privacy_

Privacy Policy

Last updated: 6 November 2026.

This policy applies to aluacompaixao.pt, aluavitals.pt (Alua Vitals) and aluapraxis.pt (Alua Praxis), all run by Alua Com Paixão. It explains what personal data we process when someone visits one of these websites or contacts us, why, for how long, and what rights each person has. We have tried to keep it simple. Any questions can be sent to info@aluacompaixao.pt.

1. Who is responsible for the data

• Controller: Vitor Alua, sole trader (empresário em nome individual), operating under the brand Alua Com Paixão.
• Tax number (NIF*): 213265907.
• Address: Avenida 5 de Outubro, 78, Almancil (Algarve), Portugal.
• Privacy contact: info@aluacompaixao.pt.

We do not have a Data Protection Officer, as the law does not require one for our activity. Privacy requests are handled directly by the controller, Vitor Alua, who is trained in data protection.

2. Visiting the website

The website is static and hosted by Netlify, in the United States. Like any server, it logs technical data about each visit, such as the IP address, the date and time and the page requested. These logs keep the website secure and working. The legal basis is our legitimate interest in protecting the website (Article 6(1)(f) GDPR*). They are kept for the period set out in Netlify's terms of service.

The website does not use cookies, visitor analytics tools, advertising pixels or local storage in the browser. Typefaces are served by the website itself, with no requests to external services.

3. What data we process, why, and on what basis

We mainly process data that people give us themselves and, in addition, the technical and source data described in this policy. We do not collect special categories of data (for example, health or ethnic origin) through the website. We do not sell data or pass it on for third-party marketing.

3.1 Contact form

• Data: name, email address, message, and confirmation that the person agrees to these data being used to reply.
• Purpose: to reply to the message. The form is received by Netlify (Netlify Forms) and the notification arrives in our email inbox (Google Workspace).
• Legal basis: steps taken at the person's request before entering into a contract (Article 6(1)(b) GDPR) or, where the request has no contractual purpose, our legitimate interest in replying to those who write to us (point (f)).

3.2 Booking a conversation (Cal.com)

• Data: name, email address, the date and time chosen and any notes the person decides to add.
• Purpose: to schedule and prepare a conversation. Booking takes place on an external Cal.com page and the event is added to our Google calendar.
• Legal basis: steps taken at the person's request before entering into a contract (point (b)).

3.3 Questionnaire «Where does your organisation stand?» (Tally)

• Required data: the answers to the questions and, about the organisation, its sector, number of people, the respondent's role, region and the timeframe in which they intend to act. We also record the channel through which the person reached the questionnaire (for example, LinkedIn or a workshop).
• Optional data: name, organisation, email address and telephone number. Anyone leaving contact details must give their consent.
• Purpose: to show an indicative reading of the organisation's situation on screen, with first steps; to send that reading by email to those who leave an address; and, with consent, to contact the person. We use the role, the size of the organisation and the timeframe given to decide the order in which we get in touch.
• Legal basis: the person's own request to receive the reading (point (b)); consent for us to contact them (point (a)).
• No automated decisions: the reading is generated automatically, but it is indicative only. It has no legal effects and does not similarly affect the person. Article 22 GDPR therefore does not apply. Whether and how we get in touch is always a human decision.
• The questionnaire runs on the Tally platform (a company based in Belgium), at plataforma.aluacompaixao.pt/pulso.

3.4 Speculative applications (Careers page)

• Data: the CV and any other data the person sends us by email.
• Purpose: to assess the application and reply.
• Legal basis: steps taken at the person's request before entering into a contract (point (b)). To keep the application for future vacancies, we ask for consent (point (a)).

Please do not send unnecessary data, such as a photograph, marital status or health information.

3.5 Notifications and access requests

• Forms on the Alua Vitals and Alua Praxis websites (proposal request, contact and online-training notification): name, email, phone and organisation where given, and the message. They are received by Netlify and the notification reaches our inbox. They are used to reply to the request or, for the notification, to send one email when the online courses open. Legal basis: steps taken at the person's request before entering into a contract (point (b)); for the notification, consent (point (a)). Requests sent directly by email to info@aluacompaixao.pt follow the same rules.
• «Notify me» (Alua Praxis): the email address, so that we can send news. Legal basis: consent (point (a)), which can be withdrawn at any time.
• Resending access to the Alua Vitals dashboard: the email address, to deal with the request. Legal basis: our legitimate interest in ensuring client organisations can access the service they have contracted (point (f)).

