WithPortugal Privacy Policy

Last updated: 12 November 2026

This Privacy Policy describes how personal data of users of the website https://withportugal.com/ (the “Website”) is collected, used, stored, transferred, and protected.

WithPortugal is an information platform that helps users find independent professionals in Portugal and contact them regarding consultations and services.

We respect every user's right to privacy and strive to ensure appropriate protection of personal data in accordance with the European Union General Data Protection Regulation (GDPR) and applicable Portuguese law.

1. General Provisions

1.1. The controller of personal data of Website users is Roman Stelmakh (the “Operator”).

1.2. Operator contact details:

Email: roman@withportugal.com
Website: https://withportugal.com/
Postal address: Rua Jacinto Isidoro de Sousa, 172, 3.º Esq., 2775-711 Carcavelos, Portugal

1.3. This Policy applies to personal data obtained by the Operator when users visit the Website, complete forms, submit enquiries, send messages, or otherwise interact with WithPortugal.

1.4. The Operator acts as the data controller for processing operations for which the Operator independently determines the purposes and means of processing.

1.5. The purpose of this Policy is to ensure transparency regarding personal data processing and to inform users about their rights and how their personal information is used.

2. Key Definitions

Personal data means any information relating to an identified or identifiable natural person.

User means a natural person who visits the Website or uses its features.

Data controller means a person who determines the purposes and means of processing personal data.

Processing of personal data means any operation performed on personal data, including collection, recording, storage, use, disclosure, updating, restriction of processing, and deletion.

Independent professional means a natural or legal person who offers professional services through the Website and may receive user enquiries.

Disclosure of personal data means making personal information available to other persons or organisations where an appropriate legal basis exists.

International data transfer means a transfer of personal data to recipients outside the European Economic Area (EEA) that is subject to the relevant GDPR provisions.

Cookies are small text files stored on a user's device that may be used to operate the Website, remember preferences, or analyse website traffic.

3. Personal Data We Process

3.1. Depending on how users interact with the Website, the Operator may process:

First and last name.
Email address.
Telephone number.
Enquiry category.
Information about the selected professional.
Content of an enquiry or message.
Photographs and other materials voluntarily provided by the user, where the relevant feature is available on the Website.
Other information voluntarily included by the user in forms or messages.

3.2. When users visit the Website, technical data may also be processed, including:

IP address.
Browser and device type.
Operating system.
Date and time of visits.
Pages viewed.
Cookie and similar technology data.
Information about interactions with the Website.

3.3. The Operator does not require users to provide special categories of personal data, including information concerning health, religious beliefs, political opinions, or other information subject to special protection under Article 9 GDPR.

Users are advised not to include such information in enquiry forms. Where processing of special categories of personal data is necessary, it will take place only where an appropriate legal basis exists and the conditions required by the GDPR are satisfied.

4. Purposes of Processing Personal Data

Depending on the specific interaction with the Website, personal data is processed for the following purposes:

Receiving and handling enquiries and requests.
Forwarding enquiries to professionals selected by users.
Identifying an appropriate professional in response to a general enquiry.
Enabling communication between users and professionals.
Responding to user questions.
Sending notifications directly related to an enquiry.
Ensuring the security and proper operation of the Website.
Analysing website traffic and improving Website functionality.
Complying with the Operator's legal obligations.
Protecting the Operator's legitimate rights and interests.
Sending marketing communications where an appropriate legal basis exists.

Personal data is not used for purposes incompatible with the original purposes of collection without an appropriate legal basis and compliance with applicable legal requirements.

5. Legal Bases for Processing Personal Data

5.1. Personal data is processed in accordance with Article 6 GDPR.

5.2. Depending on the specific purpose, the following legal bases apply:

Legitimate interests — Article 6(1)(f) GDPR.

This legal basis may apply to receiving, handling, and forwarding enquiries to independent professionals, ensuring Website security, preventing misuse, and protecting the Operator's legitimate rights, provided the requirements of this provision are met.

User consent — Article 6(1)(a) GDPR.

Consent is used for processing activities based on consent, including non-essential analytics technologies and certain marketing communications where consent is required.

