Privacy Policy

1. Data controller

The data controller is Rafael Alexandre Vicente Lopes, trading as RafaDesigns, Portuguese tax ID (NIF) 250198983, with professional address at Rua Santo Antonio, são joao da talha lote 1002 bobadela. For privacy questions or to exercise your rights, contact contacto.rafadesigns@gmail.com.

2. Data, purposes and legal bases

The planner and contact channels may collect a name, email or phone number, business information, project answers and submitted notes. These data are used to respond, assess needs and prepare proposals, based on pre-contractual steps requested by the person where applicable, and the legitimate interest in responding to genuine professional or business enquiries where appropriate.

When you send a request, it may include the landing page, campaign labels from the link and the referring website’s domain where available. This information helps understand enquiry sources and assess communication, based on the legitimate interest in improving the service. Context is stored in the tab session to survive reloading and is valid for 30 minutes. After that, it is no longer included with requests. The expired record may remain stored until the next commercial page load or preparation of a request for submission, when it is deleted or replaced, or until the tab session ends. It does not include visitor identifiers, data entered in forms or the full referring page address. It accompanies the request sent through Formspree. Where storage is unavailable, it is held only in memory.

For active client management, data are processed to perform the contract where applicable and based on the legitimate interest in managing B2B relationships and authorised contacts at client organisations. Billing and tax data are processed to comply with legal obligations.

Information needed for security, abuse prevention and protection of systems, services and users is processed on the basis of those legitimate interests. Consent is used only where specific processing requires it and it is actually requested.

3. Providers and transfers

The website is hosted and distributed by Vercel. Vercel Analytics measures general, aggregate website usage. The planner form is submitted through Formspree, used for collection, spam protection and notifications. These providers may process technical and contact data needed to deliver their services.

WhatsApp links allow direct, voluntary contact through the Meta platform chosen by the user. RafaDesigns does not receive conversation content through the website, but receives the message when the user sends it on WhatsApp.

Stripe is used as a payment processor through Stripe-hosted payment pages, whose private links are sent manually to the client after agreement on the plan or proposal. There is no public checkout on the website. Stripe processes data under its own privacy and security framework, described in its Privacy Policy.

Where a provider processes data outside the European Economic Area, legal transfer mechanisms and required safeguards are used where applicable, such as adequacy decisions or approved contractual clauses. The respective providers’ policies and conditions also apply.

4. Analytics, technical data and payments

Vercel Analytics provides aggregate information about visits, pages and referrals. RafaDesigns does not use it to identify individual visitors through cookies.

Contact clicks, planner steps, form openings and starts, submission attempts and outcomes, and project clicks are also measured. Events do not include names, contact details or messages entered in forms. WhatsApp clicks indicate interest in making contact; they do not confirm that a message was sent.

Technical data strictly necessary for operation, security, diagnosis and abuse prevention may be processed, including information provided by infrastructure providers.

To process payments, manage recurring charges and transaction records, a name, email, address, phone number and tax identification number may be processed where supplied, along with transaction and payment-method data. The legal bases of contract performance, professional relationship management and compliance with legal obligations described above apply as appropriate.

Payment data are entered on Stripe-hosted pages. RafaDesigns does not need to store full card details for this process. Tax invoices are issued externally and manually, separately from Stripe payment processing.

5. Retention

Planner requests and enquiries that do not become clients are retained for up to 12 months after the last relevant interaction, then deleted or anonymised, unless retention is legally necessary.

Operational client data are retained during the service. After termination, only information reasonably necessary for legal obligations, contract administration, dispute resolution or the establishment, exercise or defence of rights is retained, and is deleted or anonymised when those purposes no longer require identification.

Tax and accounting records and supporting documents are retained for 10 calendar years after the applicable period, under applicable Portuguese tax obligations.

Technical and security information is retained only for the period necessary for security, diagnosis and provider operations, taking into account the periods actually applied by the infrastructure.

6. Rights

Where applicable, you may request access, rectification, erasure, restriction, objection and portability of your data. Where the legal basis is consent, you may withdraw it without affecting the lawfulness of prior processing.

An erasure request may not cover data that must be retained under a legal obligation or for the establishment, exercise or defence of rights. To exercise your rights, contact contacto.rafadesigns@gmail.com. You may also lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, CNPD).