Privacy and Data Protection Policy

1. Data Controller Identification

The data controller responsible for processing personal data is:

DE MELO & SOARES, LDA

Tax Identification Number: PT517977192

Address: Rua Maria Justina, 68, 4510-609 Fânzeres, Gondomar (Portugal)

2. Scope

This Privacy Policy governs the processing of personal data in the context of using the website, booking services, purchasing products, participating in training sessions, and any contact made with Sofia de Melo Photography®.

3. Personal Data Collected

The following personal data may be collected and processed:

Name
Telephone number
Email address
Address
Tax Identification Number
Data required for service delivery
Billing information
Browsing data (cookies and similar technologies)

Data may be collected through:

Website forms
Purchase processes
Direct contact (email, phone, WhatsApp, Instagram)
Website usage

4. Purposes and Legal Basis for Processing

Personal data is processed for the following purposes:

a) Booking management and service delivery

Purpose: scheduling, execution of sessions, and service delivery

Legal basis: performance of a contract

b) Order processing and delivery

Purpose: managing purchases, shipping products, and customer support

Legal basis: performance of a contract

c) Invoicing and legal compliance

Purpose: issuing invoices and complying with tax obligations

Legal basis: legal obligation

d) Customer communication

Purpose: responding to enquiries and sending relevant information

Legal basis: performance of a contract and legitimate interest

e) Marketing and advertising

Purpose: sending communications and displaying personalised advertisements

Legal basis: consent

The data subject may withdraw consent at any time, without affecting the lawfulness of processing carried out based on previously given consent.

f) Website analysis and improvement

Purpose: analysing user behaviour and improving user experience

Legal basis: consent

5. Data Sharing with Third Parties

Personal data may be processed by third-party entities acting on behalf of the data controller, strictly for the purposes described above, including:

Customer and contact management platforms (CRM)
Email marketing and communication tools
Website analytics and performance tools
Digital advertising and remarketing platforms

All processing carried out by these entities is governed by agreements ensuring compliance with applicable data protection laws.

6. International Data Transfers

Personal data may be transferred outside the European Economic Area, including to countries that may not provide the same level of data protection.

In such cases, the data controller ensures that appropriate safeguards are implemented in accordance with applicable legislation to protect users’ personal data.

7. Data Retention Period

Personal data will be retained only for as long as necessary for the purposes for which it is processed, namely:

Contact data (leads): up to 12 months after the last interaction
Client data: for the duration of the contractual relationship and up to 2 years after the last interaction
Data for tax and invoicing purposes: for the legally required period of 10 years

After the applicable retention periods, data will be securely deleted or anonymised.

8. Data Subject Rights

Under applicable law, data subjects have the right to:

Access their personal data
Request the rectification of inaccurate or incomplete data
Request the erasure of data where legally permitted
Request restriction of processing
Object to the processing of data
Request data portability

Data subjects also have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados).

9. Data Security

The data controller implements appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure, or access.

However, despite these measures, data transmission over the internet is not completely secure, and absolute security cannot be guaranteed.

10. Privacy Contact

For any questions related to this Privacy Policy or the processing of personal data, you may contact:

Email: privacidade@sofiademelo.com

11. Changes to This Privacy Policy

The data controller reserves the right to update or modify this Privacy Policy at any time. Any changes will be duly published on the website.

12. External Links

The website may contain links to third-party websites. DE MELO & SOARES, LDA is not responsible for the content or privacy practices of such websites.