3.6 Clients

We process the contact details of the people who represent each client organisation in order to perform the contract (point (b)) and to meet tax obligations, such as invoicing (point (c)).

Data collected in diagnostic assessments (the Alua Vitals questionnaire) are processed under the contract with each client organisation. This policy does not apply to those data.

4. Summary

5. How long we keep the data

• Contacts with no follow-up (form, bookings, questionnaire, access requests): up to 12 months after the last contact. After that, we delete the data. Questionnaire answers without a name or contact details do not identify anyone and may be kept for statistical purposes only.
• Alua Praxis notifications: until we send the launch notice for the online training; after that, we delete them. Sooner, if the person withdraws consent.
• Applications: we keep the application for up to 12 months, for future vacancies, if the person agrees when we reply. Without that agreement, we delete it after replying. We delete it sooner if the person asks.
• Clients: for the term of the contract. Tax and invoicing records are kept for 10 years, as required by law.
• Server logs: for the period set by Netlify.

6. Who has access to the data

Within Alua Com Paixão, only the team accesses the data, under a duty of confidentiality, and only to deal with requests.

We use service providers that process data on our behalf (processors), under each provider's data processing agreement:

• Netlify (United States): website hosting and receipt of the contact form;
• Google Workspace (Google Ireland, with processing also in the United States): email and calendar;
• Cal.com (United States): booking conversations;
• Tally (Belgium): questionnaire and automatic sending of the reading by email.

We only share data with authorities where the law requires it.

7. Transfers outside the European Union

Some providers process data in the United States. In those cases, the transfer is based on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework (DPF*), or on standard contractual clauses approved by the European Commission. On request, we will state the safeguard that applies to each provider.

8. Required data

Fields marked as required are needed for us to reply. Without them, we cannot deal with the request. All other fields are optional.

9. Each person's rights

Under the GDPR, anyone whose data we process may:

• ask for access to their data and a copy;
• ask for incorrect or incomplete data to be rectified;
• ask for the data to be erased;
• ask for processing to be restricted;
• ask for data portability, that is, to receive the data in a commonly used format or have us send it to another organisation;
• object to processing, including processing based on legitimate interest;
• withdraw consent, without affecting processing carried out before that point.

Simply write to info@aluacompaixao.pt. We reply within one month. In complex cases this period may be extended, as the law allows, and we will say so in advance. We may ask for information to confirm the identity of the person making the request.

There is also the right to lodge a complaint with the CNPD*, the Portuguese data protection authority (www.cnpd.pt).

10. Cookies

Cookies are small files that some websites store in the visitor's browser, for example to count visits or show advertising.

This website does not use cookies or similar technologies (such as pixels or local storage). That is why no cookie banner appears. If this changes, we will ask for consent first and update this policy.

11. Links to other websites

The website links to external services: LinkedIn, Instagram, Cal.com, the cost-of-inaction calculator (custo-da-inacao-alua.netlify.app) and the painel.aluavitals.pt dashboard. These services only open when someone clicks the link. From then on, each service's own privacy policy applies.

The questionnaire appears at plataforma.aluacompaixao.pt, but runs on the Tally platform, which processes the answers on our behalf (see section 3.3).

12. Children

This website is not aimed at children under 16 and we do not knowingly collect children's data.

13. Security

We use providers with recognised security measures, encrypted connections (HTTPS) and access limited to the team members who need the data.

14. Changes to this policy

We may update this policy. The date of the last update is always shown at the top of the page.

15. Legal framework

This policy follows the GDPR* (Article 13), Portuguese Law no. 58/2019, which implements the GDPR in Portugal, Law no. 41/2004 as amended by Law no. 46/2012 (electronic communications and cookies), and Decree-Law no. 7/2004 (electronic commerce). In case of discrepancy, the Portuguese version prevails.

*GDPR — General Data Protection Regulation (Regulation (EU) 2016/679); RGPD in Portuguese. *CNPD — Comissão Nacional de Proteção de Dados, the Portuguese data protection authority. *NIF — Número de Identificação Fiscal, the Portuguese tax identification number. *DPF — EU-US Data Privacy Framework.

Back to the home page →