifying form data to Google Analytics.

3. Purpose and Legal Basis for Processing

We process personal data only for the following purposes and on the following legal bases under Article 6 GDPR:

• Responding to contact and budget requests — pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Managing the contractual relationship with our clients, including project delivery, invoicing and support — performance of a contract (Art. 6(1)(b) GDPR).
• Providing access to the Client Portal and sharing project documentation — performance of a contract (Art. 6(1)(b) GDPR).
• Complying with Portuguese tax and accounting obligations related to invoicing — legal obligation (Art. 6(1)(c) GDPR).
• Measuring website usage and improving content and lead journeys through Google Analytics — your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time through Cookie preferences.

4. Data Sharing

We do not sell personal data to third parties. We only share personal data with the following categories of recipients, and only to the extent strictly necessary:

• Supabase — infrastructure provider for database hosting and authentication, acting as a data processor under a data processing agreement.
• Lovable AI Gateway / Google (Gemini models) — when our team uses AI-assisted document analysis on internally uploaded proposals or contracts, the extracted text (which may include names and tax identification numbers) is sent to this processor for automated data extraction. This feature is only available to our staff and is never applied to your personal data without a legitimate business purpose.
• Resend — email delivery provider used to send transactional emails (contact form notifications, budget estimate confirmations, client portal invitations) and internal operational notifications to our own team.
• Google Analytics (Google Ireland Limited) — website audience measurement, activated only after cookie consent. Advertising storage, Google Signals and ad-personalisation signals are disabled.
• External accountant / bookkeeping firm — when required to comply with Portuguese tax and invoicing obligations.
• Public authorities — where required by law (e.g. tax authority, judicial requests).

All processors are bound by confidentiality obligations and process personal data only on our documented instructions.

5. International Data Transfers

Personal data is stored on infrastructure operated by our backend provider (Supabase). Depending on the region assigned to the project, processing may take place inside or outside the European Economic Area (EEA).

6. Data Retention

We retain personal data only for as long as necessary for the purposes described above:

• Leads and budget requests that do not convert into a client relationship: up to 12 months from the last interaction.
• Active client data: for the duration of the contractual relationship plus the applicable legal retention period.
• Invoices and tax-related documents: 10 years, as required by Portuguese tax law.

After the applicable retention period, personal data is deleted or irreversibly anonymised.

7. Your Rights

Under the GDPR, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, as well as the right to data portability. Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, please contact us at privacy@theicon.pt. We will respond within the legal deadlines.

If you consider that the processing of your personal data infringes the GDPR, you also have the right to lodge a complaint with the Portuguese supervisory authority — Comissão Nacional de Protecção de Dados (CNPD), www.cnpd.pt.

8. Cookies and Tracking Technologies

This website uses only essential cookies by default. Google Analytics is loaded only after explicit consent and remains disabled on Admin and Client Portal routes. For a detailed description of the cookies used and how to manage your preferences, please see our Cookie Policy at /cookies.

9. Data of Minors

Our services are directed at companies and business professionals. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, please contact privacy@theicon.pt and we will delete it.

10. Security

We apply appropriate technical and organisational measures to protect personal data, including Row-Level Security (RLS) at the database layer, mandatory Multi-Factor Authentication (MFA) for Admin accounts, encryption in transit (HTTPS/TLS), strict access controls and audit logging of administrative actions.

11. Contact

For any question related to this Privacy Policy or to the processing of your personal data, please contact:

privacy@theicon.pt