SHORT SUMMARY
Who processes your data? BLINDAJE LEGAL, LDA (Leiria, Portugal).
For what purposes? Responding to your enquiries, managing waiting lists and communications you request, selling and providing our services, invoicing and complying with the law.
On what basis? Your consent, our contract with you, legal obligations and our legitimate interest, depending on the case.
Is your data sold? No. It is only processed by the providers we need to work with and recipients required by law.
Your rights? Access, rectification, erasure, objection, restriction, portability and withdrawal of consent, by writing to privacidad@steflawpez.com.
Where can you complain? To the Portuguese CNPD or the supervisory authority in the Member State of your habitual residence, place of work or the alleged infringement; in Spain, the AEPD.
The controller of your personal data is BLINDAJE LEGAL, LDA, a Portuguese private limited company (sociedade por quotas), with its registered office at Avenida dos Combatentes da Grande Guerra 704, P7, 2400-122 Leiria, Portugal, NIPC/NIF 519470710.
General contact: steflawpez@steflawpez.com. Dedicated data protection contact: privacidad@steflawpez.com.
This policy applies to steflawpez.com and to pages, forms, calendars and purchase processes operated by the controller that link to it, as well as to the direct contact channels described below.
This policy applies to enquiries and requests received through the channels described, including those made from other countries. Whether a service can be provided, and its legal scope, are assessed separately before an engagement is agreed. The controller is established in Portugal, and the GDPR and any other rules applicable to the processing apply.
We process data you provide directly, data generated when you use our channels and, where applicable, data received from the platforms through which you interact with us. Specifically:
- Website forms and landing pages: identifying and contact information, such as your name, email address and, where applicable, telephone number.
- Purchase processes: information needed to enter into contracts, issue invoices and collect payment, including billing details and, for business-to-business transactions, tax or VAT identification numbers. Payment information is processed by the payment platform; we do not store complete card numbers.
- Social media: your username, interactions and message content, including automatic responses to keywords.
- WhatsApp, email and other channels: contact information and message content.
- Meetings and calls: scheduling information and, only with prior consent, notes, transcripts and, where necessary, recordings using Google Meet and Gemini features.
- Service delivery: business information and documentation you provide for us to perform the engagement.
- Browsing: IP address, identifiers, device, browser, pages visited and similar information generated by cookies or equivalent technologies, in accordance with the Cookie Policy.
You are not obliged to provide your data, but without information marked as necessary we will not be able to handle your request, enter into a contract or provide the service.
- Responding to enquiries and managing meeting requests, including confirmations and reminders. Basis: pre-contractual steps requested by the individual when seeking to contract in their own name; where the individual acts as a representative of an agency or company, our legitimate interest in handling its business enquiry, subject to the corresponding balancing assessment and their right to object.
- Managing waiting lists and sending communications you have requested. Basis: your consent, which you may withdraw at any time.
- Selling, delivering and providing products and services, preparing proposals and documenting validated work. Basis: performance of a contract or pre-contractual steps.
- Activating meeting notes, transcription or recording. Basis: your specific consent, requested before capture is enabled. If you do not consent, the meeting goes ahead and we take manual notes.
- Invoicing, collecting payment and complying with tax, accounting and other legal obligations. Basis: compliance with legal obligations.
- Sending customers communications about our own products or services similar to those purchased, where permitted by applicable law and always offering a free and straightforward way to object when collecting the data and in each message. We observe the rules applicable to the particular communication, including Spanish and Portuguese electronic communications requirements where applicable. Basis: our legitimate interest combined with those legal requirements. Other commercial communications require consent. If you opt in through the marketing checkbox, we will use the contact details you provide to send content, updates and offers about our services by email, SMS, WhatsApp messages and telephone calls. You may withdraw this consent at any time; it is not required to book a meeting. Opt-outs and the requirements applicable to each communication will be respected.
- Measuring and improving the website, content, services and offers. Basis: our legitimate interest for aggregate metrics and, where non-essential cookies are involved, your consent.
- Handling complaints and defending our rights. Basis: our legitimate interest.
We do not make automated decisions producing legal or similarly significant effects on you or carry out profiling of that kind.
