Privacy Policy

1. Introduction

Pedro Alexandre Vaz Serra de Vasconcelos Albuquerque, data controller for the Gestor Minuto project, values and respects the privacy of everyone who uses its website and of anyone who gets in touch through its digital channels.

This Privacy Policy explains clearly and transparently how we collect, use, store and protect personal data, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR) and other applicable Portuguese law.

The website presents a platform for accounting firms and receives requests for information or demonstrations; nothing is sold at this stage. Reading this policy does not, in itself, amount to consent. This policy covers the gestorminuto.pt website and contact requests; it does not govern the processing of the firms' client data inside the platform.

2. Data controller

3. Personal data collected

The Gestor Minuto data controller may collect the following categories of personal data:

• Identification data: Full name.
• Contact data: Email address and, if you provide it, phone number.
• Context data: The situation chosen in the form (for example, accounting firm) and the content of the message you send.
• Technical data: IP address and HTTP request data needed to serve the website and protect it against abuse, as well as technical logs of message sending and delivery. Audience measurement through Vercel Web Analytics, when authorised, processes information about visits, pages viewed, referral source, browser and device, presented in aggregate form.
• Cookie data: As described in section 16.

No special categories of data are requested, including health data, racial or ethnic origin, religious beliefs or biometric data.

4. Purposes of processing

Personal data collected is processed for the following purposes:

• Answering requests for information or contact submitted by the user.
• Providing information about the Gestor Minuto platform and arranging demonstrations when requested.
• Following up on the request, without automatic sign-up to any newsletter or marketing list.
• Complying with applicable legal obligations.
• Protecting the website and the form against automated submissions and other abuse; measuring audience, with authorisation, to understand how the website is used and improve navigation.

5. Legal bases

Personal data is processed on the following legal bases under the GDPR:

• Consent (Art. 6(1)(a)): For processing the form data in order to answer the request, according to the specific authorisation given on submission; and, separately, for audience measurement, through the cookie preferences. Consent can be withdrawn at any time.
• Legitimate interest (Art. 6(1)(f)): Ensuring the availability and security of the website and preventing spam, automated submissions and misuse of the form, limiting processing to what is necessary for those purposes and weighing users' rights.
• Legal obligation (Art. 6(1)(c)): Responding to the exercise of the rights in Articles 12 to 22 of the GDPR and meeting the documentation and breach notification obligations in Articles 33 and 34, where applicable.

6. Data retention

Personal data is kept only for as long as strictly necessary for the purposes for which it was collected, in line with applicable legal periods:

• Requests received by email: messages are kept while needed to reply and to follow up on the clarifications or demonstration requested. Once that follow-up ends, they are deleted when there is no longer a justified need to keep them, unless a legal obligation applies. The need is reviewed when the request is closed.
• Messages are received at geral@gestorminuto.pt and handled by the data controller. Retention in the mailbox follows the same criteria, even without a separate contacts database.
• Technical and delivery logs: kept for as long as needed to verify delivery, fix failures and investigate security incidents, within the limits of the service used. Resend states 30 days for email data and logs on its Free, Pro and Scale plans; Enterprise plans allow their own periods. Backups follow the service's replacement cycle and must not be used for new purposes.

Once the retention period ends, data is deleted or irreversibly anonymised.

7. Sharing data with third parties

The Gestor Minuto data controller does not sell, rent or hand over personal data to third parties for commercial purposes. Data may be shared in the following circumstances:

• With technical service providers acting as processors (see section 8), solely for the purposes described in this policy.
• With public authorities, when required by law or by court order.
• Any future transfer to the company to be incorporated will be assessed as to its legal basis and communicated to data subjects, with an update to this policy; incorporating the company does not automatically transfer the contacts.

8. Technical processors

The Gestor Minuto data controller may use processors for technical services, namely:

• Web hosting and infrastructure: Vercel, Inc., for hosting and serving the website, including form protection through Vercel BotID.
• Email service: Providers used to receive and send communications. Resend is used to deliver form requests by email; receiving and replying are done through geral@gestorminuto.pt.
• Analytics tools: Vercel Web Analytics, for aggregate audience measurement, enabled only with authorisation in the cookie preferences.

Providers processing data on the controller's behalf must be bound by the instructions and contractual obligations required by Article 28 of the GDPR. Using these services does not authorise using the requests for the providers' own marketing.

9. International data transfers

Some of the technical processors used by the Gestor Minuto controller may be located outside the European Economic Area (EEA), namely in the United States of America.

Resend states that it stores data in the United States and includes the European Commission's standard contractual clauses in its data processing agreement. Vercel likewise provides transfer mechanisms in the agreement applicable to the service. Transfers may only take place with the safeguards required by Articles 44 et seq. of the GDPR. Information about recipients, countries and applicable safeguards, including how to obtain a copy, can be requested from geral@gestorminuto.pt.

10. Data subject rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): To obtain confirmation of whether your data is processed and to access a copy of it.
• Right to rectification (Art. 16): To correct inaccurate or incomplete data.
• Right to erasure (Art. 17): To request deletion of your data, where applicable.
• Right to restriction of processing (Art. 18): To restrict processing in certain circumstances.
• Right to data portability (Art. 20): To receive the data you provided in a structured, machine-readable format, where processing is based on consent or contract and carried out by automated means, under Article 20.
• Right to object (Art. 21): To object to processing based on legitimate interest.
• Right to withdraw consent: At any time, without affecting the lawfulness of processing before withdrawal.

