Privacy Policy
- Version
- 1.0
- Effective
- 25 August 2026
Data controller
The controller is Soraia Pedroso Unipessoal Lda, tax number 518134067, with an address at Rua Santos Carvalho, n.º 28, 2.º A, 2725-176 Mem Martins, Portugal. For questions about personal data or to exercise your rights, contact info@prontonahora.pt.
Data we process and its source
- Identity and contact data: name, email and, where supplied or collected during checkout, telephone number.
- Company and billing data: company or organisation name, tax number, billing address and other tax details supplied by the client.
- Purchase and payment data: product, price, order reference and status, legal acceptances, Stripe identifiers, transaction status, dates and amount.
- Service performance data: briefing responses, files, communications, deliveries and revision requests.
- Contact data: name, email, optional company, subject and message sent through the form or by email.
- Security and usage data: session, access attempts, pseudonymised technical identifiers used for rate limiting, IP address and browser data needed by Turnstile and, after consent, the Umami browsing data described below.
Data comes from the data subject, the person or organisation they represent, the browser and involved service providers. If a client includes third-party data in a briefing or file, they must be entitled to share it. Stripe processes full payment-method details; PRonto retains only the identifiers, amounts and statuses needed for reconciliation, not full card details.
Purposes and legal bases
- Managing the account, purchase, Stripe payment, briefing, production, delivery, revisions and support — performance of a contract or pre-contractual steps.
- Responding to contact forms, enquiries and proposals — pre-contractual steps or the legitimate interest in responding to communications addressed to PRonto.
- Sending necessary data to TOC Online, issuing and retaining tax documents, responding to authorities and meeting statutory duties — legal obligation.
- Protecting the platform, preventing fraud, maintaining operational records and establishing, exercising or defending rights — legitimate interests, balanced against the data subject’s rights.
- Measuring website use through Umami — consent, which may be withdrawn at any time.
We do not use solely automated decisions with legal effects and do not sell personal data.
Name, email and legal confirmations are required to purchase; Stripe Checkout requests billing address and telephone number. Company and tax number are optional unless required to invoice the named entity. Marked contact and briefing fields are needed to respond or perform the service. Without required data, the corresponding operation cannot be completed.
Recipients and service providers
Data is accessible only to authorised team members and the following provider categories, to the extent required:
- Stripe, to host checkout, process payment, prevent fraud and meet its regulatory duties; it receives contact, billing, order and payment data and may act as processor or independent controller depending on purpose.
- TOC Online (TOConline), to issue, manage and provide tax documents using the client’s details, tax number, address, reference, description, amount and order taxes.
- Infrastructure managed through Coolify, the database and private S3 storage, for hosting, operation, backups, briefings and deliveries.
- Mailcow, for transactional email, support and delivery of contact-form messages to PRonto’s operational mailbox.
- Cloudflare Turnstile, to validate the contact form and prevent abuse; it may receive the challenge token, IP address and technical connection and browser data.
- The private Umami installation at analytics.vyral.pt, only after consent to “Analytics”, as described in section 07.
Data may also be disclosed to advisers and authorities where needed to meet a legal obligation or establish, exercise or defend rights.
Some providers may use subprocessors outside the European Economic Area. Any such transfer only takes place under a GDPR-permitted mechanism, such as an adequacy decision or standard contractual clauses, with any applicable supplementary measures. You can request information about providers, locations and safeguards at info@prontonahora.pt.
Retention and security
Client, order, payment and tax-document data is retained throughout the contractual relationship and for applicable tax, accounting, warranty and legal-claims periods. Briefings, files, deliveries and revision requests are kept during performance and for the subsequent period needed for support and evidence. Unpaid orders and inactive accounts are reviewed and deleted or anonymised when no longer needed, unless a legal obligation or dispute requires retention.
Form messages are routed through Mailcow and retained for as long as needed to reply, follow up and defend rights. Pseudonymised rate-limit records expire after the applicable control window, currently 15 minutes or one hour. The consent decision remains in the browser for 180 days, the account session lasts up to 30 days, and Umami data is retained for no more than 13 months.
We use access controls, encrypted connections, segregation of private files, event logging, request validation, backups and data minimisation. No system provides absolute security; incidents are handled under applicable legal obligations.
Data-subject rights
Where applicable, data subjects may request access, rectification, erasure, restriction, portability or objection, and may withdraw consent without affecting prior lawful processing. Send requests to info@prontonahora.pt; we may request only the information strictly needed to confirm identity.
Data subjects can complain to the Portuguese Data Protection Authority (CNPD). We will seek to respond within the GDPR deadline and explain any applicable legal limitation.