Privacy Policy
Version 7 · 22/10/2026. For any question, write to dd@doingdigital.me. This is an English translation for convenience; the Portuguese version prevails.
Who processes your data
This policy explains what doing digital does with the personal data of people who visit this website, request an audit or are our clients.
The controller is:
doing digital
Address: R. Malhões, 2770-071 Paço de Arcos, Portugal
Phone: +351 920 224 927 (call to a Portuguese mobile network)
Email: dd@doingdigital.me
For any question about this policy or about your data, write to dd@doingdigital.me. We always reply, and we reply in writing.
We have not appointed a data protection officer. Given the size and nature of our activity, we are not in any of the situations in which Article 37(1) GDPR makes such an appointment mandatory. Questions about your data are handled directly by the controller, at dd@doingdigital.me.
The principle, before the lists
We collect as little as we can, keep it for as short a time as we can, and do not sell or rent your data to anyone. Where we use third-party tools, we say which and what for. Where we are not sure, we say we are not sure.
What data we collect, and how
Data you give us. When you write to us, by email or WhatsApp, or request an audit: name, email address, company name, your website address, and whatever you write in the message. If you give us a phone number, that too. If you become a client, we also hold the data needed for invoicing and for carrying out the service.
Data your browser gives us. Like any website, this one may record the IP address, the type of browser and device, the page you came from and the pages you visited. It reaches us through the measurement tools described in the Cookie Policy, and only after you have authorised them. Part of this data, such as the IP address and the identifier the statistics tool assigns to your browser, is personal data even if it never tells us your name. We do not tell you it is anonymous, because it is not.
Conversation data. If we speak by phone, video call or WhatsApp, we keep the notes of that conversation, to the extent needed to provide you with the service.
AI assistant data. If you talk to the AI assistant on our website, we keep the messages you write, the time, and your name or contact details if you give them. The assistant always identifies itself as an AI system and hands the conversation to a person when you ask.
What we do not collect. We do not ask for, and do not want, sensitive data: health, beliefs, membership, sexual orientation, biometric data. Please do not send it, and if you send it by mistake we delete it.
What we use the data for, and on what basis
| What for | Which data | Legal basis |
|---|---|---|
| Replying in the AI assistant and routing you to a person | Messages, time, name or contact details if you give them | Steps taken at your request before entering into a contract, Article 6(1)(b) GDPR, and our legitimate interest in replying quickly, point (f) |
| Replying to an audit request or an enquiry | Name, email, company, website, message, phone if given | Steps taken at your request before entering into a contract, Article 6(1)(b) GDPR |
| Providing and invoicing the contracted service | Contact details, billing details, business data needed for the work | Performance of the contract, Article 6(1)(b), and compliance with tax obligations, point (c) |
| Measuring how the website is used and improving it | Browsing data: IP address, the identifier the statistics tool assigns to your browser, pages visited, referring page, type of browser and device. We only consult it in aggregate reports. | Your consent, Article 6(1)(a), given in the cookie notice and revocable at any time |
| Keeping proof of what was contracted and what was delivered | Contract, correspondence, delivered document | Legitimate interest in being able to show compliance and to defend against a claim, Article 6(1)(f) |
We do not take automated decisions with legal effects on you, nor do we carry out profiling, within the meaning of Article 22 GDPR.
Whether the data is mandatory. Without an email address we cannot reply, and without your website address there is no audit to discuss. Not providing the other data has no consequence. If you become a client, billing data is mandatory by tax law, and without it we cannot issue the invoice or, therefore, provide the service.
When we work on your systems. To carry out the audit we may need access to your tools, such as your website statistics. If in that access we process personal data on your behalf, we are a processor and not the controller. In that case, before any access, we enter into a processing agreement with you with the content required by Article 28(3) GDPR. Without that signed agreement, we do not access.
How long we keep it
Requests that did not lead to a contract: twelve months from the last contact, and then we delete. If you tell us you want us to delete earlier, we delete when you say so.
