Privacy policy

The controller of your personal data is Zoom Target Unipessoal, Lda. (ZoomTarget), Portuguese company and tax number 516853694, with registered office at Rua Joaquim Gomes Barbosa, 59, 1.º G, 4470-778 Vila Nova da Telha, Maia, Portugal.

For any privacy matter, write to [email protected]. Given the company's size and activity, appointing a data protection officer is not required; requests are handled directly by the management.

Contacts and quotes: what you write to us in the website's forms (name, email, phone, business, website and message), by email, phone or WhatsApp.

Customers: the data needed for the quote, the contract and the invoice — name, tax number, billing address and contacts.

Projects: the access and information you give us to do the work — for example, access to the website's hosting or, in an audit, to the systems you authorise us to test.

Security: the IP address of whoever sends a form, to limit abuse. It stays only in the server's memory, for one hour.

We do not count visits or use statistics tools such as Google Analytics.

To answer contact requests and prepare quotes — steps taken at your request before a contract (Article 6(1)(b) GDPR).

To do the work you ordered and talk to you during the project — performance of the contract (Article 6(1)(b)).

To invoice, keep the accounts and answer the authorities — legal obligation (Article 6(1)(c)).

To protect the forms against abuse, with request limits and bot checks — legitimate interest (Article 6(1)(f)).

We make no automated decisions with legal effects on you and do no advertising profiling.

Only with providers that help us deliver the service and process the data on our behalf, under contract and confidentiality obligations: hosting (OVHcloud, servers in Germany), the website's network, protection and bot checks (Cloudflare), email sending (Resend) and the certified invoicing software.

Some of these providers belong to groups based outside the European Economic Area. When data is transferred outside the EEA, it is done with the safeguards the GDPR requires: an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or standard contractual clauses.

We may have to disclose data to the authorities (for example, the tax authority) when the law requires it.

We never sell or rent personal data to anyone.

When, in a project, we process personal data on your behalf (for example, the contacts kept on your website or the data we see in an audit), you are the controller of that data and ZoomTarget acts as processor under Article 28 GDPR: we only process it to do the work, following your instructions, under confidentiality, and never for our own purposes.

Contact requests and quotes: as long as needed to answer you and, if they lead to a contract, while it lasts.

Invoices and accounting records: 10 years, as tax law requires.

A project's access and data: until the end of the project (or of the maintenance service); then they are deleted or handed back.

Data seen in an audit: deleted at the end of the audit. We do not keep passwords.

You can ask for access to your data, its correction, erasure, restriction of processing and portability, and object to processing based on legitimate interest. Write to [email protected]; we answer within one month at the latest.

If you think your data was not handled properly, you can complain to the Portuguese data protection authority (CNPD), at www.cnpd.pt.

Connections to the website always use HTTPS; the forms have bot checks and request limits; and the access you entrust to us is only used by the people working on your project.

The services are meant for people aged 18 or over. We do not knowingly collect data from minors.

If we change this policy in a meaningful way, we will tell our customers by email before the change takes effect. The date of the last update is at the top of this page.