Privacy Policy

Last updated: March 2026

This policy applies to www.iberconcept.com and all digital interactions with Iberconcept.

1. Identity of the Data Controller

The data controller responsible for processing your personal data is:

Company	Iberconcept, Lda.
Address	Rua Dr. Calisto Poiares, 79 \| 3060-030 Ançã — Coimbra — Portugal
Email	geral@iberconcept.pt
Phone	(+351) 239 496 832
Website	www.iberconcept.com

Iberconcept is registered with the competent Portuguese authorities and processes personal data in compliance with Regulation (EU) 2016/679 (GDPR) and Law No. 58/2019 of 8 August (the Portuguese implementing law).

2. Personal Data We Collect

2.1 Data provided directly by you

When you use our contact form, request information or send us an enquiry, we collect:

Full name
Email address
Phone number (optional)
Company name (optional)
Content of your message or enquiry

2.2 Data collected automatically

When you browse our website, we automatically collect technical data including:

IP address
Browser type and version
Device type and operating system
Pages visited and time spent
Referring website or search query
Geographic location (country/city level)

Note: We do not collect special categories of personal data (sensitive data) through this website.

3. Purposes and Legal Basis for Processing

We process your personal data for the following purposes, each supported by a lawful legal basis under Article 6 of the GDPR:

Responding to enquiries	Processing your contact form submissions and responding to project enquiries. Legal basis: Performance of pre-contractual measures (Art. 6(1)(b) GDPR).
Website analytics	Understanding how visitors use our website in order to improve its content, structure and performance. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR), subject to your cookie consent where required.
CRM and lead management	Managing and following up on business enquiries received through the website using our CRM system. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) / pre-contractual measures.
Legal compliance	Retaining records as required by applicable Portuguese and EU law. Legal basis: Legal obligation (Art. 6(1)(c) GDPR).

4. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies. A cookie is a small text file stored on your device when you visit a website.

4.1 Types of cookies we use

Type	Purpose	Duration	Legal Basis
Essential	Enable core website functions (navigation, forms). Cannot be disabled.	Session	Art. 6(1)(b) — Necessary for service
Analytics	Measure website traffic and user behaviour (e.g. Google Analytics).	Up to 2 yrs	Art. 6(1)(f) — Legitimate interests / Consent
Functional	Remember your preferences and improve your experience.	Up to 1 yr	Art. 6(1)(f) — Legitimate interests / Consent
Marketing	Track conversions and measure the effectiveness of campaigns.	Up to 2 yrs	Consent (Art. 6(1)(a) GDPR)

When you first visit our website, you will be presented with a cookie consent banner. You may accept all cookies, reject non-essential cookies or customise your preferences at any time.

You may also control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the website.

Google Analytics: We use Google Analytics to analyse website usage. Data is transmitted to Google LLC servers, which may be located outside the European Economic Area. This processing is subject to Google's privacy policy (policies.google.com) and the EU-US Data Privacy Framework where applicable.

5. Recipients and International Data Transfers

Your personal data may be shared with the following categories of recipients:

Our CRM and marketing platform provider, for the purpose of managing enquiries and business communications.
Website analytics providers (including Google Analytics).
IT infrastructure and hosting providers that support the operation of our website.
Legal or regulatory authorities, where required by law.

Some of these recipients may be located outside the European Economic Area (EEA). Where personal data is transferred to third countries, Iberconcept ensures that appropriate safeguards are in place, including:

Adequacy decisions by the European Commission;
Standard Contractual Clauses (SCCs) approved by the European Commission;
Participation in the EU-US Data Privacy Framework, where applicable.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:

Contact form data	Retained for up to 3 years from the date of last contact, or for the duration of any resulting contractual relationship.
Analytics data	Aggregated analytics data is retained for up to 26 months. Raw event data may be retained for shorter periods depending on cookie settings.
CRM data	Business enquiry data is retained for up to 5 years from the date of last interaction, in accordance with commercial records obligations.
Legal records	Retained for the minimum period required by applicable Portuguese law (generally 10 years for accounting and commercial records).

7. Your Rights as a Data Subject

Under the GDPR and Portuguese data protection law, you have the following rights in relation to your personal data:

Right of access	You have the right to obtain confirmation of whether we process your personal data and to receive a copy of it (Art. 15 GDPR).
Right to rectification	You have the right to have inaccurate or incomplete personal data corrected (Art. 16 GDPR).
Right to erasure	You have the right to request the deletion of your personal data where it is no longer necessary, or where you withdraw consent (Art. 17 GDPR).
Right to restriction	You have the right to request that we restrict the processing of your personal data in certain circumstances (Art. 18 GDPR).
Right to portability	You have the right to receive your personal data in a structured, machine-readable format and to transfer it to another controller (Art. 20 GDPR).
Right to object	You have the right to object to processing based on legitimate interests or for direct marketing purposes (Art. 21 GDPR).
Right to withdraw consent	Where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us at:

Data rights requests: geral@iberconcept.pt — Please include your full name and a description of your request. We will respond within 30 days.

You also have the right to lodge a complaint with the Portuguese supervisory authority:

Authority	CNPD — Comissão Nacional de Proteção de Dados
Website	www.cnpd.pt
Address	Rua de São Bento, 148-3.º \| 1200-821 Lisboa — Portugal

8. Data Security

Iberconcept implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These measures include:

Encrypted transmission of data (HTTPS/TLS) between your browser and our website.
Access controls limiting internal access to personal data on a need-to-know basis.
Regular review of security practices and third-party service providers.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 of the GDPR.

9. Links to Third-Party Websites

Our website may contain links to third-party websites. Iberconcept is not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites you visit.

10. Children's Privacy

Our website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us at geral@iberconcept.pt so that we can delete it.

11. Changes to This Privacy Policy

Iberconcept may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we do, we will update the 'Last updated' date at the top of this page.

We encourage you to review this policy periodically. Continued use of our website after any changes constitutes your acceptance of the updated policy.

12. Contact

For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please contact us:

Company	Iberconcept, Lda.
Address	Rua Dr. Calisto Poiares, 79 \| 3060-030 Ançã — Coimbra — Portugal
Email	geral@iberconcept.pt
Phone	(+351) 239 496 832