Legal
Privacy Policy
Last updated: June 2026
1. Who we are (Data Controller)
Helarys is a web agency based in Portugal, responsible for the processing of your personal data collected through this website. For any privacy-related questions or requests, contact us at: contact@helarys.com.
2. What data we collect and why
When you submit our contact form, we collect your name, email address, business name (optional) and message. This data is collected for the sole purpose of responding to your enquiry and, if applicable, managing your project with Helarys. The legal basis for this processing is legitimate interest (Article 6(1)(f) GDPR) and, where a contract exists, contractual necessity (Article 6(1)(b) GDPR).
3. How long we keep your data
Contact form data is retained for a maximum of 24 months from the date of submission, or for the duration of the project relationship. After this period, or upon your request, your data is permanently deleted.
4. Who has access to your data
Your data is accessible only to members of the Helarys team directly involved in responding to your enquiry or managing your project. We do not sell, rent or share your data with third parties for marketing purposes.
5. Data transfers outside the EU
We use third-party infrastructure providers for hosting and authentication that may store or process data on servers located outside the European Union, namely in the United States. These transfers are carried out under Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46 GDPR. All providers have signed Data Processing Agreements (DPAs) with us. Please note that US law (including the CLOUD Act) may allow US authorities to access data stored on US servers under certain conditions.
6. Cookies and analytics
This website may use basic analytics tools (such as Google Analytics) to understand how visitors use the site. These tools may place cookies on your device. Cookies do not identify you personally. You can disable cookies at any time through your browser settings. Where required by law, we will request your explicit consent before placing non-essential cookies.
7. Your rights under GDPR
Under the GDPR, you have the following rights regarding your personal data: right of access (Article 15), right to rectification (Article 16), right to erasure (Article 17), right to restriction of processing (Article 18), right to data portability (Article 20), and right to object (Article 21). To exercise any of these rights, contact us at contact@helarys.com. We will respond within 30 days.
8. Right to lodge a complaint, CNPD
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados), the Portuguese supervisory authority for data protection. Contact: Avenida D. Carlos I, 134, 1.º andar, 1200-651 Lisboa, Portugal. Website: www.cnpd.pt.
9. Data breach notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the CNPD within 72 hours as required by Article 33 GDPR, and will inform affected individuals without undue delay where required under Article 34 GDPR.
10. Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated date. We encourage you to review this page periodically.