Privacy Policy

1. Data controller

Amarela Mecânica, Lda., company no. 514659106, Largo da Senhora a Branca, n.º 54, 1.º andar, sala 3S, 4710-443 Braga, Portugal.

Privacy contact: amarelamecanica@gmail.com

2. What data we process and why

a) Email contacts. This website has no contact form. When you write to one of the addresses shown on the website, we process the data you choose to send (name, email address and the content of your message, including any attachments) solely to reply to your request and follow up on it. Legal basis: our legitimate interest in replying to those who contact us (Article 6(1)(f) GDPR) and, where the contact concerns a collaboration, application or contract, steps taken at your request prior to entering into a contract (Article 6(1)(b)).

b) Browsing the website. To keep the website working and secure, the server logs technical data such as your IP address, the date and time of access and your browser type. Legal basis: our legitimate interest in the security and proper functioning of the website (Article 6(1)(f)).

c) Embedded videos (Vimeo). Videos are only loaded after you accept non-essential cookies. From that moment, Vimeo may process usage data in accordance with its own privacy policy. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time on the Cookies page.

d) Preferences. Your choice of light or dark theme is stored only in your browser (local storage) and is not sent to us.

This website does not use analytics, advertising or marketing tools, and does not make automated decisions about you.

3. Who we share data with

We do not sell or pass on your data to third parties for commercial purposes. We use the following service providers (processors), who process data only on our behalf:

• Hostinger: hosting of the website. The website is hosted in data centres in France (European Union).
• Google (Gmail): email service for amarelamecanica@gmail.com and amarelamecanica.estagios@gmail.com.
• Vimeo: video hosting and playback, only after your consent.
• YouTube (Google Ireland Ltd.): playback of embedded videos, only after your consent.

Data may also be disclosed to public authorities where required by law.

4. Transfers outside the European Economic Area

Some of these providers (Google and Vimeo) may process data outside the European Economic Area, notably in the United States. In such cases, the transfer relies on the safeguards provided for in the GDPR, such as the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

5. How long we keep data

• Email messages: for as long as needed to reply and follow up and, at most, 12 months after the last contact, unless a longer period is required to comply with legal obligations or to establish or defend legal claims (for example, where the contact leads to a contract).
• Server technical logs: for the limited period set by the hosting provider for security purposes.
• Consent cookie: 12 months.

6. Your rights

You may at any time request access to your data, its rectification or erasure, restriction of processing and data portability, and object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing already carried out. To exercise these rights, write to amarelamecanica@gmail.com. We reply within one month.

You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

7. Security

We apply appropriate technical and organisational measures to protect data, including encrypted connections (HTTPS) and restricted access to the website's management area.

8. Changes to this policy

We may update this policy when necessary. The current version is always available on this page, with the date of the last update.