Privacy Policy & GDPR

Last updated: July 2026

1. Data Controller

okdigital.pt is the controller of the personal data of consultants registered on the platform. For messages sent by visitors through the contact forms on consultants' pages, the consultant is the controller and okdigital.pt acts as processor, processing such data solely on the consultant's behalf.

2. Data We Collect

Consultants: name, email, phone, VAT/tax number (for invoicing), working area, photo, biography, access credentials (password stored as an irreversible hash) and, for the own-domain service, FTP/SFTP credentials provided by the consultant (stored encrypted). We do not store payment card details: these are handled directly by the payment processor (Stripe). Page visitors: name, email, phone and message when voluntarily submitting the contact form. Visit and interaction statistics: page visits and clicks on contact buttons (phone, WhatsApp, email), aggregated by day and language, cookie-free and without identifying the visitor (no IP, no personal data).

3. Purposes and Legal Bases

Provision of the contracted service (performance of contract — Art. 6(1)(b) GDPR); service communications such as the monthly report and account notices (legitimate interest/contract); invoicing and tax obligations (legal obligation); marketing communications only with consent, revocable at any time.

4. Retention

Account data is kept while the account is active and deleted within 30 days of closure, except where legal obligations apply (e.g. invoicing documents, 10 years). Visitor messages are kept for as long as the consultant keeps them in their backoffice.

5. Sharing and Processors

We do not sell personal data. We use providers strictly necessary for the service: web hosting, automatic content translation (property texts and biography only — never visitor data), card payment processing (Stripe Payments Europe) and certified invoice-receipt issuance (KeyInvoice). Stripe and KeyInvoice receive only the data strictly necessary for billing and invoicing (name, VAT number, email and amount). Stripe may process data on servers outside the European Union under appropriate safeguards (EU Standard Contractual Clauses). Where the consultant enables Google Analytics on their page, the consultant's own privacy policy applies.

6. Cookies

The platform uses only technical session cookies strictly necessary for the backoffice (authentication). We use no advertising or tracking cookies on consultants' public pages.

7. Your Rights

Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent and to lodge a complaint with the supervisory authority (CNPD — www.cnpd.pt). To exercise your rights, contact us at the email below; we reply within 30 days.

8. Security

We apply appropriate technical and organisational measures: TLS encryption in transit, bcrypt-hashed passwords, encrypted sync credentials, restricted access and regular backups.

9. Minors

The service is intended for professionals and is not directed at persons under 18.

10. Changes

Material changes to this policy will be notified by email to registered consultants with reasonable notice.

Contact for privacy matters and exercising your rights: ok@okdigital.pt