Privacy Policy

Conta Plena ("Conta Plena", "we", "us" or "our") provides accounting, tax and business consulting services to individuals and companies in Madeira and mainland Portugal, including international clients. This Privacy Policy explains what personal data we collect through this website, why we collect it, who we share it with, how long we keep it, and what rights you have in relation to it.

This Policy applies to contaplena.pt and to any enquiry, booking request or other message you send us through the website. It does not cover the separate engagement letter, data processing agreement or service terms you sign with us once you become a client. Those documents take precedence for the personal data we process while delivering accounting or consulting services on your behalf.

This Policy is issued in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and Portuguese Law no. 58/2019.

1. Who we are

The data controller responsible for the personal data collected through this website is:

• Conta Plena - Contabilidade & Fiscalidade, Lda.
• Registered office: Impasse Água de Mel, N.º 2, 9020-063 Funchal, Madeira, Portugal
• Company registration / NIPC: 518710378
• Email: geral@contaplena.pt
• Phone: +351 938 023 952

We are not required to appoint a Data Protection Officer under Article 37 of the GDPR and have not appointed one. All privacy queries and requests should be sent to the contact details above and will be handled by our management team.

Where we act as a data processor on behalf of a client, for example when processing accounting records or payroll data you supply to us, the terms of that engagement govern how that data is handled rather than this Policy. This Policy concerns data we collect in our own capacity as controller, mainly through this website.

2. What data we collect

Depending on how you interact with us, we may collect the following categories of personal data.

2.1 Data you give us directly

• Contact details: your name, email address and phone number, submitted through one of our website forms, through our booking modal, or by email or telephone.
• Enquiry content: the information you choose to share about your situation, your business or the service you are enquiring about. This is free text, so the content is entirely within your control.
• Booking details: your preferred date and time for a consultation, and any information needed to schedule and confirm the appointment.
• Correspondence: records of emails, calls and messages exchanged with us, including any attachments you choose to send.

The website currently operates three enquiry forms: the general contact form on the homepage, the IRS enquiry form, and the IBC Madeira enquiry form. All three collect the same core fields described above.

2.2 Data collected automatically

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, and approximate location inferred from your IP address.
• Usage data: pages visited, time spent on pages, referring website, search terms used to reach the site, and interactions such as clicking a booking button.
• Cookie data: identifiers stored on your device as described in Section 5, and your recorded cookie preferences.

We do not intentionally collect special categories of personal data under Article 9 of the GDPR, such as health, religious, political or biometric data, through this website. If you include such information in a free-text enquiry, we will process it only to the extent necessary to respond to you.

3. How we collect your data

We collect personal data when you:

• Submit the homepage contact form, the IRS enquiry form or the IBC Madeira enquiry form;
• Request or book a consultation through our booking modal, which is powered by Microsoft Bookings;
• Email, call or message us directly;
• Browse the website, through cookies and similar technologies described in Section 5; and
• Interact with our Google Business Profile listing, for example by requesting directions, calling from the listing or leaving a review. Data you submit to Google in that context is governed by Google's own privacy policy, and we receive only aggregated insights and any review content you publish.

4. Legal basis and purpose of processing

Under the GDPR we must have a lawful basis for each processing activity. The table below sets out what we do and why.

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

5. Cookies and similar technologies

A cookie is a small text file placed on your device when you visit a website. We also use similar technologies such as pixels, tags and local storage. This section serves as our cookie policy.

5.1 Your choices

When you first visit the website you are shown a cookie banner. You can select "Accept all" to allow all categories, or "Manage cookies" to choose which categories to allow or to opt out of non-essential cookies. Strictly necessary cookies are set regardless, because the website cannot function without them. Your preference is stored so that you are not asked on every visit, and you can change it at any time by reopening the cookie preferences from the banner or by clearing cookies in your browser.

5.2 Categories of cookies used

Analytics data collected through Google Analytics 4 is used in aggregate. We have IP anonymisation applied by default under Google Analytics 4 and we do not use analytics data to identify individual visitors.

You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the website from working correctly.

