Privacy Policy
Last updated: 13 October 2026
This policy explains what personal data is processed when you visit www.belrung.pt or contact us through the form, for what purposes, and what your rights are under the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and Portuguese Law 58/2019.
1. Data controller
Belrung Informática Lda, Tax ID (NIPC) 513788220. Privacy contact: [email protected].
Appointing a Data Protection Officer (DPO) is not required for this activity.
2. Data we process
| Source | Data | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| Contact form | Name, email, company (optional), message content | Replying to your request and, where applicable, preparing a proposal | Consent (point (a)) and pre-contractual steps at your request (point (b)) |
| Server technical logs | IP address, date and time, requested page, browser (user agent) | Security, abuse prevention and error diagnosis | Legitimate interest in keeping the site secure (point (f)) |
We do not collect special categories of data. Please do not include them in your message.
Your IP address is also held in memory only, for at most one hour, to limit the number of form submissions (spam protection). It is not written to disk for this purpose.
3. What we do not do
- We do not use cookies, analytics, advertising or tracking tools (see the Cookie Policy).
- We do not load third-party resources: fonts, scripts and images are served from our own server.
- We do not sell or share data with third parties for commercial purposes.
- We do not carry out automated decision-making or profiling.
4. Recipients and processors
- Website hosting: our own server, managed by Belrung and located in Portugal.
- Email: form messages are delivered to our mailbox, hosted on Apple’s iCloud Mail service. Apple acts as a processor. For customers in the EU the service is provided by Apple Distribution International Ltd. (Ireland); transfers to the US may occur under the EU-U.S. Data Privacy Framework and/or standard contractual clauses.
Data may also be disclosed to authorities where required by law.
5. Retention
- Contact messages: 24 months after the last contact, unless they lead to a contractual relationship — in which case statutory periods apply (e.g. tax and accounting obligations).
- Server technical logs: 30 days, then automatically deleted.
- IP address for rate limiting: up to 1 hour, in memory only.
6. Your rights
You may at any time request access to, rectification or erasure of your data, restriction of or objection to processing, and portability of the data you provided. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise these rights, write to [email protected]. We reply within one month at the latest.
You also have the right to lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.
7. Security
The site is served exclusively over HTTPS with restrictive security headers. Access to the server and to the mailbox is restricted and protected by strong authentication.
8. Changes
This policy may be updated. The date of the last update is shown at the top of the page.