This Privacy Policy sets out the terms applicable to the processing of personal data by Everythink, Lda. (hereinafter “Everythink”) in the context of the use of its website and the forms provided therein, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — “GDPR”) and other applicable legislation.

‍

1. Data Controller: The data controller for personal data is: Everythink, Lda, with registered office at Rua Alfredo Allen, 455 – 4200-135 Porto and email address info@everythink.com

‍2. Categories of Processed Data and Purposes: Everythink only processes the personal data strictly necessary for the purposes indicated below.

2.1. Newsletter Subscription

• Data collected: Name and email address;
• Purpose: Sending informative, promotional, and institutional communications;
• Legal basis: Consent of the data subject (Art. 6(1)(a) of the GDPR).

2.2. Contact Form

• Data collected: Name, email address, phone number (optional), and message content.
• Purpose: Management of and response to contact requests, clarifications, collaboration proposals, or other matters submitted by the user.
• Legal basis: Everythink's legitimate interest in ensuring the processing of received inquiries (Art. 6(1)(f)), or consent where applicable.

3. Data Retention: Personal data is kept only for the period strictly necessary for the purposes for which it was collected:

• Newsletter: until consent is withdrawn by the data subject.
• Contact form: up to 12 months after the resolution of the request or the last relevant interaction, unless otherwise required by law.

Everythink will delete or anonymize data after the periods indicated above have elapsed.‍

4. Data Sharing with Third Parties: Under no circumstances will data be sold or shared with external entities for commercial purposes. Everythink does not share personal data with third parties, except:

a) Service providers acting on behalf of Everythink (e.g., email marketing platforms), under a written contract ensuring compliance with the GDPR;

b) When required by law or by a competent authority.

‍5. International Transfers: These will only occur under the appropriate safeguards provided for by the GDPR. If it is necessary to transfer data to countries outside the European Union, Everythink will ensure that such transfer only takes place when there is an adequacy decision by the European Commission or through the adoption of appropriate safeguards as provided for by the GDPR.

‍6. Security: Everythink adopts appropriate technical and organizational measures to ensure the integrity, confidentiality, and availability of personal data, preventing unauthorized access, loss, destruction, or improper disclosure.

‍7. Data Subject Rights: Data subjects may exercise their rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent via the email address provided. You may also file a complaint with the CNPD. Requests to exercise these rights should be sent to: info@everythink.com. Data subjects may also file a complaint with the National Data Protection Commission (CNPD).

8. Policy Updates: Everythink reserves the right to modify or update this Policy at any time. The most recent version will always be available on the website and identified by the date of the last update.