Compliance with legal obligations — Article 6(1)(c) GDPR.

This legal basis applies where processing personal data is necessary to comply with legal requirements.

5.3. Legal Bases for Handling and Forwarding Enquiries

Personal data provided by users through enquiry forms on the Website is processed on the basis of the Operator's legitimate interests under Article 6(1)(f) GDPR, provided that the processing is necessary and the rights and freedoms of users do not override those interests.

The Operator's legitimate interest is to operate the WithPortugal platform, which helps users find independent professionals in Portugal and contact them.

Enquiries from professional profile pages

When a user selects a professional and submits an enquiry, the Operator processes personal data to receive, handle, and forward the enquiry to the selected professional.

Enquiries from the homepage

When a user submits a general enquiry without selecting a particular professional, the Operator processes personal data to review the enquiry, identify a suitable professional, and, where appropriate, forward the enquiry to one independent professional so that they can contact the user.

Processing is limited to the personal data necessary to achieve these purposes.

Users have the right to object to processing based on legitimate interests in accordance with Article 21 GDPR.

To exercise this right, users may contact roman@withportugal.com.

5.4. Where processing is based on consent, users may withdraw their consent at any time.

6. Handling and Forwarding Enquiries to Professionals

6.1. WithPortugal is an information platform that helps users find independent professionals in Portugal.

6.2. Depending on how an enquiry is submitted, personal data is processed under one of two scenarios.

6.3. Enquiries from Professional Profile Pages

When a user selects a professional and submits an enquiry through the relevant form on the Website, their contact details and enquiry information are forwarded to the selected professional.

This disclosure is made to enable the professional to handle the request, clarify its details, and contact the user.

6.4. Enquiries from the Homepage

When a user submits a general enquiry without selecting a particular professional, the enquiry is first received and handled by the WithPortugal administration.

The administration reviews the nature of the enquiry and may, where appropriate, forward it to one independent professional whose expertise matches the user's request.

The purpose of this disclosure is to enable the relevant professional to contact the user about their enquiry.

6.5. Categories of Data Disclosed

The following information may be disclosed to the professional:

User's name.
Contact details.
Enquiry category.
Content of the enquiry.
Other information necessary to handle the specific request.

Only data necessary for the relevant purpose is disclosed.

6.6. Status of Independent Professionals

Independent professionals who independently determine the purposes and means of further processing of the personal data they receive act as separate data controllers under the GDPR.

Further processing by the professional is subject to applicable law and the professional's own personal data protection obligations.

6.7. WithPortugal is not a party to agreements that may be concluded between users and independent professionals and does not accept payments for those professionals' services.

6.8. Forwarding an enquiry to a professional does not automatically entitle that professional to use the contact details received for unrelated marketing purposes without an appropriate legal basis.

6.9. User Reviews

Users may submit reviews and ratings about independent professionals listed on WithPortugal.

Submitted reviews are checked by the WithPortugal administration before publication. The Operator may decline to publish or may remove reviews that contain spam, offensive material, irrelevant content, or personal information disclosed without an appropriate legal basis.

If a review is approved, its content, rating, and the reviewer's display name may be published on the Website. The reviewer's email address is not displayed publicly.

Personal data submitted through review forms is processed for receiving, reviewing, moderating, and, where appropriate, publishing reviews, as well as preventing misuse of the review system.

The Operator processes this information on an appropriate legal basis under Article 6 GDPR, determined according to the purpose and circumstances of the processing.

Users may request the removal of a published review or exercise their other data protection rights by contacting roman@withportugal.com.

7. Other Recipients of Personal Data

7.1. In addition to independent professionals, personal data may be accessible to technical service providers supporting the Website, including:

GoDaddy — for website hosting and email services.
Google Analytics — for website analytics.
Technical support service providers.
Other authorised service providers necessary for the operation of the Website.

7.2. User enquiries are processed and stored in the database of a web application developed using Laravel.

7.3. Where service providers process personal data on behalf of the Operator, the relevant arrangements are established in accordance with Article 28 GDPR.

