Privacy Policy

1. Who We Are and How to Contact Us

This Privacy Policy explains how Salty Lavender Unipessoal, Lda ("we", "our", or "the agency") collects, uses and protects your personal information.

We are the data controller for the personal data described in this policy.

• Company: Salty Lavender Unipessoal, Lda
• Tax number (NIPC): 515679461
• Registered address: Rua Garcia Domingues, Lote 25, n.º 14, 8100-231 Loulé, Portugal
• Email: hello@saltylavender.com

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and Portuguese Law no. 58/2019 of 8 August.

We have not appointed a Data Protection Officer, as we are not required to do so. Any question about this policy should be sent to the email address above.

2. Information We Collect

We collect different types of information when you use our services.

2.1 Information you provide directly

• Name and contact details
• Email address
• Company or organisation
• Information about your business or project
• Messages sent through our contact form

2.2 Information collected automatically

• IP address
• Browser and device type
• Pages visited on our site
• Time spent on our site
• Referrals from other sites

The information in 2.2 is collected only where you have consented to analytical cookies. If you decline, we do not collect it.

3. How We Use Your Information

Your information is used to:

• Respond to your enquiries and requests
• Provide and improve our services
• Improve the experience on our site
• Send marketing communications, where you have given consent
• Comply with legal obligations
• Prevent fraud and keep our systems secure

4. Legal Basis for Processing

We process your personal data on the following bases:

• Consent (Article 6(1)(a) GDPR): for marketing communications, and for analytical cookies. You may withdraw consent at any time.
• Performance of a contract (Article 6(1)(b)): to provide the services you have engaged us for, and to take steps at your request before entering into a contract.
• Legitimate interest (Article 6(1)(f)): to respond to enquiries, to keep our systems secure, and to promote our services to business contacts. You may object to processing on this basis at any time.
• Legal obligation (Article 6(1)(c)): where the law requires us to keep or disclose records, in particular for tax and accounting purposes.

5. Who We Share Your Information With

We do not sell or rent your personal information. We share it only in the following situations:

• With your explicit consent
• To comply with legal obligations, or to establish, exercise or defend legal claims
• In the event of a merger, acquisition or sale of assets

We also use service providers who process personal data on our behalf, under contract and on our instructions:

• Website hosting and infrastructure: DigitalOcean, LLC
• Content delivery, DNS and security: Cloudflare, Inc.
• Website development and maintenance: Kalin Digital
• Email and business tools: Google Ireland Limited (Google Workspace)
• Website analytics: Google Ireland Limited (Google Analytics)

6. Cookies and Similar Technologies

We use cookies to operate our site and, with your consent, to understand how it is used. Cookies fall into these categories:

• Essential: necessary for basic site functionality. These do not require consent.
• Functional: remember your preferences, such as your language.
• Analytical: help us understand how the site is used. These are set only with your consent.

You can accept or decline non-essential cookies when you first visit the site, and you can change your choice at any time through the cookie settings on our site or by clearing cookies in your browser.

7. Data Security

We put appropriate technical and organisational measures in place to protect your personal information against unauthorised access, alteration, disclosure or destruction, including encryption in transit, access controls and regular monitoring.

8. How Long We Keep Your Information

We keep your personal information only for as long as necessary for the purposes for which it was collected, or for as long as the law requires. In practice:

• Enquiries that do not lead to work: deleted within six months of the last contact.
• Client records: three years from the end of the engagement.
• Accounting and tax records: ten years, as required by Portuguese law.
• Marketing contacts: until you withdraw consent or ask to be removed.

When information is no longer needed, it is securely deleted.

9. Your Rights

Under the GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your data
• Restriction: restrict how we process your data
• Portability: receive your data in a portable format, or have it transferred to another provider
• Objection: object to processing based on our legitimate interests, including direct marketing
• Withdrawal of consent: withdraw your consent at any time, without affecting processing carried out before you withdrew it
• Complaint: lodge a complaint with the supervisory authority (see section 13)

To exercise any of these rights, email us at hello@saltylavender.com. We will respond within one month. If your request is complex, we may extend that period by up to two further months and will tell you if we do.

10. International Transfers

Some of the service providers listed in section 5 are established outside the European Economic Area, or may process data outside it. In particular, our hosting provider, DigitalOcean, LLC, and our content delivery provider, Cloudflare, Inc., are established in the United States.

Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place. For the providers named in section 5, this is the European Commission’s standard contractual clauses, incorporated into our agreement with each of them. You can ask us for details of the safeguards that apply.

11. Automated Decision-Making

We do not use your personal data to make automated decisions that produce legal effects concerning you or similarly significantly affect you, and we do not carry out profiling of that kind.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will note significant changes on our site, and the date of the last update will always appear at the top of this page.

13. Contact and Complaints

For questions about this Privacy Policy, or to exercise your rights, contact us at hello@saltylavender.com.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Portuguese data protection supervisory authority:

• Comissão Nacional de Proteção de Dados (CNPD)
• Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
• geral@cnpd.pt · www.cnpd.pt