Privacy Policy

This Privacy Policy governs the processing of personal data by João Pedro de Sousa Viegas Tito Lívio, sole trader, owner of the registered trademark pH7x Systems® (“pH7x Systems”, “we”, “us”), in connection with your use of https://ph7x.com (the “Website”), in accordance with:

• General Data Protection Regulation (GDPR), Regulation (EU) 2016/679;
• Lei n.º 58/2019, of 8 August, Portuguese GDPR implementation law;
• Lei n.º 41/2004, of 18 August, protection of personal data in electronic communications.
• Demonstrating your consent. When you choose in the cookie banner, we keep a record of that choice: what you accepted, when, and the version of the policy in force. We do not store your IP: the only link to you is a random identifier kept in your browser. Lawful basis: legal obligation (Article 7(1) GDPR, which requires us to be able to demonstrate that you consented).
• Measuring the audience of the Site with Google Analytics 4, to know which pages get read. Lawful basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time under Cookie preferences. Without consent, Google's script does not load and nothing is measured. See the Cookie Policy.

1. Data Controller

Given the nature and limited scale of the processing described below, the designation of a Data Protection Officer (DPO) is not required under Article 37 of the GDPR. All data protection matters are handled directly by the Data Controller at the email address above.

2. What this Website collects, and what it does not

This Website is static and informational. It has no user accounts and no sign-up. By default it sets no cookies and loads no third-party resources: it only does so with your permission (Google Analytics, if you accept the Statistics category in the banner) and on the contact page (reCAPTCHA, strictly necessary for the form). The only reserved area is the Website's own administration, accessible only to pH7x Systems, through Microsoft authentication.

We collect personal data when you contact us (email, telephone, WhatsApp or the contact form) and, only if you allow it, usage data through Google Analytics. We also keep the record of your cookie choice, which is the proof of your consent (see the Cookie Policy).

The contact form

On the contact page you may send us a message. We collect the name, email address, company (optional) and the content of your message. We do not store your IP address.

Nothing reaches us until you confirm. After you submit, we send an email to the address you gave us. Your message is only delivered to us once you click the link in that email (double opt-in). If you do not confirm, the record is deleted within 48 hours and we never see the message. This protects you from someone submitting a form in your name, and protects us from automated abuse.

Technical email dispatch records (which address we sent to, when, and whether the send succeeded) are kept for 12 months, for diagnostics and proof of dispatch, and are then deleted automatically.

This happens only on the contact page, and only after you explicitly accept: the Google script is not loaded until you do. If you prefer not to, you can write to us directly at hello@ph7x.com, and nothing is shared with anyone. Legal basis: your consent (Article 6(1)(a) GDPR). See Google's privacy policy at policies.google.com/privacy.

Contacting us via WhatsApp

The Website includes a link that opens a conversation with us on WhatsApp. The link itself sets no cookies and does not track you. If you choose to use it, the conversation takes place on WhatsApp, a service operated by Meta Platforms Ireland Ltd., which acts as an independent controller for the data processed on its platform, including your phone number, profile name and message content, under its own terms. We receive and process the content of the messages you send us for the sole purpose of responding to your enquiry, on the same legal bases set out below. If you prefer not to use WhatsApp, please contact us by email at hello@ph7x.com. See Meta's privacy policy at whatsapp.com/legal/privacy-policy-eea.

3. Purposes and legal bases

• Responding to your enquiry and providing the information or proposal you request. Legal basis: your consent and/or steps taken at your request prior to entering into a contract (Article 6(1)(a) and (b) GDPR);
• Managing our business relationship and complying with legal obligations (e.g. tax and accounting where a contract follows). Legal basis: legal obligation and legitimate interests (Article 6(1)(c) and (f) GDPR).

4. Hosting and technical data

The Website is hosted on Microsoft Azure Static Web Apps. Like any web server, the hosting infrastructure may process limited technical connection data (such as IP address, browser type and timestamps) in server logs, strictly for security, abuse prevention and reliable delivery of the pages. Microsoft acts as our hosting provider (processor). See Microsoft’s privacy documentation at privacy.microsoft.com.

5. Sharing and recipients

We do not sell, rent or trade personal data. We share it only where strictly necessary:

• Microsoft (Azure and Microsoft 365), as our hosting provider and for sending and receiving email;
• Google Ireland Limited (Google Analytics), only if you allow the Statistics category in the cookie banner. If you decline, nothing is sent to them. See the Cookie Policy;
• Meta Platforms Ireland Ltd., only if you choose to contact us via WhatsApp;
• partner companies that follow up on a request together with us (for example, Microsoft licensing or implementation), only if you expressly authorise it on the contact form (the option is optional, and your choice is recorded), and only the data needed for that follow-up;
• competent public authorities, where legally required.

We do not otherwise disclose your data to third parties without your consent.

6. International transfers

We aim to keep data within the European Union / European Economic Area. Where a processor may transfer data outside the EU/EEA, such transfers are safeguarded by adequacy decisions or the European Commission’s Standard Contractual Clauses.

7. Retention

Unconfirmed form submissions are deleted within 48 hours. If you do not click the confirmation link, the record is removed automatically and we never see it.

Confirmed messages and other correspondence are kept only for as long as necessary to handle your request and, where a business relationship follows, to meet applicable legal (for example tax) retention obligations. Data no longer needed is deleted.

8. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand. To exercise any right, contact privacy@ph7x.com.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration. No method of transmission over the Internet is, however, completely secure.

10. Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. The current version and its effective date are shown at the top of this page. Material changes will be reflected by a new version number.

Governing language

This document is provided in several languages for your convenience. In the event of any divergence or conflict of interpretation between the versions, the Portuguese version shall prevail.