7.4. Personal data may be disclosed to competent public authorities where required by law.

7.5. The Operator does not sell users' personal data to third parties.

8. Storage and Protection of Personal Data

8.1. The Operator implements appropriate organisational and technical measures to protect personal data against unauthorised access, accidental loss, unlawful use, alteration, or destruction.

8.2. Access to personal data is granted only to persons who need it to perform their relevant duties.

8.3. Personal Data Retention Periods

The Operator retains personal data only for as long as necessary to achieve the relevant processing purpose, unless longer retention is required by law or necessary for the establishment, exercise, or defence of legal claims.

The following retention periods are established for different categories of personal data:

Enquiries submitted through professional profile pages: up to 180 calendar days after the Operator's last action concerning the relevant enquiry.
Enquiries submitted through the homepage: up to 180 calendar days after the Operator's last action concerning the relevant enquiry.
Other enquiries and email correspondence: up to 6 months after the relevant correspondence has ended.
Website technical logs: up to 30 calendar days from creation, unless longer retention is necessary to investigate security incidents or comply with legal obligations.
Analytics data: according to the settings of the analytics service used, but no longer than 14 months for data that can identify a user, unless a different period is justified by a separate purpose and legal basis.
Backups: up to 30 calendar days from creation, after which they are deleted or overwritten in accordance with the established backup cycle.

8.4. Deletion of Personal Data

After the applicable retention period expires, personal data is deleted or anonymised unless further processing is necessary on lawful grounds.

Where personal data remains in backups, it is deleted according to the backup renewal cycle. Access to such data is restricted, and restored data remains subject to the applicable deletion rules.

8.5. Data Retention by Independent Professionals

Once an enquiry has been forwarded to an independent professional acting as a separate data controller, the professional's subsequent storage and processing of the data is subject to their own GDPR obligations.

The retention periods established by this Policy for WithPortugal do not automatically determine how long independent professionals may retain personal data.

Users may contact the Operator regarding the exercise of their rights at roman@withportugal.com.

9. Cookies and Analytics Services

9.1. The Website uses cookies and similar technologies to:

Ensure the proper operation of the Website.
Remember user preferences.
Maintain security.
Analyse website traffic.
Improve functionality and usability.

9.2. Google Analytics is used to analyse website traffic. Depending on its configuration, the service may process information about pages viewed, interactions with the Website, technical device characteristics, and online identifiers.

9.3. Cookies and similar technologies that are not strictly necessary, including analytics and marketing technologies, are used only after obtaining the relevant user consent where such consent is required by law.

9.4. Users may manage cookie preferences through the consent management tools available on the Website and through their browser settings.

9.5. Detailed information about cookie categories, their purposes, providers, and lifetimes is provided through cookie preference settings or a separate Cookie Policy, where published on the Website.

9.6. Cookie Consent Management

WithPortugal uses Cookiebot as a consent management platform to inform visitors about cookies and similar technologies and to manage their preferences.

Cookiebot allows users to accept or reject optional cookie categories and to change or withdraw their consent.

Information about the cookies and tracking technologies used on the Website, including their purposes, providers, and retention periods, is made available through the Cookiebot cookie declaration or consent settings.

Where consent is required, non-essential cookies and tracking technologies are used only after the user has provided the relevant consent.

10. Transfers of Personal Data Outside the European Economic Area

10.1. To operate the WithPortugal Website, the Operator uses GoDaddy for website hosting and email services and Google Analytics to analyse Website traffic and usage.

10.2. Personal data submitted through enquiry forms is processed and stored in the database of a web application developed using Laravel. The physical location of the data depends on the server location and hosting configuration.

10.3. As a result of using these services, personal data may be transferred or made accessible to recipients outside the European Economic Area (EEA), including in the United States of America. Such transfers may take place to support Website operation, email services, technical support, security, and web analytics.

10.4. International transfers of personal data are carried out in accordance with Chapter V GDPR using appropriate safeguards. Depending on the recipient and circumstances of the transfer, these may include:

European Commission adequacy decisions under Article 45 GDPR.
The EU–US Data Privacy Framework, where a transfer to the United States is covered by a valid adequacy decision and the recipient's relevant certification.
Standard Contractual Clauses adopted by the European Commission under Article 46 GDPR, together with additional protective measures where necessary.

