This policy explains how Bluppit handles the personal data of people who visit bluppit.com or contact us through it, in line with the General Data Protection Regulation (GDPR) and applicable Portuguese law.
Who is responsible for your data
Bluppit Software Engineering, Unipessoal Lda, company number (NIPC) 516420313, based in Paredes, Porto, Portugal. For any question about your personal data, email us at geral@bluppit.com or call +351 918 473 212.
What we collect
- Contact form: your name, email, the service you are interested in, your message and the page of the website you sent it from.
- Direct contact: the details you share when you email or call us.
- Technical data: your device's IP address, used to protect the contact form against abuse and logged briefly by the server for security.
- Usage data, only with your consent: through Google Analytics, the pages you visit, how long you stay and what you click, where you came from (for example, a Google search), your type of device and browser, your approximate location (country and city) and a random identifier stored in a cookie.
We do not ask you to create an account, we do not use advertising cookies, and we do not collect special categories of data. Please do not include anything in your message that we do not need in order to reply.
Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Reply to your request and prepare a proposal | Name, email, service, message | Steps taken at your request before a contract (Art. 6(1)(b)) |
| Protect the website against spam and abuse | IP address | Legitimate interest (Art. 6(1)(f)) |
| Meet legal obligations if you become a client | Billing details and correspondence | Legal obligation (Art. 6(1)(c)) |
| Understand how the website is used, to improve it | Usage data (Google Analytics) | Consent (Art. 6(1)(a)) |
We do not use your data for marketing or for automated decision-making.
Who we share it with
We do not sell or give away your data. We use service providers (processors) that handle it only on our behalf and on our instructions:
- Resend: delivers contact form messages to our inbox.
- Google (Google Ireland Limited): website usage statistics through Google Analytics, only if you accept analytics cookies.
- Hosting provider: the server the website runs on.
- Email provider: the mailbox where we receive and answer messages.
- Sanity: manages the website's content. Images are served from cdn.sanity.io, which receives your device's IP address when it loads them.
We may also have to share data with public authorities when the law requires it.
Transfers outside the European Union
Some of these providers are based in, or store data outside, the European Economic Area, notably in the United States. In those cases the transfer relies on safeguards provided for in the GDPR, such as the EU-US Data Privacy Framework adequacy decision or the standard contractual clauses approved by the European Commission.
How long we keep it
- Contact messages: up to 2 years after our last contact, if they do not lead to a project.
- Clients: for the duration of the contract and then for the period required by law for accounting and tax records.
- IP address for form protection: up to 10 minutes, in memory only.
- Server logs: for a short period, for security only.
- Google Analytics data: 14 months, after which Google deletes it automatically.
Cookies
Cookies are small files a website stores on your device. We only use analytics cookies, from Google Analytics, and only if you consent. On your first visit we show a notice where you can accept or decline; declining does not affect how the website works. You can change your mind at any time through the “Cookie settings” link in the footer.
| Cookie | What it does | Duration |
|---|---|---|
| _ga | Tells visitors apart, using a random identifier | 2 years |
| _ga_<ID> | Keeps track of your visit | 2 years |
We have set up Google Analytics so the data is not used for advertising or linked to your Google account. Google Analytics does not log or store your IP address. We also store your cookie choice on your device, so we do not ask again on every visit.
We do not use advertising or social media cookies. Our team also uses a technical cookie when previewing unpublished content, which is never set on visitors’ devices.
Your rights
You can ask at any time to access, correct or delete your data, restrict its processing, receive it in a portable format, or object to processing based on legitimate interest. To do so, email geral@bluppit.com. We reply within one month and may ask for information to confirm your identity.
Where processing is based on your consent, as with Google Analytics, you can withdraw it at any time in “Cookie settings”, without affecting processing carried out before then.
If you believe your data has not been handled properly, you also have the right to lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD) at www.cnpd.pt.
Security
The website is served only over encrypted connections (HTTPS), and access to your data is limited to the people who need it to reply to you.
Changes to this policy
We may update this policy to reflect changes to the website or the law. The date of the last update is shown at the top of this page.