1. Data Controller Identification
The data controller responsible for the processing of personal information collected through this website is Curiositypoppio Lda., registered under Portuguese Company Registration Number PT 518 904 312, with registered offices located at Estrada da Marinha, Caramujeira, 8400-407 Lagoa, Algarve, Portugal. Our designated Data Protection Officer (DPO) can be contacted directly at [email protected].
2. Personal Data We Collect
We adhere strictly to the principle of data minimization under Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR). Depending on your interactions with our website, we may collect:
- Direct Communications Data: Your name, email address, subject matter, and message content submitted voluntarily via our contact form.
- Technical & Usage Data: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, and anonymized referral URLs collected automatically through server logs.
- Cookie & Consent State: Local storage and cookie indicators confirming whether you have accepted, rejected, or customized tracking parameters.
3. Legal Bases for Processing
We process your personal information under the following legal frameworks established by Article 6 of the GDPR:
- Consent (Art. 6(1)(a)): Where you provide explicit permission for non-essential analytical cookies or direct subscription requests.
- Contractual / Pre-Contractual Measures (Art. 6(1)(b)): To respond to business communications or guide inquiries submitted through our contact portal.
- Legitimate Interests (Art. 6(1)(f)): To monitor server health, mitigate cyber attacks, maintain firewall security, and ensure smooth content delivery.
4. Third-Party Processors and International Transfers
We do not sell, rent, or trade your personal information. Data may be processed by vetted third-party service providers acting strictly as data processors under binding Data Processing Agreements (DPAs). These include cloud infrastructure hosting providers and encrypted email service operators situated within the European Economic Area (EEA). If data is ever transferred outside the EEA, we ensure appropriate safeguards, such as European Commission Standard Contractual Clauses (SCCs).
5. Data Retention Periods
Personal data gathered through contact requests is retained only for the duration required to address your specific inquiry, up to a maximum of 24 months, after which it is securely deleted or anonymized. Technical web logs are routinely purged after 90 days unless required for an ongoing cybersecurity investigation.
6. Your Statutory Rights (GDPR & CCPA)
Subject to statutory exemptions, visitors located in the European Union, United Kingdom, and California retain specific rights regarding their personal data:
- Right of Access: Request confirmation and copies of personal data held regarding you.
- Right to Rectification: Request correction of inaccurate or incomplete records.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal information where processing is no longer necessary.
- Right to Restrict Processing: Limit how we process your information under specific legal disputes.
- Right to Data Portability: Obtain your data in a structured, commonly used, machine-readable format.
- Right to Object: Object to processing founded upon legitimate interests.
- California Consumer Privacy Act (CCPA) Rights: California residents hold the right to know what personal categories are collected, request deletion, and remain free from discrimination for exercising privacy rights. We do not sell consumer personal data.
To exercise any of these statutory rights, submit your request to [email protected]. You also hold the right to lodge a complaint with the Portuguese National Data Protection Commission (Comissão Nacional de Proteção de Dados - CNPD).