Privacy Policy

Last updated: 20 September 2026

This policy explains what personal data is collected when you visit sites.gratis or hire our services, what it is used for, who it is shared with, and what rights you have.

1. Data controller

Given the size and nature of the activity, there is no legal obligation to appoint a Data Protection Officer. Requests concerning personal data are handled directly by the controller, using the contacts above.

2. What data we collect

This site has no forms. We do not ask for data to browse it and we do not create user accounts. Personal data only reaches us when you start the contact yourself, or when you accept analytics cookies.

Category	Data	Source
Contact data	Name, phone number, email address and the content of the messages you send us	Provided by you, via WhatsApp or email
Project data	Information about your business, plus text, images, logos, product catalog and platform credentials (Wix, Shopify, domain, email) you hand over so we can build and configure the site or online store	Provided by you during the service
Billing data	Name or company name, address, tax number and invoiced amounts	Provided by you, required by tax law
Browsing data	Pages viewed, device, browser and traffic source — always in aggregate form	Meta Pixel, only if you accept cookies
Technical logs	IP address and access timestamp, kept by the hosting server	Automatic, inherent to how the internet works

3. Why we use it, and on what basis

Purpose	Legal basis (GDPR)
Answering enquiries and preparing quotes	Pre-contractual steps, Art. 6(1)(b)
Delivering the agreed service and communicating during the project	Performance of a contract, Art. 6(1)(b)
Issuing invoices and meeting tax and accounting obligations	Legal obligation, Art. 6(1)(c)
Measuring ad performance and improving the site	Consent, Art. 6(1)(a)
Keeping the site secure and working	Legitimate interest, Art. 6(1)(f)

We do not make automated decisions with legal effects concerning you, and we do not carry out profiling beyond the aggregate campaign measurement described above.

4. Who we share it with

We do not sell personal data. We share only what is necessary, and only with:

• Meta Platforms Ireland Limited — ad measurement, when you accept cookies. See the Cookie Policy.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing, if you choose to pay that way. PayPal acts as an independent controller for the data it collects.
• WhatsApp Ireland Limited — when you talk to us on WhatsApp, the conversation is handled under that service's terms.
• Wix.com Ltd. — the platform where contracted websites are built and hosted, when that is the chosen solution. sites.gratis is an official Wix partner.
• Shopify International Limited / Shopify Inc. — the platform where contracted online stores are built and hosted. sites.gratis is an official Shopify partner and accesses client stores through a partner account, solely to set them up and maintain them.
• Our hosting provider — storage of the site files and technical access logs.
• Certified accountant and the Portuguese Tax Authority — billing data, as required by law.

5. Sites and online stores we manage for clients

When we build or maintain a website or a Shopify store on a client's behalf, the data of that store's visitors and buyers (name, delivery address, contacts, orders) belongs to the client. In that relationship:

• The client is the data controller and is responsible for publishing their own privacy and cookie policies on the store.
• sites.gratis acts as a processor under Art. 28 GDPR: we access the data only where needed to configure, fix or maintain the store, following the client's instructions, and never for our own purposes.
• Shopify (or Wix, depending on the platform) acts as the client's processor for hosting and order processing, under that platform's own data processing terms.
• Payments in the store are handled by the providers the client chooses (for example Shopify Payments, Multibanco/MB WAY, PayPal), which act as independent controllers for payment data. sites.gratis never has access to full card details.

Once the service ends, partner access to the store can be removed at the client's request.

6. International transfers

Some of these providers belong to groups with infrastructure outside the European Economic Area, notably in the United States, Canada and Israel. Where that happens, transfers rely on the standard contractual clauses approved by the European Commission, or on an applicable adequacy decision — as is the case for Canada, home of the Shopify group, covered by a European Commission adequacy decision.

7. How long we keep it

Data	Retention
Enquiries that do not lead to a project	Up to 12 months after the last contact
Project documentation and communications	For the duration of the contract and 3 years afterwards
Platform credentials (Wix, Shopify, domain)	For the duration of the contract; returned or deleted when the service ends
Invoices and accounting records	10 years, as required by law
Analytics cookies	Up to 90 days, or until you withdraw consent

8. Security

The site is served over HTTPS. WhatsApp conversations are end-to-end encrypted by the service itself. The accounts used in the business, including the Wix and Shopify partner accounts, have two-factor authentication enabled, and access to client stores is individual and revocable. No measure removes risk entirely, but we keep processing to the minimum needed.

9. Your rights

You may exercise the following rights at any time:

• Access the personal data we hold about you
• Have inaccurate or incomplete data corrected
• Request erasure, where no legal retention duty applies
• Restrict or object to certain processing
• Receive your data in a structured format (portability)
• Withdraw consent, without affecting the lawfulness of earlier processing

To exercise any of these, write to nunobarataalves@gmail.com. We reply within one month at most.

If you believe your data is not being handled properly, you may lodge a complaint with the Portuguese data protection authority, CNPD.

10. Children

These services are aimed at professionals and businesses. We do not knowingly collect data from anyone under 16. If that happens by mistake, the data is deleted as soon as we notice.

11. Changes

This policy may be updated whenever the tools or practices described here change. The date at the top shows the version in force.