Privacy Policy
How we process your personal data under the GDPR (Regulation (EU) 2016/679).
Last updated: July 2026 · Version 1.0
This page is an English translation provided for convenience. In case of any discrepancy, the Portuguese version prevails.
1. Data controller and contact details
Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 ("GDPR"), Regular & Integral, Lda, owner of the ApartFix trade mark, is the controller of the personal data collected through the website apartfix.pt.
| Company name | Regular & Integral, Lda |
| NIF / NIPC (tax number) | 515 988 561 |
| Share capital | €120.000 |
| Registered office | Rua Cidade Cardiff 28, 4B, 1170-095 Lisboa, Portugal |
| Privacy email | geral@apartfix.pt |
| Telephone | +351 935 104 020 |
Data Protection Officer (DPO): Regular & Integral, Lda is not required to designate a DPO under Article 37 of the GDPR and Article 13.º of Lei n.º 58/2019 (the Portuguese GDPR implementation law), since the activity of renovating and refurbishing real estate does not constitute large-scale processing of special categories of data, nor large-scale systematic monitoring of data subjects. For any questions relating to data protection, contact us directly at geral@apartfix.pt.
2. Scope of application and processing principles
This policy applies to all personal data processed by Regular & Integral, Lda in the context of operating the website apartfix.pt and providing its services, in accordance with the GDPR and Lei n.º 58/2019, of 8 August (the law implementing the GDPR in Portugal).
Processing is governed by the principles of Article 5 of the GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability of the controller.
3. Categories of personal data processed and their origin
Personal data is obtained directly from the data subject, voluntarily, through the website forms, by telephone, WhatsApp or email. We do not collect data from third-party sources, public databases or social networks.
- Identification data: full name.
- Contact data: telephone number, email address, locality.
- Data describing the request: type of works intended, approximate area, desired timeframe, and any photos or floor plans of the space you choose to share voluntarily.
- Invoicing and contract performance data: address of the works and bank details for payment (only after acceptance of the quote).
- Technical browsing data: IP address, device type and pages visited, collected through cookies only with consent (see the Cookie Policy).
Mandatory nature of the data: your name and telephone number are necessary for us to prepare and communicate your quote; without them, we cannot respond to your request. The remaining fields are optional.
Special categories of data (Article 9 GDPR): we do not collect or process any special categories of personal data.
Data of minors: our services are not intended for persons under 16 years of age. We do not knowingly collect data from minors.
4. Purposes of processing and their legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to quote requests and pre-contractual steps | Art. 6(1)(b): pre-contractual, at the data subject's request | 12 months after the last contact, if it does not become a contract |
| Performance of the works contract | Art. 6(1)(b): performance of the contract | Duration of the works + 5 years (legal warranty period, Art. 1225.º of the Código Civil, the Portuguese Civil Code) |
| Invoicing and accounting obligations | Art. 6(1)(c): legal obligation (CIVA, the Portuguese VAT Code, Art. 52.º) | 10 years |
| Commercial communications (only with express opt-in) | Art. 6(1)(a): consent | Until consent is withdrawn |
| Statistical analysis of the website (analytics cookies) | Art. 6(1)(a): consent, required by the ePrivacy Directive | As per the Cookie Policy |
| Defence of rights in disputes | Art. 6(1)(f): legitimate interest | For the period necessary to resolve the dispute |
Where processing is based on legitimate interest, we have carried out a balancing assessment confirming that this interest is not overridden by the fundamental rights and freedoms of the data subjects. The data subject may request information about this assessment at any time.
5. Recipients of the data: processors and third parties
- Website and form hosting (e.g. Netlify, Inc.), under a Data Processing Agreement (DPA) pursuant to Article 28 of the GDPR.
- Technical and subcontracted teams involved in carrying out the works, subject to confidentiality obligations and with access limited to what is necessary for their duties.
- Certified accountant (TOC), for compliance with tax obligations, with access limited to invoicing data.
- Analytics and advertising (e.g. Google Analytics, Google Ads), only with your consent: see the Cookie Policy and section 6 below on international transfers.
- Public authorities (Autoridade Tributária, the Portuguese tax authority, and CNPD), where required by legal obligation.
Regular & Integral, Lda does not sell, rent or share any personal data with third parties for commercial purposes.
6. International data transfers
Data submitted through the website forms is processed by Netlify, Inc., a company headquartered in the United States of America, certified under the EU-US Data Privacy Framework (verifiable at dataprivacyframework.gov). This transfer is based, in the first instance, on the European Commission's Adequacy Decision concerning that framework (Implementing Decision (EU) 2023/1795).
Vigilance note: the validity of this adequacy decision is currently under increased scrutiny at European level, following judicial developments in the USA concerning the independence of the US authority that oversees compliance with the framework. As a precaution, and regardless of the outcome, the transfer of data to Netlify, Inc. is additionally covered, as a fallback safeguard, by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), which guarantee an equivalent level of protection should the adequacy decision be revised or annulled by the Court of Justice of the European Union. We actively monitor this situation and will update this policy if there are relevant changes.
Google Analytics / Google Ads: the website uses Google Tag Manager, active only with your prior consent (see the Cookie Policy). When consent is given, the browsing data collected by these tools is processed by Google Ireland Limited, with additional transfer safeguards for the USA under the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as applicable. We do not carry out any other transfers of data to third countries outside the European Economic Area beyond those described in this section.
7. Your rights
The GDPR grants data subjects the following rights, free of charge and without formality. We respond within a maximum of one month, extendable by a further two months in cases of particular complexity.
- Access (Art. 15): confirmation of processing and a copy of the data processed.
- Rectification (Art. 16): correction of inaccurate or incomplete data.
- Erasure (Art. 17): where the data is no longer necessary, consent is withdrawn, or the processing was unlawful.
- Restriction of processing (Art. 18): in the cases provided for by law.
- Portability (Art. 20): receiving the data you provided in a structured format and transmitting it to another controller; applies only to processing based on consent or contract and carried out by automated means.
- Objection (Art. 21): objecting to processing based on legitimate interest; for direct marketing, this right is absolute and unconditional.
- Withdrawal of consent (Art. 7(3)): at any time, without affecting the lawfulness of previous processing.
We do not carry out any automated decision-making or profiling with legal effects on the data subject (Art. 22). To exercise your rights, contact geral@apartfix.pt.
8. Right to lodge a complaint with the supervisory authority
Without prejudice to any judicial remedy, you have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD, the Portuguese data protection authority), under Article 77 of the GDPR: www.cnpd.pt · geral@cnpd.pt · Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa.
9. Data security and breach notification
We adopt appropriate technical and organisational measures, under Articles 25 and 32 of the GDPR, including encrypted transmission (HTTPS/TLS), access restricted on a need-to-know basis, and processor contracts with GDPR clauses. In the event of a personal data breach likely to result in a risk to data subjects, we will notify the CNPD within 72 hours (Art. 33) and, where the risk is high, we will notify the affected data subjects directly (Art. 34).
10. Cookies
We use necessary cookies and, with your consent, analytics and marketing cookies. Detailed information is set out in our Cookie Policy, which forms an integral part of this policy.
11. Changes to this policy
This policy may be updated to reflect legislative changes or changes in data processing practices. The version in force is the one published on this page, with the date indicated above. Materially significant changes will be flagged with a prominent notice on the website.
12. Contact
geral@apartfix.pt · 📞 +351 935 104 020 · Regular & Integral, Lda · NIF 515 988 561 · Lisboa, Portugal