PRIVACY POLICY

Last updated: October 19, 2025

This Privacy Policy describes how Altafar Agency (“we”, “our”, or “us”) collects, uses, and protects the personal data of individuals who visit our website, communicate with us, or engage with our services. We are committed to safeguarding your privacy and processing your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Czech Act on Personal Data Protection, and other applicable data protection laws.

------------------------------------------------------------

1. DATA CONTROLLER

Altafar Agency

Operated by António Augusto Branquinho De Oliveira Lopes

Registered in the Czech Republic

Registered Office: Revoluční 1056/8a, 110 00 Prague 1 – Nové Město, Czech Republic

Portugal Office: Av. Eng. Duarte Pacheco, Amoreiras, Torre 2, 2º – sala 4, 1070-102 Lisboa, Portugal

Email: [email protected]

Altafar Agency acts as the data controller for all personal data collected and processed through our website and related business activities.

------------------------------------------------------------

2. SCOPE AND PURPOSE OF PROCESSING

We process personal data to the extent necessary for the following purposes:

- Responding to inquiries, requests, and communications submitted via contact forms or email.

- Providing marketing, consulting, and advertising services to our clients.

- Managing client relationships, project execution, and billing processes.

- Sending marketing communications, newsletters, or promotional materials (based on consent).

- Conducting analytics, website performance tracking, and service improvement.

- Complying with legal and regulatory obligations applicable to our operations.

We process personal data only to the extent required for these purposes and only when a lawful basis exists.

------------------------------------------------------------

3. CATEGORIES OF PERSONAL DATA PROCESSED

We may collect and process the following categories of personal data:

- Identification and contact data: name, email address, phone number, company name, and role or title.

- Communication data: messages, inquiries, and correspondence exchanged with us.

- Business data: information necessary for providing services, billing, or contractual arrangements.

- Technical and website usage data: IP address, device type, browser, location, operating system, referring URLs, and pages visited.

- Marketing preference data: subscription status, consent to communications, and interaction with our marketing materials.

Altafar Agency does not intentionally collect or process special categories of personal data (sensitive data).

------------------------------------------------------------

4. LEGAL BASIS FOR PROCESSING

Altafar Agency processes personal data on the following lawful grounds as defined in Article 6 of the GDPR:

- Consent (Article 6(1)(a)) – when you voluntarily provide data through a form, subscribe to marketing updates, or consent to cookies.

- Contractual necessity (Article 6(1)(b)) – when data processing is necessary to provide our services or fulfill an agreement.

- Legitimate interest (Article 6(1)(f)) – for analytics, communication, client relationship management, or service improvement.

- Legal obligation (Article 6(1)(c)) – where processing is required by applicable law.

------------------------------------------------------------

5. DATA RETENTION PERIOD

Personal data is stored only for as long as necessary to fulfill the purposes for which it was collected or to comply with applicable legal obligations. Unless stated otherwise:

- Contact and inquiry data are retained for up to 12 months from the last interaction.

- Client relationship and billing data are retained for up to 5 years after service completion.

- Marketing subscription data are retained until you withdraw consent.

- Analytical data are stored for periods defined by the respective service providers (e.g., Google Analytics).

After the retention period expires, data is securely deleted or anonymized.

------------------------------------------------------------

6. DATA SOURCES

Personal data is obtained primarily from:

- Direct interactions through our website forms or email correspondence.

- Business relationships and service agreements.

- Website analytics tools, cookies, and social media platforms (subject to consent).

------------------------------------------------------------

7. DATA SHARING AND PROCESSORS

Altafar Agency may share personal data with trusted third-party service providers solely for operational purposes. These include:

- Website hosting and maintenance providers.

- Customer relationship management (CRM) platforms.

- Advertising and analytics platforms such as Google Analytics, Meta Ads, and LinkedIn Ads.

- Email marketing and automation tools.

- Legal, accounting, or administrative service providers.

All third-party processors act under contractual obligations to ensure data security and compliance with GDPR requirements. Altafar Agency does not sell or rent personal data to any third party.

------------------------------------------------------------

8. INTERNATIONAL DATA TRANSFERS

Certain third-party service providers (e.g., Google, Meta, CRM platforms) may process data outside the European Economic Area (EEA). In such cases, Altafar Agency ensures compliance with GDPR Chapter V by relying on Standard Contractual Clauses (SCCs) or other appropriate safeguards ensuring an adequate level of data protection.

------------------------------------------------------------

9. COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies and similar technologies for analytics, functionality, and advertising. Cookies help us understand website usage and improve user experience.

Detailed information on cookie categories, retention, and management is available in our Cookie Policy, accessible at altafar.com/legal/cookie-policy.

You can adjust your browser settings to block or delete cookies at any time.

------------------------------------------------------------

10. DATA SECURITY

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include secure data storage, encryption where appropriate, access restrictions, and employee confidentiality obligations.

------------------------------------------------------------

11. RIGHTS OF DATA SUBJECTS

As a data subject, you have the following rights under the GDPR:

- Right of access – to obtain confirmation and a copy of your personal data processed by us.

- Right to rectification – to request correction of inaccurate or incomplete data.

- Right to erasure (“right to be forgotten”) – to request deletion of your personal data where legally applicable.

- Right to restriction of processing – to request limited use of your personal data.

- Right to data portability – to receive your data in a structured, commonly used format.

- Right to object – to object to data processing based on legitimate interests or direct marketing.

- Right to withdraw consent – at any time, for data processed on the basis of consent.

To exercise these rights, please contact us at [email protected].

You also have the right to lodge a complaint with a Data Protection Authority (DPA), particularly in your country of residence or where the alleged violation occurred. In the Czech Republic, the competent authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

------------------------------------------------------------

12. MINORS

Altafar Agency’s services are not directed toward individuals under the age of 18. We do not knowingly collect or process data from minors. If such data is discovered, it will be promptly deleted.

------------------------------------------------------------

13. AUTOMATED DECISION-MAKING

Altafar Agency does not perform automated decision-making or profiling that produces legal effects or significantly affects individuals.

------------------------------------------------------------

14. CHANGES TO THIS POLICY

We reserve the right to amend this Privacy Policy from time to time to reflect legal updates or operational changes. Any modifications will be published on this page with a revised “Last updated” date. Continued use of our website constitutes acceptance of the updated policy.

------------------------------------------------------------

15. CONTACT INFORMATION

For any questions, concerns, or data-related requests, please contact:

Altafar Agency

Email: [email protected]

Registered Office: Revoluční 1056/8a, 110 00 Prague 1 – Nové Město, Czech Republic

Portugal Office: Av. Eng. Duarte Pacheco, Amoreiras, Torre 2, 2º – sala 4, 1070-102 Lisboa, Portugal

------------------------------------------------------------