Privacy Policy

Ethks 2 Services, Lda., which trades as Ethikos Services, is the controller of the personal data described in this policy. In this policy, ‘Ethikos Services’, ‘we’ and ‘us’ refer to that company. Its company details are set out in our Legal mentions.

Controller

Ethks 2 Services, Lda. (Ethikos Services)

Registered office

Rua Marquês de Fronteira, 111, 1D, 1070-292 Lisboa, Portugal

Privacy contact

contact@ethikos.services

We have not appointed a data protection officer. Questions and requests about your personal data go to contact@ethikos.services, or by post to the address above, for the attention of ‘Data protection’.

This policy covers the personal data that we decide about ourselves: that of visitors to this website, of people who contact us and of the people we deal with at clients, suppliers and partners.

When we build or run a system for a client – a back office, a sector app, a website or an outsourced process such as client onboarding or business development – we process the personal data in it on the client’s behalf, as a processor, under a data processing agreement (Article 28 GDPR). The client is the controller of that data, and its own privacy notice applies. This includes the people we contact on a client’s behalf when we run its business development.

This website is intended for businesses and is not directed at children.

For each situation below you will find the data we use, the purpose, the legal basis under Article 6(1) GDPR and how long we keep the data. We do not ask for special categories of data, such as health data, and we ask you not to send them to us.

Visiting this website

Data

IP address, date and time, the page requested, the referring page and browser and device information, recorded in the technical logs of our hosting provider.

Purpose

To deliver the website, keep it secure, prevent abuse and fix errors.

Legal basis

Our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).

Retention

No more than 30 days in the logs available to us.

To protect the website against automated attacks, our hosting provider may screen a visit with a brief automatic browser check (the ‘Vercel Security Checkpoint’). When it does, it sets the security cookie described under Cookies and your device.

Measuring visits

Data

The page visited, the referring page, the approximate location (country, region and city) derived from the IP address, and the type of device, operating system and browser.

How

With Vercel Web Analytics, which sets no cookies, stores nothing on your device and keeps no IP address; each visit is counted through a temporary hash of the request.

Purpose

To count visits and see, in aggregate, which pages are useful.

Legal basis

Our legitimate interest in measuring the audience of our website with minimal data (Article 6(1)(f) GDPR).

Retention

The hash is discarded after 24 hours; what remains are aggregated statistics that identify no one.

If you prefer not to be counted, you can block the analytics script in your browser or with a content blocker. The website works in the same way without it.

Contact forms and emails

Data

Your name, email address and phone number, the subject of your request, your country, your message and the page or person your message is about. If you email us, the content of your email and of any attachments.

Purpose

To answer your request and, where relevant, prepare a proposal.

Legal basis

Steps taken at your request before a possible contract (Article 6(1)(b) GDPR) or, when you write on behalf of a company or about anything else, our legitimate interest in answering the messages we receive (Article 6(1)(f) GDPR).

Retention

For as long as we need to deal with your request. If no engagement follows, we delete the message within 12 months of our last exchange. Our email delivery provider keeps its copy for up to 30 days.

Your name, email address, phone number and, on the contact page, your country are needed to answer you; without them the form cannot be sent. Everything else is optional. If your message mentions other people, include only what we need and let them know.

Clients, suppliers and partners

Data

Name, job title, company, business email address and phone number, our correspondence and meeting notes and, for contracts and invoices, billing and tax details.

Source

You or your organisation.

Purpose

To prepare, perform and manage contracts, to invoice and keep our accounts, and to keep in touch with our business contacts.

Legal basis

Performance of a contract with you (Article 6(1)(b) GDPR); our legitimate interest in managing our relationships with the organisations we work with (Article 6(1)(f) GDPR); and our legal obligations on invoicing, accounting and tax (Article 6(1)(c) GDPR).

Retention

For the duration of the relationship. Accounting and tax records are kept for 10 years (Article 123 of the Corporate Income Tax Code); other data may be kept until the limitation periods for the corresponding rights expire (Article 21 of Law no. 58/2019).

Our pages on LinkedIn and Instagram

When you visit or interact with our pages on LinkedIn and Instagram, LinkedIn Ireland Unlimited Company and Meta Platforms Ireland Limited process your data under their own privacy policies. For the page statistics these platforms give us, we may be joint controllers with them (Article 26 GDPR); the platforms’ terms set out how that processing works and how they handle requests about it. We only see aggregated statistics and the public interactions with our posts.