We do not sell your data. We only disclose it to:
- Technology providers necessary for the relevant service. Some may act as independent controllers for their own purposes as described in their policies. The categories and main providers include: websites, CRM, calendars, forms and automation (Mastermind Business Hub, based on GoHighLevel/LeadConnector); payments (Stripe); email, documents, storage, meetings and Gemini features (Google Workspace); social media and messaging (Meta, Instagram and WhatsApp); content scheduling and metrics (Metricool); document and project management (Notion); artificial intelligence tools used for support; and management and invoicing software.
- Professional advisers, such as accounting, tax or legal advisers, where necessary.
- Public authorities, courts and other third parties where required by a legal obligation.
We use tools whose documentation provides for the processing of data outside the European Economic Area, particularly in the United States. Google Workspace governs locations and transfers in its data processing agreement: Google states that Google LLC has adopted the EU-US Data Privacy Framework for covered transfers to the United States and provides for standard contractual clauses where applicable. Notion states that data resides in the United States by default and that its agreement incorporates standard contractual clauses for international transfers. Stripe provides for transfers to Stripe, LLC in the United States; its data transfer addendum provides for the application of the Data Privacy Framework and, as a fallback where applicable, standard contractual clauses. You can consult the linked documents for each provider and request information or a copy of those documents at privacidad@steflawpez.com.
- Waiting lists and commercial communications: until you withdraw consent or object and, at most, two years from your last interaction.
- Enquiries that do not result in a contract: for the time needed to handle them and then for up to two years from the last contact.
- Client files and data: throughout the relationship and subsequently for the periods required by tax and accounting legislation and the limitation periods for potential liabilities.
- Recordings, transcripts and raw meeting notes: until they are no longer necessary and, as a general rule, for a maximum of 12 months after the meeting.
- Material information that has been reviewed, validated and incorporated into a file: for the period applicable to that file.
- Technical information and cookies: for the periods stated in the Cookie Policy or while necessary for the relevant purpose.
Our retention policy requires data to be erased or anonymised when these periods end. For internal improvement and content, we preferably retain aggregated or anonymised conclusions.
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw any consent you have given, by writing to privacidad@steflawpez.com from the address you use to communicate with us or proving your identity in another reasonable way. Exercising your rights is free of charge and we will respond within the statutory deadlines.
You may lodge a complaint with the Portuguese Comissão Nacional de Proteção de Dados (CNPD, https://www.cnpd.pt) or with the supervisory authority in the Member State of your habitual residence, place of work or the alleged infringement; in Spain, the Agencia Española de Protección de Datos (AEPD, https://www.aepd.es).
The website and services are intended for adults and businesses. We do not knowingly process minors' data; if we discover that a minor has provided data without a valid basis, we erase it.
On our profiles, we process information about your interactions to manage the controller's presence on the platform and respond to you. This processing coexists with the processing each platform carries out as an independent controller under its own policies, which we recommend you review.
Meetings may be transcribed and, where necessary, recorded using Google Meet and Gemini features to document discussions, prepare follow-up, proposals or deliverables, and extract internal learnings that help improve services, offers and materials.
Capture is only activated after advance notice in the invitation and consent from the participant at the start. Recording, transcription or AI note-taking will only be activated after obtaining your consent. Any notices and controls provided by Google Meet supplement, but do not replace, this prior check. Refusing does not prevent the meeting from going ahead: it continues without capture and manual notes are taken.
Access to meeting records is restricted to people who need it for the stated purpose. The capture functions used, including any capture of presented content, will be explained before activation and will remain within the consent obtained. No quotations, testimonials, case studies or identifiable information are published without additional specific authorisation. AI-generated summaries are drafts and are not incorporated as confirmed facts without human review.
We apply appropriate technical and organisational measures to protect data, taking into account the nature, context and risks of processing.
This policy may be updated to reflect regulatory, corporate or processing changes. The applicable version is identified by its publication date on this page.
This policy is governed by Regulation (EU) 2016/679 and Portuguese Lei n.º 58/2019 of 8 August, without prejudice to any other mandatory rules applicable to the processing.
Version 2.0 · Published on 25 October 2026.
© 2026 Blindaje Legal, Lda. · Legal Notice · Privacy Policy