Privacy Policy

1. Data Controller

The data controller for the personal data collected through this website is:

CompanyName: SmartLinks, Marketing and Sales Consulting
Headquarters: Lisbon, Portugal
Contact email for privacy matters: geral@smartlinks.pt

SmartLinks is committed to processing users’ personal data in a lawful, fair, and transparent manner, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and other applicable legislation in Portugal.

2. Data Collected

We collect personal data only when the user actively provides it through the forms available on the website:

Form	Data Collected
Free Quick Scan	Name, email, company, phone number, industry, and growth stage
Contact Form	Name, email, company, message
Schedule a Meeting	Name, email, company, phone number
Newsletter / Insights	Email (with explicit consent)

Browsing Data: Through Google Analytics 4, we collect anonymized browsing behavior data (pages visited, duration, traffic source). This data does not directly identify the user. The activation of this tracking is subject to cookie preferences.

We do not collect sensitive data (health, racial origin, political or religious beliefs, etc.) or data from individuals under 18 years of age. If you become aware that a minor has provided us with data, please contact us immediately so we can delete it.

3. Purposes and Legal Basis

The data collected is processed for the following purposes and on the respective legal bases under Article 6 of the GDPR:

Purpose	Legal Basis
Responding to contact and information requests	Legitimate interest (Art. 6(1)(f)), taking steps prior to entering into a contract
Sending assessments, commercial proposals, and follow-ups	Legitimate interest (Art. 6(1)(f)), B2B business relationship
Sending newsletters and editorial content (Insights)	Explicit consent (Art. 6(1)(a))
Analysis of browsing behavior to improve the website	Consent (via cookie banner)
Business relationship management and CRM	Legitimate interest (Art. 6(1)(f))

The legitimate interest invoked for B2B commercial contacts is based on the reasonable expectation that companies requesting information from a professional service provider agree to the commercial follow-up inherent in such a request. The data subject may object to this processing at any time (see section 6).

4. Retention Period

We retain personal data for only as long as is strictly necessary for the purposes for which it was collected:

Contacts with an active business relationship: for the duration of the business relationship or as long as there is demonstrated mutual interest.
Contacts without an active business relationship (inactive): up to 3 years after the last contact or interaction.
Newsletter subscribers: as long as their subscription remains active. After cancellation, the data is deleted within 30 days.
Browsing data (Analytics): as configured in Google Analytics 4 (by default, 14 months).

At the end of the retention period, the data is deleted or irreversibly anonymized.

5. Tools and Subcontractors

To provide our services, we use third-party platforms that may have access to personal data in their capacity as processors. All processors have been selected based on their assurances of compliance with the GDPR:

Platform	Purpose	Data Location
HubSpot	CRM, marketing automation, forms, business email	EU / US (Data Privacy Framework)
Google Analytics 4	Browsing behavior analysis (anonymized)	EU / US (Data Privacy Framework)
Google Ads	Conversion tracking and remarketing (with consent)	EU / US (Data Privacy Framework)

Transfers outside the EU: HubSpot and Google participate in the EU-U.S. Data Privacy Framework, certified by the European Commission as an adequacy mechanism for data transfers to the U.S. (Adequacy Decision of July 10, 2023). These transfers are therefore lawful under Article 45 of the GDPR.

We do not sell, transfer, or share personal data with third parties for marketing purposes unrelated to SmartLinks’ services.

6. Data Subjects’ Rights

Under the GDPR, data subjects have the following rights, which they may exercise at any time:

Right of access (Art. 15): to obtain confirmation that their data is being processed and to receive a copy of it.
Right to rectification (Art. 16): to request the correction of inaccurate or incomplete data.
Right to erasure (Art. 17): to request the erasure of their data (“right to be forgotten”), where applicable.
Right to data portability (Art. 20): to receive your data in a structured, machine-readable format, or to request direct transfer to another data controller.
Right to object (Art. 21): to object to processing based on legitimate interest, including for direct marketing purposes.
Right to restriction of processing (Art. 18): to request the temporary suspension of processing under certain circumstances.
Right to withdraw consent: When processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please send an email to geral@smartlinks.pt with sufficient identification to process your request. We will respond within 30 days.

If you believe that the processing of your data violates the GDPR, you have the right to file a complaint with the competent supervisory authority in Portugal:

CNPD, National Data Protection Commission

Av. D. Carlos I, 134, 1st Floor, 1200-651 Lisbon

Website: www.cnpd.pt

Email: geral@cnpd.pt

8. Data Security

We have implemented appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or accidental or unlawful destruction. These measures include:

Encrypted communications via HTTPS (TLS).
Restricted access to data by the SmartLinks team, on a need-to-know basis.
Use of certified platforms (HubSpot, Google) with enterprise-level security controls.
Periodic review of security and access practices.

In the event of a personal data breach that poses a risk to data subjects, we will notify the CNPD within 72 hours and the affected data subjects without undue delay, as required by Article 33 of the GDPR.

9. Updates to This Policy

This Privacy Policy may be updated periodically to reflect changes in our practices, applicable laws, or the services we provide. The “last updated” date at the top of this page will always be updated in the event of a material change.

We recommend that you check this page periodically. In the event of significant changes that affect your rights, we will endeavor to notify you by email if we have your email address on file.