Privacy Policy

Carp-Bezverhnii, Unipessoal Lda.

Effective Date: 6 August 2026

Last Updated: 6 August 2026

1. Who we are – Data Controller

Carp-Bezverhnii, Unipessoal Lda.
NIF: 518832511
Registered office: Rua dos Argonautas 5, Portugal
Email: contact@cbfactory.co
Website: https://www.cbfactory.co

We are the data controller responsible for the processing of your personal data when you visit and use our website https://www.cbfactory.co (the "Website"), including when you contact us or book a discovery call.

1.1 Our Role and Client Responsibility

We provide product consulting, software engineering, architecture, infrastructure, and related technical services to help clients move ideas, prototypes, and MVPs to the next stage or production.

We act as a provider of professional services and technical delivery.

We do not, unless explicitly agreed otherwise in a separate written agreement:

determine the purposes for which any client product data is collected or used beyond what is needed to deliver the engagement;
act as data controller for personal data that belongs to our clients’ end users or customers;
take ownership of client products, codebases, or customer relationships.

Where we process personal data on behalf of a client during an engagement, roles and responsibilities are defined in the relevant contract or data processing agreement.

The client remains responsible for their own product compliance, including GDPR obligations toward their users, unless otherwise agreed in writing.

2. What personal data do we collect?

We collect the following categories of personal data:

A. Data you actively provide to us

Name
Email address
Phone number
Company name / position
Any other information you voluntarily send us through email, booking tools, or other communication channels

B. Data we collect automatically

IP address
Date and time of visit
Browser type and version
Operating system
Device type
Approximate geographic location (derived from IP address)
Pages viewed, time spent on pages, referral source
Cookies and similar tracking technologies (see section 7. Cookies and other tracking technologies)

3. Legal basis for processing

We process your personal data on the following legal bases:

Answering your contact / consultation request → Contract / pre-contractual steps (Art. 6(1)(b) GDPR – necessary to respond to your inquiry)
Providing our services / executing a contract → Contract (Art. 6(1)(b) GDPR)
Sending commercial communications / newsletter → Consent (Art. 6(1)(a) GDPR – you can withdraw consent at any time)
Analysing website usage (analytics tools) → Legitimate interests (Art. 6(1)(f) GDPR – improve our website / services)
Ensuring website security & fraud prevention → Legitimate interests (Art. 6(1)(f) GDPR – protect our systems and users)
Complying with legal obligations → Legal obligation (Art. 6(1)(c) GDPR, e.g. tax, accounting, answering authority requests)

4. How long do we keep your personal data?

We keep personal data only for as long as necessary for the purpose for which it was collected:

Contact / booking inquiries → until the matter is closed + 12 months (for defence in case of dispute)
Newsletter subscribers → until you unsubscribe / withdraw consent
Analytics data (anonymised / aggregated) → up to 26 months
Server logs / security data → maximum 6–12 months
Contract / invoice data → 10 years (legal accounting & tax obligation in Portugal)

After these periods we either delete or anonymise the data.

5. Who do we share your data with? (Recipients)

Categories of recipients:

IT & hosting providers (EU and/or EEA)
Scheduling / booking providers used to arrange discovery calls (e.g. Cal.com), when you book through those tools
Analytics providers, where used (with appropriate transfer safeguards)
Content Delivery Network (CDN) providers
Our external accountant / tax consultant (Portugal)
Public authorities when we have a legal obligation

We do not sell your personal data to anyone.

6. International data transfers (outside EEA)

Some of our processors may be located outside the European Economic Area.

Whenever we transfer personal data outside the EEA, we ensure an adequate level of protection by using at least one of the following safeguards:

Adequacy decision of the European Commission
EU Standard Contractual Clauses (SCCs) + supplementary measures when necessary
EU-U.S. Data Privacy Framework (for US companies certified under DPF)

You can ask us for more information about the safeguards we use.

7. Cookies and other tracking technologies

We may use cookies and similar technologies.

Where a cookie banner is shown, you can manage preferences there. You can also manage cookies through your browser settings at any time.

8. Your rights under GDPR

As a data subject you have the following rights:

Right to access your personal data
Right to rectification
Right to erasure ("right to be forgotten")
Right to restriction of processing
Right to data portability
Right to object to processing
Right to withdraw consent at any time (when processing is based on consent)
Right not to be subject to automated decision making (if applicable)

How to exercise your rights

Send your request to: contact@cbfactory.co

We will normally answer within one month.

9. Right to lodge a complaint

If you believe we are not processing your data in accordance with the law, you have the right to lodge a complaint with the supervisory authority:

Comissão Nacional de Proteção de Dados – CNPD
Website: https://www.cnpd.pt
Email: geral@cnpd.pt

10. Data Security

We implement appropriate technical and organisational measures to protect your data.

However, please be aware that no method of transmission over the internet or electronic storage is 100% secure.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

The new version will be published on this page with an updated Last Updated date.

We recommend that you review this page periodically.

12. Contact us

Email (preferred): contact@cbfactory.co
Website: https://www.cbfactory.co