Privacy policy
Last updated: 16 October 2026.
1. Data controller
The controller of the data collected through the form is WizTec - BF, Tax ID PT140615172. Address: Rua do Cruzeiro N3, 3500-621 Viseu. For privacy questions and exercising rights, please use the Contact form ↗.
2. Data and purposes
We collect name, email, service area and request description. Phone, organisation, location and PDF documents are optional. We use these data to assess the request, respond and prepare a possible proposal.
The request is sent to WizTec's email inbox with a generated PDF summary and any attachments that pass validation. A copy of the request and PDF summary is also sent to the sender's stated email address. Project attachments are not forwarded in that copy. We do not use form data for newsletters or advertising.
To prevent abuse, we also process session checks, attempt times and identifiers derived from IP addresses and email addresses through a cryptographic mechanism. These identifiers remain pseudonymised data, not anonymous data.
When the portal is active, the confirmed email identifies the client account: requests sent with the same email are grouped in that account history. Messages, documents and proposals are shown only after authentication and request authorisation; internal notes remain available only to administrators.
3. Legal bases for processing
Proposal requests and steps necessary for possible contracting rely on Article 6(1)(b) of the GDPR. General enquiries and proportionate abuse prevention measures rely on legitimate interests in responding and protecting the service under point (f). Legal obligations applying to a contractual relationship rely on point (c).
Acknowledgement of this policy records that the information was presented. It is not consent to marketing and does not replace the legal basis for processing.
4. Recipients and services used
The team handling the request can access the communication. SMTP delivery uses Brevo as the technical email provider, and WizTec receives the message. The website server is managed by the provider. The PDF is generated locally on the server; its content is not sent to an external document-generation service.
Hosting and email providers must act under applicable processing agreements. Specific service configuration and any international transfers must be checked by the controller. Transfers to countries without an adequacy decision require GDPR safeguards. Information about recipients and safeguards may be requested through the contact form.
5. Retention
As this version's operational retention period, requests that do not lead to a contract are retained for up to 12 months after the last useful contact. The controller must confirm this period before publication. Where there is a contract or a need to defend rights, legal time limits and purpose-specific criteria apply.
When the portal is active, requests, messages, documents and proposal versions are stored in the database and in private storage outside the public document root. Documents require authentication and request-level authorisation. Summaries and attachments sent by email also remain in the recipient inboxes. The request retention period applies, subject to periods required for contracts and defending rights.
The client area verifies access through email and temporary single-use codes. Codes are stored as cryptographic derivatives, expire in 10 minutes and have attempt limits. Request events, responses, proposal versions and notification status are recorded. Administrators use a password and additional email verification.
Usage-limit identifiers cover a maximum 24-hour window. Expired records are removed on subsequent use or by the daily cleanup task. Hosting server technical logs require their own retention policy.
6. Security and limitations
We apply data validation, repeated-request controls, secure communication and PDF checks before sending. No mechanism guarantees the absence of all threats. Do not include passwords, identity documents, health data or other sensitive data unnecessary for the project.
7. Data subject rights
Access, rectification, erasure, restriction and portability of personal data may be requested where provided for by the GDPR. Processing based on legitimate interests may also be opposed. The response and any legal limitations depend on the request and the legal basis.
To exercise these rights, use the contact form. A complaint may be lodged with the Portuguese Data Protection Authority.
8. Required data and automated decisions
Required fields allow us to identify and respond to the request. Without them the form cannot be submitted. Security checks may automatically block suspicious attempts. We do not perform commercial profiling or automated decisions with legal or similarly significant effects. If submission is blocked, request human review through the contact form.
9. Cookies
Read our cookie informationPortal terms to learn how the form session works.