1. Who we are
This policy explains how we handle personal data on collectadpp.com (the website). The controller is:
- Company: [FILL: legal entity name and legal form]
- Registered address: [FILL: registered address in Portugal]
- Company number (NIPC): [FILL: Portuguese company and tax number]
- Privacy contact: [FILL: privacy email address]
- Data protection officer: [FILL: contact details if one is appointed, otherwise delete this line]
2. What this policy covers
It covers visitors of this website and people who contact us. The product itself (the Collecta DPP application and API) has its own notice for account holders: [FILL: link to the application privacy notice].
For the battery and passport data that customers enter into the product, the customer decides what is processed and why, and we process it on the customer's behalf under a data processing agreement (DPA). If your personal data appears in a customer's passport, for example as a supplier or contact person, please contact that customer first. We will help the customer answer your request.
3. What we process, why and on what basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Operating and securing the website | IP address, browser and device type, pages requested, time, referrer (server logs) | Legitimate interest in running and protecting the site (Art. 6(1)(f) GDPR) | [FILL: log retention, in days] |
| Measuring how the site is used, with your consent | Analytics cookie identifiers, pages viewed, approximate location, device and browser data, traffic source | Your consent (Art. 6(1)(a) GDPR and the ePrivacy rules) | [FILL: Google Analytics data retention, in months] |
| Measuring how the site is used, before you choose | Technical data in a request to Google: page address, referrer, browser type, time, IP address and your consent state. No cookies are set. | Legitimate interest in counting visits (Art. 6(1)(f) GDPR) [FILL: lawyer to confirm this basis] | [FILL: Google Analytics data retention, in months] |
| Page-view and performance statistics without cookies (Vercel Analytics and Speed Insights) | Aggregate page views and loading times | Legitimate interest in keeping the site fast and understanding its use (Art. 6(1)(f) GDPR) [FILL: confirm what Vercel stores] | [FILL: retention set by Vercel] |
| Answering your emails and requests | Your name, email address, company and what you write | Legitimate interest in answering business enquiries, or steps before a contract (Art. 6(1)(f) or 6(1)(b) GDPR) | [FILL: how long enquiries are kept] |
| Remembering your choices on the site | Your cookie choice, light or dark theme, developer-docs preferences, stored in your browser | Strictly necessary or requested by you; not read by us on our servers | See the cookie policy |
Giving us this data is not a legal or contractual requirement. If you do not provide it, parts of the site may not work as intended, for example we cannot answer an email we never received.
We do not use automated decision-making or profiling that produces legal effects for you. [FILL: confirm]
4. Cookies and similar technologies
Analytics cookies are set only after you accept them. Read the cookie policy for the full list and for exactly what happens before you make a choice. You can change your choice at any time with "Cookie settings" in the footer.
5. Who receives your data
- Website hosting and delivery: Vercel Inc. [FILL: add any other hosting provider]
- Analytics: Google [FILL: Google entity named in the Google Analytics account, for example Google Ireland Limited]; Vercel Inc. for Vercel Analytics and Speed Insights
- Email: [FILL: email provider for the info and support mailboxes]
- Professional advisers and authorities where the law requires or where we need advice
These providers act on our instructions as processors, except where they act for their own purposes under their own terms. We do not sell personal data.
6. Transfers outside the European Economic Area
Some of these providers are based in, or can access data from, the United States. Where that happens we rely on [FILL: mechanism per provider: the provider's certification under the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses]. Vercel's data processing terms use the Standard Contractual Clauses. You can ask us for a copy of the safeguards at the privacy contact above.
7. How long we keep data
The periods are in the table in section 3. We keep data only for as long as the purpose needs it, or as long as the law requires (for example accounting rules for invoices). Your cookie choice is kept for about six months and then we ask again.
8. Your rights
Under the GDPR you can ask us for access to your data, to correct it, to erase it, to restrict its use, and to receive it in a portable format where that right applies. Write to the privacy contact above. We answer within one month, and we may need to confirm who you are first.
You can complain to a data protection authority. As we are established in Portugal, that is the Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt. You may also complain to the authority where you live or work.
9. Security
We use technical and organisational measures appropriate to the risk. [FILL: only describe measures that are confirmed]
10. Children
The website is for businesses and is not directed at children.
11. Changes and language
We update this policy when our processing changes and show the date at the top. This policy is available in several languages for convenience. [FILL: state which language version prevails]