6. Advertising and remarketing

We may run paid advertising campaigns on Google Ads and on Meta platforms, including Facebook and Instagram. Where these campaigns are active, the following may apply:

• A Google Ads conversion tag or a Meta pixel may be loaded on the website to measure how many visitors arrive from an advertisement and how many go on to make an enquiry;
• These tools may set cookies or similar identifiers that allow Google or Meta to recognise your device across websites and to show you our advertising again at a later date, a practice known as remarketing; and
• We may create audiences based on website activity in order to reach people with similar interests.

These technologies are only loaded if you consent to advertising cookies. If you decline, no advertising tag is placed on your device. Google and Meta act as independent controllers or, in certain cases, as joint controllers with us for the data they collect through these tools, and their own privacy policies apply to that processing. You can also manage advertising preferences directly through your Google account settings and your Meta account settings.

7. Who we share your data with

We do not sell your personal data and we do not share it for the independent commercial purposes of others. We share it only with service providers who process it on our behalf under contract, and with third parties where we are legally required to do so.

We may also disclose personal data to:

• Professional advisers and IT support providers who assist us under duties of confidentiality;
• Public authorities, including the Portuguese tax authority and authorities responsible for the prevention of money laundering and terrorist financing, where disclosure is required by Portuguese or EU law; and
• A purchaser or successor in the event of a sale, merger or reorganisation of our business, subject to the same protections described in this Policy.

Each processor acts only on our documented instructions and is bound by a written data processing agreement that requires appropriate technical and organisational safeguards.

8. International data transfers

Some of the providers listed above are established in, or process data in, the United States. This means your personal data may be transferred outside the European Economic Area.

Where such a transfer takes place, we rely on one or more of the following safeguards recognised under Chapter V of the GDPR:

• The European Commission's adequacy decision of 10 July 2023 in respect of the EU-US Data Privacy Framework, where the recipient is a certified participant;
• The European Commission's Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures; or
• Another lawful transfer mechanism recognised under the GDPR.

You may request further information about the safeguards applied to a specific transfer by contacting us using the details in Section 15.

9. How long we keep your data

We keep personal data only for as long as necessary for the purposes for which it was collected, or for as long as we are required to keep it by law.

Once a retention period expires, data is deleted or irreversibly anonymised. You may ask us to delete enquiry data sooner, and we will do so unless we are required to keep it.

10. How we protect your data

We apply technical and organisational measures appropriate to the risk, including encrypted transmission of all website traffic and form submissions over HTTPS, access controls and multi-factor authentication on our business accounts, restriction of access to personal data on a need-to-know basis, and the use of established service providers who maintain recognised security standards.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Comissão Nacional de Proteção de Dados within 72 hours where required, and we will inform you directly where the breach is likely to result in a high risk to you.

11. Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not use your data for profiling of that kind. Analytics and, where active, advertising tools involve statistical segmentation only and do not result in decisions about you as an individual.

12. Your rights under the GDPR

Subject to the conditions set out in the GDPR, you have the right to:

• Be informed about how your personal data is used, which is the purpose of this Policy;
• Access the personal data we hold about you and receive a copy of it;
• Rectify inaccurate or incomplete data;
• Erase your data in certain circumstances, sometimes described as the right to be forgotten;
• Restrict processing while a query about accuracy or lawfulness is resolved;
• Object to processing based on our legitimate interests, and to object at any time and without justification to processing for direct marketing purposes;
• Data portability, to receive data you provided to us in a structured, commonly used and machine-readable format;
• Withdraw consent at any time where processing is based on consent; and
• Lodge a complaint with a supervisory authority, as described in Section 15.

To exercise any of these rights, contact us using the details in Section 15. We may ask for information to verify your identity before we act, in order to avoid disclosing data to the wrong person. We will respond within one month of receiving your request. That period may be extended by two further months for complex requests, in which case we will tell you within the first month and explain why. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

Certain rights may be limited where we are subject to a legal retention obligation or a duty of professional secrecy.

13. Children's privacy

This website and our services are directed at businesses and at adults capable of entering into professional service agreements. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us so that we can delete it.

14. Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices, the tools we use, or legal requirements. The "Last updated" date at the top of this page shows when it was last revised. Where a change materially affects how we use your personal data, we will take reasonable steps to bring it to your attention.