Privacy Policy

This Privacy Policy governs the processing of personal data by João Pedro de Sousa Viegas Tito Lívio, sole trader, owner of the registered trademark pH7x Systems® (“pH7x Systems”, “we”, “us”), in connection with your use of https://ph7x.com (the “Website”), in accordance with:

• General Data Protection Regulation (GDPR), Regulation (EU) 2016/679;
• Lei n.º 58/2019, of 8 August, Portuguese GDPR implementation law;
• Lei n.º 41/2004, of 18 August, protection of personal data in electronic communications.
• Demonstrating your consent. When you choose in the cookie banner, we keep a record of that choice: what you accepted, when, and the version of the policy in force. We do not store your IP: the only link to you is a random identifier kept in your browser. Lawful basis: legal obligation (Article 7(1) GDPR, which requires us to be able to demonstrate that you consented).
• Measuring the audience of the Site with Google Analytics 4, to know which pages get read. Lawful basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time under Cookie preferences. Without consent, Google's script does not load and nothing is measured. See the Cookie Policy.

1. Data Controller

Given the nature and limited scale of the processing described below, the designation of a Data Protection Officer (DPO) is not required under Article 37 of the GDPR. All data protection matters are handled directly by the Data Controller at the email address above.

2. What this Website collects, and what it does not

This Website is static and informational. It has no user accounts and no sign-up. By default it sets no cookies and loads no third-party resources: it only does so with your permission (Google Analytics, if you accept the Statistics category in the banner) and on the pages that carry a form (contact and blog comments), where reCAPTCHA is strictly necessary to that form. The only reserved area is the Website's own administration, accessible only to pH7x Systems, through Microsoft authentication.

We collect personal data when you contact us (email, telephone, WhatsApp or the contact form) and, only if you allow it, usage data through Google Analytics. We also keep the record of your cookie choice, which is the proof of your consent (see the Cookie Policy).

The contact form

On the contact page you may send us a message. We collect the name, email address, company (optional) and the content of your message. We do not store your IP address.

Nothing reaches us until you confirm. After you submit, we send an email to the address you gave us. Your message is only delivered to us once you click the link in that email (double opt-in). If you do not confirm, the record is deleted within 48 hours and we never see the message. This protects you from someone submitting a form in your name, and protects us from automated abuse.

Technical email dispatch records (which address we sent to, when, and whether the send succeeded) are kept for 12 months, for diagnostics and proof of dispatch, and are then deleted automatically.

This happens only on the contact page, and only after you explicitly accept: the Google script is not loaded until you do. If you prefer not to, you can write to us directly at hello@ph7x.com, and nothing is shared with anyone. Legal basis: your consent (Article 6(1)(a) GDPR). See Google's privacy policy at policies.google.com/privacy.

Blog comments

You can leave a comment on any blog article. We collect the name you choose, the text of the comment and, if you choose to give one, an email address. The email is optional and is never published: it exists so we can reply to you. The name and the text are public, because that is what a comment is.

We do not store your IP address. We store an irreversible value derived from it, which lets us recognise repeated submissions without knowing whose they are.

Nothing appears without being read. Every comment waits for approval and is published only after someone at pH7x Systems has read it. Lawful basis: your consent (Article 6(1)(a) GDPR), given when you submit the comment for publication. You can ask for your comment to be removed at any time, at privacy@ph7x.com.

The comment form uses reCAPTCHA, exactly as the contact form does and for the same reason: to stop automated submissions. Google's script loads only once you start writing. Reading the article loads nothing from Google.

The newsletter

You can subscribe to the pH7x Systems engineering newsletter. We collect your email address, the language you were reading in, the page the subscription came from, and the dates on which you subscribed, confirmed and unsubscribed. We also keep the version and a cryptographic hash of the exact consent wording shown to you, as the proof of what you agreed to.

We do not store your IP address. The form is rate-limited using a truncated, irreversible value held in memory only for the length of the window.

Nothing is sent until you confirm. Subscribing creates a pending record and sends you one confirmation email; until you click the link in it you are not on the list. If you never confirm, the pending record is deleted within 7 days. Legal basis: your consent (Article 6(1)(a) GDPR).

We do not track whether you open an edition or click its links, and we do not profile you. The list is used for the newsletter and nothing else.

