This Privacy Policy explains how Necrocaser Unipessoal Lda ("Necrocaser", "we", "us") collects, uses, stores, and protects your personal data when you visit necrocaser.life, contact us, or engage our interior concept services. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Portuguese Law No. 58/2019 of 8 August (implementing the GDPR), and applicable CNPD guidance.
1. Scope
This policy applies to all personal data processed through:
- The website necrocaser.life
- Email, telephone, and in-person communications
- Client engagements for interior concept services
- Consultation bookings and project delivery
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity data | Full name, company name, job title | Contact forms, email, contracts |
| Contact data | Email address, phone number, postal address | Contact forms, email, contracts |
| Project data | Venue details, floor plans, business requirements, budget range | Consultations, briefs, site visits |
| Financial data | IBAN (for refunds only), invoicing details, payment records | Contracts, bank transfers |
| Technical data | Browser type, device type, pages visited, consent status | Website (localStorage only) |
| Communication data | Email correspondence, consultation notes, feedback | Email, meetings, phone calls |
We do not collect special categories of personal data (Article 9 GDPR) such as health data, biometric data, or data revealing racial or ethnic origin, unless you voluntarily provide such information in project communications and we have your explicit consent.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Responding to enquiries and providing quotes | Art. 6(1)(b) — steps prior to entering a contract; Art. 6(1)(f) — legitimate interest in operating our business |
| Delivering interior concept services under contract | Art. 6(1)(b) — performance of a contract |
| Invoicing, accounting, and tax compliance | Art. 6(1)(c) — legal obligation (Portuguese tax and commercial law) |
| Storing cookie consent preference | Art. 6(1)(a) — consent |
| Anonymous portfolio references | Art. 6(1)(f) — legitimate interest, balanced against your rights |
| Defending legal claims | Art. 6(1)(f) — legitimate interest; Art. 6(1)(c) where applicable |
4. How we use your data
We use personal data exclusively for the purposes listed above. Specifically:
- To respond to contact form submissions and email enquiries within one business day
- To prepare project briefs, concept packages, and deliverables under contract
- To issue invoices, process payments, and maintain accounting records as required by Portuguese law (retention: 10 years per Código Comercial)
- To remember your cookie consent preference via localStorage (key: necrocaser_life_consent)
- To improve our website and services based on aggregated, non-identifiable usage patterns
We do not use your data for automated decision-making or profiling within the meaning of Article 22 GDPR.
5. Data sharing and processors
We do not sell, rent, or trade your personal data. We may share data with:
- Accountant / tax advisor: Invoicing and tax compliance (Portugal)
- IT infrastructure providers: Email hosting and secure file transfer for project deliverables (EU-based where possible)
- Legal counsel: Only if required to defend or pursue legal claims
All processors act under data processing agreements compliant with Article 28 GDPR. We do not transfer personal data outside the European Economic Area (EEA) unless adequate safeguards are in place (Standard Contractual Clauses or adequacy decision).
6. Retention periods
| Data type | Retention period |
|---|---|
| Enquiry data (no contract signed) | 12 months from last contact, then deleted |
| Client project data | Duration of contract + 5 years (limitation period under Portuguese civil law) |
| Invoices and financial records | 10 years (Código Comercial, Art. 418) |
| Cookie consent (localStorage) | Until you clear browser storage or withdraw consent |
| Email correspondence | 5 years from last communication, unless longer retention required by law |
7. Your rights under GDPR
As a data subject, you have the following rights under Articles 15–22 GDPR:
- Right of access (Art. 15): Request a copy of the personal data we hold about you
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
- Right to erasure (Art. 17): Request deletion of your data, subject to legal retention obligations
- Right to restriction (Art. 18): Request that we limit processing in certain circumstances
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
- Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior lawful processing
To exercise any of these rights, contact us at [email protected] with the subject line "Data Subject Request". We will respond within 30 days as required by Article 12(3) GDPR.
8. Right to lodge a complaint
If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the CNPD:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º
1200-651 Lisboa, Portugal
Website: www.cnpd.pt
Email: [email protected]
9. Security measures
We implement appropriate technical and organisational measures to protect personal data, including:
- Encrypted email communication (TLS) for all client correspondence
- Password-protected file transfer for project deliverables
- Access controls limiting personal data to authorised personnel only
- Regular review of data processing activities and retention schedules
- Physical security at our São Bento studio (locked premises, no public access to client files)
No method of electronic transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.
10. Children's data
Our website and services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, contact us immediately and we will delete it.
11. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be indicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
12. Contact
For privacy-related questions or to exercise your data subject rights:
Necrocaser Unipessoal Lda
Rua de São Bento 142, 1200-822 Lisboa, Portugal
Email: [email protected]
Phone: +351 21 346 7829