Privacy Policy

This English version is provided for convenience. The Portuguese version prevails in case of conflict.

Last updated: 2 May 2026

This Privacy Policy describes how PROFECIABRAND LDA collects and processes your personal data when you visit profeciabranda.com, apply to collaborate with us, or use our creator portal. It is issued under the EU General Data Protection Regulation (GDPR, EU 2016/679) and Portuguese Law 58/2019.

1. Data controller

PROFECIABRAND LDA, registered office at Rua C nº 33, 4480-621 Árvore, Portugal. For any privacy matter, contact us at collab@profeciabranda.com.

2. What data we collect

We only collect data necessary for the purposes set out below:

  • Application data: name, email, phone, age, social media handles, audiovisual material you choose to share, and anything you write in the /apply form.
  • Creator account data: email, password (bcrypt hash only), preferred language, account and contract status.
  • Contract data: signed content, IP and user-agent at signing time, the exact consent text shown to you, the generated PDF, and the signing date.
  • Communication data: send, open, click, bounce, and complaint events for emails we send you, handled by our email processor.
  • Technical site data: aggregated, anonymous statistics — approximate country, page visited, device type. We do not use tracking cookies or persistent identifiers (see Section 7).

3. Purposes and legal bases

  • Evaluating applications and managing the contractual relationship with creators — performance of a contract (Art. 6(1)(b) GDPR).
  • Meeting legal obligations (accounting, tax, retention of contractual evidence) — Art. 6(1)(c) GDPR.
  • Communicating with you about your application status, contract expiry, and portal operations — legitimate interest and contract performance.
  • Securing the platform and preventing fraud and abuse — legitimate interest (Art. 6(1)(f) GDPR).
  • Aggregately analysing site traffic to improve it — legitimate interest, using cookieless analytics with no individual identification.

4. Who we share data with

We do not sell your data. We share only with processors that provide essential services to the site and portal:

  • Hetzner Online GmbH (Germany) — infrastructure hosting.
  • Resend, Inc. (United States) — transactional email and deliverability webhooks.
  • Payment and accounting providers, where applicable to creator payments.
  • Public authorities, where required by law.

Processors act on our behalf under data processing agreements that bind them to a level of protection equivalent to this policy.

5. How long we keep your data

  • Unsuccessful applications: up to 12 months after the decision, unless you ask for earlier deletion.
  • Creator accounts and signed contracts: for the duration of the relationship and, after termination, for the legal retention period that applies (typically 10 years for accounting and contractual records).
  • Signing audit records (IP, user-agent, template hash): kept for as long as the related contract must be retained.
  • Email event logs (delivery, bounce): 24 months.
  • Aggregated visit statistics: 12 months.

6. International transfers

Where possible, your data is processed within the European Economic Area. Where a processor operates outside the EEA — notably Resend (USA) — the transfer relies on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) or another valid transfer mechanism.

7. Cookies and analytics

The site uses only strictly necessary cookies — portal authentication session and CSRF protection. These cookies do not require prior consent under Article 5(3) of the ePrivacy Directive.

To understand site traffic we run a self-hosted Umami instance on our own infrastructure. It does not set cookies, does not collect identifying IP addresses, does not fingerprint, and does not allow re-identification. On those grounds, and in line with CNPD guidance on anonymous statistics, this processing does not require consent.

8. Your rights

At any time you have the right to:

  • Access your data and obtain a copy of it;
  • Request correction of inaccurate or outdated data;
  • Request deletion of your data, except where a legal retention obligation applies;
  • Request restriction of, or object to, processing on grounds related to your particular situation;
  • Request portability of the data you provided to us, in a structured and readable format;
  • Withdraw your consent, where processing relies on consent, without affecting the lawfulness of prior processing.

9. How to exercise your rights

Send your request to collab@profeciabranda.com identifying the right you wish to exercise. We respond within a maximum of 30 days. We may ask for proof of identity where necessary to confirm the request comes from the data subject.

10. Complaints to the supervisory authority

You have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa — geral@cnpd.pt — www.cnpd.pt.

11. Changes to this Policy

We may update this Policy to reflect changes in the law or in how our services operate. The version in force is always the one published on this page, identified by the last-updated date.