Privacy Policy

Last updated: 14/10/2026

About this document

This Policy explains how Margarida Ximenes handles personal data collected through margaridaximenes.com and in the relationship with clients and prospective clients, in compliance with Regulation (EU) 2016/679 (GDPR) and Portuguese Law no. 58/2019.

1. Data controller

Margarida Ximenes, sole trader (ENI), NIF 252006305, address: Estação Ferroviária Foros de Amora, loja 16, 2845-612 Amora, Seixal, Portugal; email margarida@margaridaximenes.com.

2. Data we collect

  1. Contact form: name, email, business type, main challenge and message content.
  2. Direct contacts (email, phone or social media): data you provide in communication.
  3. Contractual relationship: identification, tax, billing and payment data required to perform the contract.
  4. Navigation data: we use Google Analytics for anonymous traffic analysis — aggregated statistics on pages visited, time on site and traffic source, without directly identifying the visitor. Data is collected via cookies, described in point 7.
  5. We do not intentionally collect data from persons under 16 or special category data.

3. Purposes and legal basis

  1. Responding to enquiries and preparing proposals: pre-contractual steps at the data subject's request (Art. 6(1)(b) GDPR).
  2. Performing service contracts and managing the client relationship (Art. 6(1)(b)).
  3. Complying with legal obligations, namely tax and accounting (Art. 6(1)(c)).
  4. Sending marketing communications or newsletters, only with explicit consent (Art. 6(1)(a)), which may be withdrawn at any time.
  5. Website traffic analysis via Google Analytics, only with your consent (Art. 6(1)(a)).

4. Retention periods

  1. Contact requests without contracting: 12 months after last contact, unless consent to keep in touch was given.
  2. Contractual and billing data: as required by tax and accounting legislation, generally 10 years.
  3. Consent-based data: until consent is withdrawn.

5. Recipients and sub-processors

Data may be processed by providers acting on our behalf, including: email and documents (Google Workspace), internal management tools (Notion), website hosting (Netlify), traffic analysis (Google Analytics) and payment services (bank transfer, PayPal or Wise).

Google LLC and Netlify are based in the USA, so data processed by these entities is transferred outside the EEA with appropriate safeguards, namely the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission. Data is not sold or shared with third parties for advertising purposes.

6. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict or object to processing of your data, to data portability and to withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, write to margarida@margaridaximenes.com. You may also lodge a complaint with the Portuguese data protection authority (CNPD) at www.cnpd.pt.

7. Cookies

The website uses technical cookies necessary for its operation and Google Analytics analysis cookies. The main analytics cookie is _ga, lasting 2 years, and is only activated with your consent. You may decline analytics cookies at any time without affecting your use of the website, via the cookie banner or your browser settings.

8. Security

We adopt appropriate technical and organisational measures to protect data against unauthorised access, loss or misuse, including restricted access to email accounts and management tools, and the use of strong passwords and two-factor authentication.

9. Changes

This Policy may be updated. The version in force is the one published on the website, with the date of update indicated.