Privacy

This notice explains what personal data we handle, why, for how long, and how to exercise your rights.

Who we are and how to reach us

INNOSURE - INNOVATION, MANAGEMENT & IT CONSULTING, LDA, Portuguese tax and legal entity identification number (NIPC) 518587240, trading as CrmWare, is the controller of personal data collected through this website. For anything in this notice, write to dataprivacy@crmware.pt.

What we collect, why, and on what basis

• Contact form. Your name and email address, and your message if you write one. We use them to answer you and to follow up. We also record which page you submitted from and, if you came from another website, that website's address only. Legal basis: your consent, which the form requires before it will submit.
• Booking a meeting. The booking button opens Google Calendar, which asks for your first name, surname, email address and company so the meeting can be prepared. Legal basis: steps taken at your request before entering into a contract. The booking is completed on Google's page, not on this site, and without the details it asks for the meeting cannot be scheduled.
• Keeping the forms usable. We check submissions for automated abuse and limit how often they can be sent. This processes your IP address, which the rate limiter stores only in a hashed form. Legal basis: our legitimate interest in keeping the site available and free of abuse.
• Privacy requests. When you ask us to erase your data or exercise another right, we record your email address, what you asked for and anything you add. Legal basis: our legal obligation to handle the request.
• Optional analytics. Only with your consent, and described below.

The contact form needs a name, an email address and your consent; without them it will not submit and we cannot reply. A message is optional. A privacy request needs an email address and what you want erased; without them we cannot reach you or act.

We make no solely automated decisions that produce legal effects concerning you or similarly significantly affect you.

Who else handles it

We use service providers to run the site and the services on it: hosting, our CRM, email delivery, bot protection, rate limiting, calendar, and website analytics when it is enabled. They act on our instructions.

Some providers may process data outside the EEA. Where that applies, we rely on adequacy decisions or standard contractual clauses. You can ask us for information about these safeguards.

How long we keep it

• Contact submissions: up to 24 months after our last contact, then deleted from our CRM and from every copy in our mailbox.
• Bookings: up to 24 months after the meeting date, then deleted.
• Privacy requests: we keep the record while the case is open and, after it closes, for as long as needed to demonstrate how it was handled, up to a maximum of three years. We then delete it.

Analytics and cookies

Your consent choice is remembered for up to 180 days, and the pseudonymous browser reference lasts at most 30 days before it is replaced with a new one.

We remember your language preference for 12 months. It is not used for tracking or advertising.

With your consent, we use PostHog Cloud EU to measure visits, use of the main actions, and submissions the site accepted. We send a pseudonymous browser reference and we do not send your name, email address, message or any form content. The network request exposes your IP address to PostHog while it is delivered; the project is configured not to retain it with the analytics event. Before discarding it, PostHog uses it to estimate an approximate location (country, region, city, postal code and approximate coordinates) and stores that location with the analytics event. You can withdraw consent through Manage analytics in the footer, and ask us to erase the events through the erasure request page.

We keep those analytics events for 30 days and then delete them.

Withdrawing consent stops further capture on that browser. It does not by itself erase events already recorded, which is what the erasure request is for.

Your rights and how to complain

At any time you can ask us for a copy of your data, ask us to correct it, delete it, restrict how we use it, or give it to you in a portable form. You can also object to our processing. Where we rely on your consent you can withdraw it at any time, which does not undo what we did while it was valid.

To ask us to erase your data, use the erasure request page. It works without an account and without accepting analytics, and it gives you a case reference. Writing to dataprivacy@crmware.pt is an equivalent route, handled the same way.

We may need to confirm you control the email address before acting. We reply within one month; if a request is complex we may need up to two further months, and we will tell you before the first month is out.

If you consider that our processing of your personal data infringes the GDPR, you can lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, at cnpd.pt. You do not have to contact us first.