Legal

Privacy Policy (GDPR)

Last updated: 28 August 2026

This Privacy Policy explains how Envolt ("we", "us", or "our") collects, uses, discloses, and protects your personal data. It applies to residents of the European Union and Portugal and is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and with Lei n.º 58/2019, of 8 August, which ensures the GDPR's application in Portuguese law. By using our website and services, you agree to the collection and use of information as described in this policy.

1. Data Controller

The data controller responsible for your personal data is Envolt, established in Porto, Portugal. For any questions about this policy or about how we process your data, including the exercise of your rights, you can contact us at info@envolt.com.

2. Legal Framework

This policy is governed by the General Data Protection Regulation (Regulation (EU) 2016/679) and by the Portuguese law that implements it nationally, Lei n.º 58/2019, of 8 August. Where applicable, other sector-specific Portuguese legislation on the protection of personal data also applies.

3. Personal Data We Collect

We collect the information you provide directly, such as your name, email address, company, and message when you contact us, request a quote, or subscribe to communications. We also collect limited technical data automatically, such as IP address, browser and device information, and usage data through strictly necessary and, where you have consented, analytics cookies.

4. Purposes and Legal Basis

We process your personal data for the following purposes and on the following legal bases: to respond to your enquiries and provide our services (performance of a contract, Article 6(1)(b) GDPR); to comply with legal obligations, such as tax and accounting record-keeping (Article 6(1)(c) GDPR); with your consent, to send you marketing communications and to measure website analytics (Article 6(1)(a) GDPR); and for our legitimate interests in improving our website, preventing fraud, and ensuring security (Article 6(1)(f) GDPR), provided these interests do not override your rights.

5. Retention Periods

We keep your personal data only for as long as necessary for the purposes for which it was collected. Enquiry and contract data are kept for the duration of our relationship and for the period required by law afterwards (for example, invoicing and tax records are generally retained for up to 10 years under Portuguese law). Marketing data is kept until you withdraw your consent. Aggregated or anonymised analytics data may be kept for longer.

6. Recipients and International Transfers

We do not sell your personal data. We may share it with trusted service providers (such as hosting, email, and analytics providers) acting as processors under written contracts that meet the GDPR requirements. Where personal data is transferred outside the European Economic Area (EEA), we rely on an adequacy decision of the European Commission or on appropriate safeguards, such as Standard Contractual Clauses, to ensure a comparable level of protection.

7. Your Rights

Under the GDPR and Lei n.º 58/2019 you have the right to access your personal data, to rectify inaccurate data, and to request its erasure. You also have the right to restrict or object to processing, to data portability, and to withdraw consent at any time. You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. To exercise any of these rights, contact us at info@envolt.com.

8. Complaints to the CNPD

If you consider that your personal data has been processed in breach of the law, you have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD): Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal; telephone +351 213 928 400; email geral@cnpd.pt; website www.cnpd.pt.

9. Cookies

We use strictly necessary cookies to operate the website securely. With your consent, we also use analytics cookies to understand how visitors use the site and to improve it. You can accept or reject non-essential cookies and manage your preferences at any time through your browser settings.

10. Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure, including encryption in transit, access controls, and regular review of our practices. No method of transmission over the internet is completely secure, but we work to protect your data using recognised standards.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The "last updated" date at the top shows when it was revised. We encourage you to review it periodically.

12. Contact

To exercise your rights, or if you have any questions about this policy or our data practices, please contact us at info@envolt.com.