Clients: for the duration of the contractual relationship and, afterwards, for the period during which the law obliges us to keep it. Invoicing and accounting documents: for the 10 calendar years following the year they relate to, as required by Article 52(1) of the Portuguese VAT Code.
Proof of what was contracted and delivered (contract, correspondence and audit document): until the limitation period for the rights that may be exercised on the basis of the contract ends and, if a dispute is pending at that time, until its final resolution.
AI assistant. The history the assistant consults to reply: 30 days. Duplicate control: 7 days. The technical event log: 90 days. The conversation in the service inbox: twelve months from the last contact, like the other requests without a contract.
Browsing data: stays in the measurement tools for the period configured there, stated in the Cookie Policy. If you withdraw your consent, it is no longer collected from that moment.
Who we share it with
We do not sell, rent or exchange personal data. We share only with those who are needed for the service to work, and only what is needed.
| Who | What for | Where the data is |
|---|---|---|
| Duda, Inc. (United States) | Website platform and hosting, as our processor | According to Duda, in the United States, Israel, the European Economic Area, the United Kingdom, Canada and other countries where Duda or its processors operate. Transfers to the United States take place under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), to which Duda states it adheres, and the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, provided for in Duda's data processing agreement. |
| Google Ireland Limited | Google Tag Manager and Google Analytics 4, usage measurement, only after your consent. Also the email and file storage we work with. | Data may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) or the standard contractual clauses provided for in Google's data processing terms. |
| Weglot SAS (Paris, France) | Page translation | According to Weglot, on servers in the European Union. |
| WhatsApp Ireland Limited | WhatsApp conversations, when that is the channel you choose to contact us | According to the terms of the service itself, which you can consult in the app. |
| Google Cloud EMEA Limited | Hosting of the service inbox (Chatwoot, operated by us) and of the website's AI assistant | In the europe-west1 region (Belgium). Data may be transferred to the United States under the standard contractual clauses provided for in Google's data processing terms. |
| Anthropic Ireland, Limited (contracting entity for the European Economic Area) | Language model that drafts the AI assistant's replies, only during the conversation | Processing by Anthropic PBC in the United States, under the EU Standard Contractual Clauses (Modules Two and Three) incorporated in Anthropic's Data Processing Addendum. Conversations are not used to train models. |
| Certified invoicing software provider and certified accountant | Issuing invoices and complying with tax obligations, clients only | We give the name of each to anyone who asks, in writing. |
Besides these, we may have to disclose data to public authorities when the law requires. If that happens, and if we can legally tell you, we will.
Your rights
The General Data Protection Regulation gives you rights that you can exercise at any time, by writing to dd@doingdigital.me. They are free and we reply within one month. If the request is particularly complex, the law allows us to extend that period by two further months, and in that case we tell you within the first month, with the reason (Article 12(3)).
- Access the data we hold about you, and receive a copy (Article 15).
- Rectify anything wrong or incomplete (Article 16).
- Erase your data, when we have no grounds to keep it (Article 17).
- Restrict processing, keeping the data with us without using it, while an issue is resolved (Article 18).
- Take your data with you, in a machine-readable format, when we process it on the basis of your consent or a contract and by automated means (Article 20).
- Object to processing we carry out on the basis of legitimate interest (Article 21).
- Withdraw the consent you have given, at any time, without affecting what was done before on the basis of it (Article 7(3)). For the website's measurement tools, this is done through the "Cookies" link at the bottom of each page.
To reply to one of these requests we may need to confirm that you are who you say you are. This is not bureaucracy: it is what stops someone else from requesting your data in your name.
If you think we have mishandled your data, tell us first, because if we got it wrong we want to fix it. But you are not obliged to go through us: you have the right to complain directly to the supervisory authority (Article 77 GDPR).
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
www.cnpd.pt
· complaints at www.cnpd.pt/cidadaos/participacoes
Security
We use appropriate technical and organisational measures to protect your data. We do not promise absolute security, because no one honest can. If there is a data breach likely to put you at high risk, we will tell you, and we will notify the CNPD within the legal deadlines.
Changes to this policy
If this policy changes, we publish the new version here and change the date below. If the change is significant and we have your contact details, we let you know.