This website uses no advertising, analytics or social media cookies, loads nothing from other websites and stores nothing on your device, with a single exception:

Cookie

_vcrcs

Set by

Vercel, our hosting provider, only when its security check screens a visit

Purpose

To remember that your browser passed the check, so that it is not repeated on every page

Duration

1 hour

Category

Strictly necessary; first-party, sent only to ethikos.services

Because this cookie is strictly necessary to provide the website securely, it does not require your consent (Article 5(2) of Law no. 41/2004). That is why the website has no cookie banner. You can delete or block cookies in your browser settings; if you block this one, the security check may run again.

If we ever use cookies or similar technologies that are not strictly necessary, we will ask for your consent first.

We share personal data only with those who need it for the purposes above:

• Vercel Inc. (United States), which hosts the website, runs the contact forms and measures visits on our behalf; it also processes technical data for its own security and service purposes, under its privacy policy;
• Plus Five Five, Inc., trading as Resend (United States), which delivers the messages sent through our forms to our mailbox and the confirmation email to the person who wrote;
• Microsoft Ireland Operations Limited (Ireland), which provides our email and office software (Microsoft 365);
• our certified accountant, legal advisers and auditors, who are bound by duties of confidentiality;
• public authorities and courts, when the law requires it.

Service providers that process data on our behalf do so under a data processing agreement and only on our instructions (Article 28 GDPR).

We do not share your data with Ethikos Lawyers, Ethikos Advisors or any other company unless you ask us to. If your request needs a lawyer, we pass it on only with your explicit consent. We do not sell personal data, and we do not use it for advertising.

Vercel and Resend are based in the United States, and data they handle may be processed there. These transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which both companies are certified, and on the standard contractual clauses adopted by the Commission (Implementing Decision (EU) 2021/914), which are part of their data processing agreements.

Microsoft stores and processes our Microsoft 365 data within the European Union, under its EU Data Boundary; the limited transfers outside the EU that Microsoft documents are covered by the same safeguards.

You can ask us for a copy of these safeguards at contact@ethikos.services.

We use technical and organisational measures suited to the risk (Article 32 GDPR): the whole website is served over encrypted connections (HTTPS), access to personal data is limited to the people who need it, and our service providers are bound by contract to confidentiality and security obligations.

If a personal data breach is likely to put your rights at risk, we will notify the CNPD within 72 hours of becoming aware of it and, if the risk is high, we will also tell you (Articles 33 and 34 GDPR).

You have the right to:

• access the personal data we hold about you and receive a copy of it (Article 15 GDPR);
• have inaccurate data corrected and incomplete data completed (Article 16);
• have your data erased (Article 17);
• restrict how we use your data (Article 18);
• receive the data you gave us in a structured, commonly used and machine-readable format, or have it sent to another controller, when we process it by automated means on the basis of your consent or of a contract (Article 20);
• withdraw your consent at any time, without affecting the lawfulness of what was done before (Article 7(3)).

We make no decisions about you based solely on automated processing, including profiling (Article 22 GDPR).

To exercise your rights, write to contact@ethikos.services. It is free of charge. We may ask you to confirm your identity, and we reply within one month; for complex or numerous requests this may be extended by two further months, in which case we will tell you why within the first month (Article 12 GDPR).

Some rights have limits set by law. For example, we cannot erase data that we are legally required to keep, such as invoices, until that period ends.

Your right to object

You can object at any time, on grounds relating to your particular situation, to any processing based on our legitimate interests. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. You can also object at any time, without giving reasons, to any use of your data for direct marketing, and we will stop (Article 21 GDPR). To object, write to contact@ethikos.services.

If you believe we have not handled your data properly, please tell us at contact@ethikos.services so that we can put it right. You also have the right to lodge a complaint with the Portuguese data protection authority:

Authority

Comissão Nacional de Proteção de Dados (CNPD)

Address

Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal

Telephone

+351 213 928 400

Email

geral@cnpd.pt

Website

www.cnpd.pt

You may instead complain to the data protection authority of the EU country where you live or work, or where the alleged infringement took place, and you have the right to an effective judicial remedy (Articles 77 and 79 GDPR).

We update this policy whenever our processing changes. The date at the top shows the version in force. If a change significantly affects how we use your data, we will say so clearly on this page.