# Privacy Policy

Last updated : April 2026 · Version 1

Milpat Portugal, Unipessoal Lda. (NIF 514383968, head office at Travessa da Veiga do Leça 72, 4825-243 Lamelas, Portugal) respects your privacy and complies with the General Data Protection Regulation (EU 2016/679, "GDPR"). This policy describes how we collect, process and protect your personal data.

## 1. Data controller

Milpat Portugal, Unipessoal Lda.
Email : gdpr@milpat.pt
Address : Travessa da Veiga do Leça 72, 4825-243 Lamelas, Portugal

## 2. What data we collect

Only the data you voluntarily provide through the milpat.pt forms or by email :

- Identification data : name, job title, company
- Contact data : business email, phone
- Operational data : store name, intervention address, on-site contact
- Technical data : strictly necessary cookies (see section 8)

We do not collect sensitive data (health, political opinions, religion, etc.). We do not sell or share data with third parties outside the purposes described below.

## 3. Purposes and legal basis

- Answering business requests — basis : pre-contractual measures, GDPR art. 6(1)(b).
- Scheduling and performing interventions — basis : contract execution, GDPR art. 6(1)(b).
- Invoicing and accounting obligations — basis : legal obligation, GDPR art. 6(1)(c).
- B2B commercial prospecting for new professional contacts — basis : legitimate interest, GDPR art. 6(1)(f), with clear opt-out in every email.

## 4. Data retention

- Inactive prospects : 3 years from last contact.
- Active clients : duration of the relationship + 10 years for accounting obligations.
- Technical site logs : 6 months.

## 5. Your rights

Under GDPR, you can exercise the following rights :

- Access to your data
- Rectification of inaccurate data
- Erasure (right to be forgotten)
- Restriction of processing
- Portability of your data
- Objection to processing for prospecting

To exercise these rights, email gdpr@milpat.pt with proof of identity. We respond within 30 days. If you consider your rights are not being respected, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) : www.cnpd.pt.

## 6. Data security

We implement appropriate technical and organisational measures : in-transit encryption (HTTPS), access control, daily backup, strong password policy, GDPR training for the team.

## 7. Sub-processors

We use the following providers for the site and our services. All are covered by GDPR-compliant Data Processing Agreements (DPA) :

- Formspree (form submissions) — USA, EU standard contractual clauses.
- Web hosting : [to fill].
- Professional email : Google Workspace / Microsoft 365 — EU.
- CRM : [to fill].

## 8. Cookies

The milpat.pt site uses only strictly necessary cookies (e.g. cookie preference management, language preference). We do not use advertising cookies or intrusive analytics (Google Analytics, etc.). Your choice is stored in your browser via localStorage and can be changed at any time by clearing site data.

## 9. Policy changes

This policy may be updated to reflect legal or service changes. The last update date is shown at the top of this page. Material changes are communicated to registered contacts.

## 10. Contact

For any question about this policy or data processing : gdpr@milpat.pt.

← Back to home