10.5. GoDaddy and Google have published documents addressing personal data processing and international transfer mechanisms. The applicability of specific safeguards depends on the relevant contractual terms, services used, and actual data transfers.

10.6. Disclosure of personal data to independent professionals for handling enquiries takes place as described in Section 6 of this Policy. Where such disclosure falls within the rules governing international transfers of personal data, the relevant GDPR requirements apply.

10.7. Users may contact the Operator at roman@withportugal.com to obtain additional information about international transfers of their personal data, recipient countries, applicable safeguards, and how to access information about those safeguards.

11. Users' Rights

Under the GDPR and applicable law, users have the right to:

Receive information about the processing of their personal data.
Access their personal data.
Request correction of inaccurate or incomplete data.
Request deletion of personal data in circumstances provided for by law.
Request restriction of processing.
Object to processing based on legitimate interests, subject to the GDPR requirements.
Receive their personal data in a portable format where provided for by law.
Withdraw previously given consent.
Not be subject to solely automated decision-making, including profiling, in the circumstances covered by Article 22 GDPR.
Lodge a complaint with a competent data protection supervisory authority.

To exercise these rights, users may contact roman@withportugal.com.

The Operator handles requests within the time limits established by the GDPR, generally within one month of receipt. Where permitted by law, this period may be extended, and the user will be informed accordingly.

Users also have the right to lodge a complaint with the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)

Website: https://www.cnpd.pt/

12. Voluntary Provision of Personal Data

12.1. Users provide personal data through Website forms voluntarily.

12.2. Data marked as mandatory in a form is necessary to handle the relevant enquiry.

12.3. If a user does not provide the information necessary to handle an enquiry, the Operator may be unable to forward it to a professional or arrange follow-up contact.

12.4. Submitting personal data through a form does not, by itself, constitute consent to unrelated processing activities.

13. Marketing Communications

13.1. WithPortugal may send information about new services, offers, events, and other marketing materials only where an appropriate legal basis exists under the GDPR and applicable electronic communications legislation.

13.2. Where consent is used as the legal basis for marketing communications, it is requested separately from the submission of an enquiry to a professional.

13.3. Users may opt out of marketing communications at any time by using the relevant unsubscribe mechanism or by emailing roman@withportugal.com with the subject line “Unsubscribe from Marketing Communications”.

13.4. Opting out of marketing communications does not affect a user's ability to submit enquiries to professionals through the Website.

14. Withdrawal of Consent

14.1. Where personal data processing is based on consent, users may withdraw their consent at any time.

14.2. To withdraw consent, users may email roman@withportugal.com with the subject line “Withdrawal of Consent to Personal Data Processing”.

14.3. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

14.4. Where processing is carried out on another appropriate legal basis, withdrawal of consent does not automatically terminate that processing. Users may exercise other rights provided for under the GDPR.

15. Automated Decision-Making and Profiling

15.1. WithPortugal does not use solely automated decision-making, including profiling, that produces legal or similarly significant effects on users within the meaning of Article 22 GDPR.

15.2. Enquiries submitted through professional profile pages are forwarded to the professionals selected by the users themselves.

15.3. General enquiries submitted through the Website homepage are reviewed by the WithPortugal administration. The administrator decides whether to forward an enquiry to one suitable independent professional.

15.4. Automated technical processes are used to operate the Website, including receiving and storing enquiries, sending notifications, and web analytics. WithPortugal does not use these processes to make solely automated decisions that produce legal or similarly significant effects on users.

15.5. Google Analytics is used to analyse Website traffic. Information about data processing through this service, including the use of cookies, is provided in Section 9 of this Policy.

16. Changes to the Privacy Policy

16.1. The Operator may update this Policy in response to changes in legislation, Website functionality, or personal data processing practices.

16.2. The current version of this Policy is published at https://withportugal.com/.

16.3. The date of the latest update appears at the beginning of the document.

16.4. Where changes materially affect personal data processing, the Operator will ensure that users are appropriately informed in accordance with applicable law.