Contacting us via WhatsApp

The Website includes a link that opens a conversation with us on WhatsApp. The link itself sets no cookies and does not track you. If you choose to use it, the conversation takes place on WhatsApp, a service operated by Meta Platforms Ireland Ltd., which acts as an independent controller for the data processed on its platform, including your phone number, profile name and message content, under its own terms. We receive and process the content of the messages you send us for the sole purpose of responding to your enquiry, on the same legal bases set out below. If you prefer not to use WhatsApp, please contact us by email at hello@ph7x.com. See Meta's privacy policy at whatsapp.com/legal/privacy-policy-eea.

The software we publish, which is a different thing from this website

Everything above is about ph7x.com: a website, with a contact form, a newsletter and (only if you allow it) analytics. It receives data, and the sections above say exactly which.

Microsoft 365 Governance as Code is not that. It is software you download and run on your own machine. It is not a service we operate and not something you log in to. It authenticates against Microsoft's own service endpoints, with the identity and permissions you configure, and reads the environment you point it at. What it produces (evidence, findings, reports) is written to your disk.

Tenant evidence processed by the software is not sent to pH7x Systems by the software. It carries no telemetry, no usage reporting and no licence check that reaches us. For that data you are the controller, and the processing relationship is between you and Microsoft. If you later choose to send us a report (by email, or attached to a support request) that is a message to us, and the rules for messages above apply to it.

3. Purposes and legal bases

• Responding to your enquiry and providing the information or proposal you request. Legal basis: your consent and/or steps taken at your request prior to entering into a contract (Article 6(1)(a) and (b) GDPR);
• Sending the newsletter you asked for, and keeping the proof that you asked for it. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing;
• Managing our business relationship and complying with legal obligations (e.g. tax and accounting where a contract follows). Legal basis: legal obligation and legitimate interests (Article 6(1)(c) and (f) GDPR).

4. Hosting and technical data

The Website is hosted on Microsoft Azure Static Web Apps. Like any web server, the hosting infrastructure may process limited technical connection data (such as IP address, browser type and timestamps) in server logs, strictly for security, abuse prevention and reliable delivery of the pages. Microsoft acts as our hosting provider (processor). See Microsoft’s privacy documentation at privacy.microsoft.com.

5. Sharing and recipients

We do not sell, rent or trade personal data. We share it only where strictly necessary:

• Microsoft (Azure and Microsoft 365), as our hosting provider and for sending and receiving email;
• Google Ireland Limited (Google Analytics), only if you allow the Statistics category in the cookie banner. If you decline, nothing is sent to them. See the Cookie Policy;
• Meta Platforms Ireland Ltd., only if you choose to contact us via WhatsApp;
• partner companies that follow up on a request together with us (for example, Microsoft licensing or implementation), only if you expressly authorise it on the contact form (the option is optional, and your choice is recorded), and only the data needed for that follow-up;
• competent public authorities, where legally required.

We do not otherwise disclose your data to third parties without your consent.

6. International transfers

We aim to keep data within the European Union / European Economic Area. Where a processor may transfer data outside the EU/EEA, such transfers are safeguarded by adequacy decisions or the European Commission’s Standard Contractual Clauses.

7. Retention

Unconfirmed form submissions are deleted within 48 hours. If you do not click the confirmation link, the record is removed automatically and we never see it.

Confirmed messages and other correspondence are kept only for as long as necessary to handle your request and, where a business relationship follows, to meet applicable legal (for example tax) retention obligations. Data no longer needed is deleted.

Newsletter: an unconfirmed subscription is deleted within 7 days — a confirmation you never clicked is not consent. An active subscription is kept until you unsubscribe. When you unsubscribe we immediately remove your email address, the page you subscribed from and the confirmation data from the record: what remains is an irreversible value derived from your address, the date and the consent version, which is what proves we stopped sending. That evidence is deleted after 24 months. Technical dispatch records follow the same 12-month rule as the contact form.

An approved comment stays published for as long as the article is online, or until you ask for it to be removed. A comment that is not approved is never published; it stays in the moderation queue until it is deleted, and you can ask for its deletion at any time.

8. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand. To exercise any right, contact privacy@ph7x.com.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration. No method of transmission over the Internet is, however, completely secure.

10. Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. The current version and its effective date are shown at the top of this page. Material changes will be reflected by a new version number.

Governing language

This document is provided in several languages for your convenience. In the event of any divergence or conflict of interpretation between the versions, the Portuguese version shall prevail.