11. Exercising your rights

To exercise any of these rights, send your request in writing to:

The Gestor Minuto data controller will reply without undue delay and within one month of receipt. This period may be extended by two further months depending on the complexity and number of requests, in which case you will be informed, with reasons, within the first month. Additional information to confirm your identity will only be requested where there are reasonable doubts about it.

12. Data security

Protecting data requires measures proportionate to the risks of unauthorised access, loss, destruction or disclosure. For the website and contact requests, the relevant measures are:

• Data transmitted over the secure HTTPS protocol.
• Access restricted to people who need to know the data.
• Form protection against automated and abusive submissions through Vercel BotID.
• Incident assessment and handling by the controller, with documentation and notifications where legally required.

Data breaches will be documented and assessed. Where legally required, the CNPD (Portuguese Data Protection Authority) will be notified without undue delay and, where possible, within 72 hours of becoming aware of the breach. Data subjects will be informed without undue delay where there is a high risk, subject to legal exceptions.

13. Contact form

The contact form on the Gestor Minuto website collects personal data solely to answer the request submitted. Filling in and sending it means:

• Authorising the processing of your name, email, phone (if provided), the situation you chose and your message in order to answer the request, through the form's consent checkbox. This authorisation does not cover newsletters or promotional campaigns.
• Sending the form does not sign you up to any newsletter or marketing list. The policy informs you about the data; reading it does not amount to consent.

Important: do not send access credentials, tax documents, bank details or any sensitive data through the form. The form is intended solely for a first contact and to qualify the request.

14. Artificial intelligence assistant

Requests sent through the form are answered by email. Presenting the platform's artificial intelligence features does not mean an advisory service is provided through this form. For users:

• The information on the website does not replace accounting, tax, legal or financial advice tailored to a specific case.
• A request for information does not require access to your tax, accounting or financial situation.
• The form must not be used to send sensitive data or client documents.
• Data processing in future use of the platform must be explained in separate information, suited to the features contracted.

If an AI assistant that receives messages from visitors is ever made available, this policy will be updated beforehand with its purpose, the data processed, the recipients and the retention periods.

15. Sensitive data that must not be sent

Users must not send, through any Gestor Minuto digital channel (form, email, AI assistant or chat), the following categories of data:

• Tax Identification Number (NIF).
• Access credentials (passwords, PINs, authentication codes).
• Identity documents (copies of identity cards, Citizen Cards or passports).
• Bank details (IBANs, account numbers, credit or debit cards).
• Tax returns or detailed accounting documents.
• Confidential information or information covered by professional secrecy.

At this stage, a request for information or a demonstration does not require client documents. If documents are needed in future, suitable channels will be defined and communicated beforehand.

16. Cookies and similar technologies

The website uses local storage to keep preferences, cookie-free audience measurement and form security mechanisms, as described in the Cookie Policy. The Meta Pixel is not intended to be used. The technologies are:

• Privacy preferences: The gm-consentimento entry, in the browser's local storage, keeps your audience measurement choice. It remains until you change your choice or clear local data.
• Audience measurement: Vercel Web Analytics, enabled only with authorisation, provides aggregate statistics without cookies. According to the service documentation, the session identifier is discarded after 24 hours; this does not mean all aggregate statistics are deleted within that period.
• Security and editing: Vercel BotID protects the contact form against automated submissions. The website's cookie policy states session duration for this mechanism and for the Keystatic editing session, which is reserved for blog editors.

Your audience measurement choice can be changed or withdrawn through «Cookie preferences» in the website footer. Refusing does not prevent you from sending a contact request. More information is available at https://gestorminuto.pt/en/cookie-policy.

17. Links to external websites

The Gestor Minuto website may contain links to third-party websites. The Gestor Minuto data controller is not responsible for the content, privacy practices or security policies of external websites. We recommend reading the privacy policy of each website you visit.

18. Complaints to the CNPD

Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with the competent supervisory authority in Portugal:

19. Changes to this Privacy Policy

The Gestor Minuto data controller may update this Privacy Policy whenever necessary, namely following changes in law or in the services provided. Changes take effect from the date they are published on the website.

For significantly different processing, users will be informed appropriately and, where applicable, asked for new consent. We recommend checking this policy periodically.

20. Contacts

For questions about privacy and data protection, contact:

21. Final provisions

a) Application of the Policy and non-compliance

All Gestor Minuto staff, whatever their legal relationship, must know the content of this Policy and of its later updates.

Staff must comply with this Policy and cooperate in applying it.

Non-compliance will be assessed under applicable law and reported to the data controller.

Staff should refrain from any conduct they have doubts about and may ask the Gestor Minuto data controller for clarification.

If this Privacy Policy conflicts with the law, the law prevails.

b) Review and monitoring of the Policy

This Policy will be reviewed periodically or whenever client requests, facts or changes in law require it.

c) Communication and dissemination

Once approved, this Policy is communicated to all Gestor Minuto staff, whatever their legal relationship.

d) Entry into force

This Privacy Policy enters into force on the date it is published on gestorminuto.pt. Last updated: 27 October 2026.

Updates to the Policy in this document are valid from the date they are approved.