Privacy Policy

The controller of the personal data collected through this site is the company identified above.

Requests about personal data are handled by the management, using the email address or phone number shown. There is no dedicated form: write or call.

In the quote request: the services you want, the type of work, the description you write, the property type, the floor area in square metres, the condition of the property, the address, the postal code, the town, the budget range, when you expect to start, your name, phone, WhatsApp, email, preferred way of being contacted and the language you filled the form in. Any photos you attach are kept with the request.

In the visit booking: name, phone, email, address, town, the preferred day and time, and any notes you write.

In the client area: on top of what is already in the request, the details of the works — title, address, town, stage, progress, expected dates, contract value, documents, payment schedule and the messages exchanged with the team.

In the worker area: name, email, phone, job title, start date, hourly rate, personnel documents (contract, pay records, certificates, identification), rotas, clock-in and clock-out records, working days and expenses. The location of a clock-in is only stored for workers who have expressly authorised it; without that authorisation the clock-in is recorded and the coordinates are discarded.

Technical data: the IP address of whoever submits a form is held in the server's memory for about a minute, to stop repeated submissions. It is not written to the database.

Answering the request, preparing the estimate and the quote, and getting in touch the way you chose.

Arranging and carrying out the site visit.

Carrying out the works and keeping the client informed: stages, photos, documents, payment schedule and messages.

Meeting the company's legal obligations, in particular the record of working time and tax duties.

Keeping the site running and blocking abuse of the forms.

Data is not sold, is not passed to third parties for commercial purposes and is not used for advertising.

Performance of a contract, or steps taken at the data subject's request before entering into one — this covers the request, the visit and the works (Article 6(1)(b) GDPR).

Compliance with a legal obligation — the record of working time and tax and employment duties (Article 6(1)(c)).

Legitimate interests — the security of the site and the defence of the company in a dispute (Article 6(1)(f)).

Consent — only for the location of a worker's clock-in, which is asked for separately and can be withdrawn at any time (Article 6(1)(a)).

Vercel — hosting of the site.

Supabase — database, access accounts and files.

Resend — sending the emails the site generates.

These companies process the data on behalf of NOVA OKS RENOV LDA and only for the purposes above. There is no other recipient: the site carries no advertising and no visitor analytics tool.

Where the law requires it — for example before the Portuguese tax authority or the labour inspectorate — the data required is provided.

The database and the files are hosted in the eu-west-3 region (Paris), inside the European Union.

The email domain is configured in the European eu-west-1 region.

Vercel and Resend are international companies. Where data is transferred outside the European Economic Area, the safeguards set out in Chapter V of the GDPR apply.

The record of working time is kept for five years, as the Portuguese Labour Code requires, and stays available to the labour inspectorate. That record is neither deleted nor rewritten: a wrong clock-in is put right by correcting the day, and the original line stays where it is.

The data of a project is kept for as long as it is needed to carry out the works, to answer for the warranty and to meet the applicable legal deadlines.

A quote request that does not lead to a project has no automatic deletion deadline today: it is erased when it is no longer needed, or when the data subject asks.

You can ask for access to the data we hold about you, correction of anything wrong, erasure, restriction of processing, objection to processing, and portability — receiving the data in a format you can take with you.

Where processing rests on your consent, you can withdraw it at any time, without affecting what was done before.

To exercise any of these rights, write or call using the contact details above. There is no button that does this on its own: the request is handled by hand by the team, who first confirm they are dealing with the data subject. We answer within the period set by the GDPR — as a rule, one month.

Some data cannot be erased on request while the law requires us to keep it, such as the record of working time. Where that applies, we say why.

If you believe your data has been mishandled, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

The private areas require an open session, and the database filters every row by whoever is asking for it: a client only reaches their own project, a worker only their own record.

Photos and documents sit in private storage and only open through temporary links, generated at the moment of use.

The site is served over HTTPS and loads no advertising or analytics scripts.

This policy is updated whenever the site or the services change. The date of the last update is at the top of the page, and the version in force is the one published here.