Privacy Policy

1. Data Controller / Responsável pelo Tratamento

The controller responsible for processing your personal data is:

This website does not require the designation of a Data Protection Officer (DPO) under Article 37 GDPR / Art. 20 Lei 58/2019, as it is operated by a natural person and does not carry out large-scale systematic monitoring of data subjects. Should this change, this policy will be updated accordingly.

2. Legal Framework / Enquadramento Legal

This policy complies with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
• Lei n.º 58/2019 of 8 August — Portuguese implementing law for the GDPR
• Diretiva 2002/58/CE (ePrivacy) as transposed into Portuguese law via Lei n.º 41/2004, for cookies and electronic communications

3. Data We Collect / Dados Recolhidos

3.1 Information you provide directly

• Contact/booking form: name, email address, optional phone number, message text
• Merchandise checkout: name, email, delivery address, optional VAT number

3.2 Automatically collected data

• Session cookie (PHP PHPSESSID): strictly necessary, stores temporary state (cart, CSRF token, flash messages). No tracking data is stored in this cookie.
• Server logs: IP address, HTTP method, page requested, timestamp — kept for security purposes.
• Error logs: failed login attempts are logged with IP address for abuse prevention.

3.3 Data we do NOT collect

• We do not use analytics tracking services (e.g. Google Analytics) on this website.
• We do not build user profiles or use targeted advertising cookies.
• We do not knowingly collect data from persons under 13 years of age (minimum age per Art. 8(1) GDPR and Art. 16 Lei 58/2019 as applied in Portugal).

4. Purposes & Lawful Basis / Finalidades e Base Jurídica

5. Cookies

We use cookies in compliance with the ePrivacy Directive and Lei n.º 41/2004. You can manage your preferences at any time via the Cookie Preferences panel.

We do not use analytics, tracking, or marketing cookies. If this changes, this policy and the consent mechanism will be updated before any such cookies are placed.

6. Third-Party Data Processors / Subcontratantes

We share data with the following trusted third parties only to the extent necessary:

Google LLC is based in the USA. Transfers are covered by the EU–US Data Privacy Framework (Decision 2023/1795). No other international transfers of personal data are made.

We do not sell, rent, or trade your personal data to any third party.

7. Data Retention / Prazo de Conservação

Data is kept only for as long as necessary for the stated purpose or as required by law:

• Contact/booking form submissions: emails retained in the mailbox for a maximum of 2 years, then deleted.
• Order/quote request emails: retained for 10 years to comply with Portuguese accounting and tax obligations (Código Comercial, Art. 40; CIVA).
• Server & error logs: 90 days, then automatically purged.
• Session cookies: deleted when you close your browser.
• reCAPTCHA cookies: up to 6 months, managed by Google.

8. Your Rights / Os Seus Direitos

Under the GDPR (Arts. 15–22) and Lei 58/2019, you have the following rights:

• Right of access (Art. 15): obtain confirmation of whether we process your data and receive a copy.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): request deletion of your data where it is no longer necessary or you withdraw consent.
• Right to restriction of processing (Art. 18): limit processing in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time — without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making: we do not use automated profiling or decision-making.

To exercise any right, contact us at: info@technik-o.com .
We will respond within 30 days as required by Art. 12 GDPR. Identity verification may be requested before acting on your request.

9. Data Security / Segurança

We implement appropriate technical and organisational measures in accordance with Art. 32 GDPR, including:

• HTTPS/TLS encryption for all data in transit
• CSRF token protection on all forms
• Input validation and output encoding to prevent injection attacks
• Brute-force login protection with automatic account lockout
• Credentials stored outside the webroot in environment-specific configuration files
• Content Security Policy (CSP) with per-request nonces

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours (Art. 33 GDPR) and, where applicable, notify you directly (Art. 34 GDPR).

10. Right to Lodge a Complaint / Direito de Reclamação

If you believe your data has been processed in breach of applicable law, you have the right to lodge a complaint with the Portuguese supervisory authority:

You may also contact the supervisory authority of your EU Member State of habitual residence.

11. Changes to This Policy / Alterações

This policy may be updated to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will be revised accordingly. Material changes will be signalled by a prominent notice on the website for at least 30 days before taking effect.

12. Contact / Contacto