PRIVACY POLICY

Effective Date: February 14, 2026

1. Who We Are

This Privacy Policy explains how Afortexpansão Unipessoal Lda (trading as Stonali) collects, uses, stores, and protects your personal data in compliance with:

• GDPR (EU Regulation 2016/679)
• Portuguese Data Protection Law (Lei n.º 58/2019)

Data Controller:

Afortexpansão Unipessoal Lda

NIF: 516262092

Address: Rua Courela do Forno, Lote 7, 2660 Ramada, Odivelas, Portugal

Email: info@stonali.com

Website: www.stonali.com

2. What Personal Data We Collect

We collect personal data when you:

• Fill out a contact form on our website
• Email us directly
• Commission a project
• Subscribe to updates (if applicable)

Data collected includes:

• Contact Information: Name, email address, phone number
• Project Information: Company name, project type, location, budget, timeline, and any details you provide about your vision
• Website Analytics: IP address, browser type, device type, pages visited, time spent on site (via cookies)
• Payment Information: Bank details (for invoicing purposes only — we do not store credit card data)

3. Why We Collect Your Data (Legal Basis)

We process your personal data based on the following legal grounds under GDPR:

• To respond to inquiries and communicate about projects: Legitimate interest (Article 6(1)(f))
• To execute project contracts: Contract performance (Article 6(1)(b))
• To send invoices and process payments: Contract performance and legal obligation (tax/accounting requirements)
• To maintain records for tax and legal compliance: Legal obligation (Article 6(1)(c))
• For marketing purposes: Only with your explicit consent (Article 6(1)(a))
• For website analytics and improvement: Legitimate interest (Article 6(1)(f))

4. How We Use Your Data

We use your personal data to:

• Respond to your project inquiries
• Provide consultations, proposals, and contracts
• Communicate throughout the project (updates, scheduling, approvals)
• Issue invoices and manage payments
• Fulfill legal obligations (tax records, accounting)
• Improve our website and services (via anonymized analytics)

We do NOT:

• Sell or rent your data to third parties
• Use your data for unsolicited marketing (unless you opt in)
• Share your data with advertisers or data brokers

5. Who We Share Your Data With

We may share your personal data with:

• Email service providers (e.g., Google Workspace) — to communicate with you
• Accounting/tax professionals — for legal and financial compliance
• Payment processors (if applicable) — to process payments securely
• Installation partners — only if your project requires coordination with trusted third-party installers (with your knowledge)
• Legal authorities — if required by Portuguese or EU law

All third parties are GDPR-compliant and process data only as instructed.

6. International Data Transfers

Your data is primarily stored and processed within the European Union. If we use service providers outside the EU (e.g., cloud hosting), we ensure they comply with GDPR through:

• Adequacy decisions (approved by the EU Commission)
• Standard Contractual Clauses (SCCs)
• Privacy Shield (if applicable)

7. How Long We Keep Your Data

Active project data: Retained for the duration of the project plus 5 years (legal and tax requirement under Portuguese law).

Inquiries that don't proceed: Deleted after 2 years.

Invoices and contracts: Retained for 10 years (Portuguese tax law requirement).

Marketing consents: Retained until you withdraw consent.

Website cookies: Stored for up to 12 months.

After these periods, data is securely deleted or anonymized.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

Right to Access: Request a copy of the personal data we hold about you.

Right to Rectification: Correct inaccurate or incomplete data.

Right to Erasure ("Right to be Forgotten"): Request deletion of your data (unless legally required to retain it).

Right to Restrict Processing: Limit how we use your data.

Right to Data Portability: Receive your data in a standard, machine-readable format.

Right to Object: Object to processing based on legitimate interest.

Right to Withdraw Consent: If processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at: info@stonali.com

We will respond within 30 days (or explain why we need more time).

9. Cookies & Website Tracking

We use cookies to:

• Ensure the website functions properly (essential cookies)
• Analyze website traffic and user behavior (analytics cookies via Google Analytics)

You can:

• Disable cookies in your browser settings
• Opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout

Disabling cookies may affect website functionality.

10. Data Security

We implement industry-standard security measures to protect your data, including:

• Encrypted data transmission (SSL/TLS)
• Secure servers and access controls
• Regular backups
• Limited access to personal data (only authorized personnel)

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

11. Children's Privacy

Our services are not directed at individuals under 18 years old. We do not knowingly collect data from minors. If you believe we have collected data from a child, contact us immediately at info@stonali.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy occasionally to reflect changes in our practices or legal requirements. Updates will be posted on this page with a new "Effective Date." We encourage you to review this policy periodically.

13. Your Right to Complain

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Portuguese Data Protection Authority:

CNPD (Comissão Nacional de Proteção de Dados)

Website: https://www.cnpd.pt

Email: geral@cnpd.pt

Phone: +351 213 928 400

You may also complain to the data protection authority in your EU country of residence.

14. Contact Us

For questions about this Privacy Policy or to exercise your rights:

Email: info@stonali.com

Address: Rua Courela do Forno, Lote 7, 2660 Ramada, Odivelas, Portugal