Legal

Privacy Policy

Last updated · May 14, 2026

1. Who we are

Data controller: Oleksandr Shevchuk, sole trader (trabalhador independente) based in Algarve, Portugal, registered under tax number (NIF) 318260077, trading as alexgoes.dev. Activity: programação e consultoria informática (CAE 62010 / 62020), IRS Categoria B — Regime Simplificado, IVA Regime de Isenção (Art. 53.º CIVA).

Contact for any data-protection question: hi@alexgoes.dev · phone +351 963 463 827 · Telegram @alexandrrid. No dedicated DPO is appointed — solo operation. Inquiries reach the controller directly.

Official registered contact (Autoridade Tributária e Aduaneira): geekneedspace@gmail.com.

2. What data we collect and why

2.1 Visitors (analytics)

If you accept analytics cookies, Google Analytics 4 records: pages visited, scroll depth, button clicks, country (derived from IP, IP itself is not stored), device type, referring URL, approximate session duration.

Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it any time via in the footer.

If you decline, no analytics cookies are stored. Google may still receive an anonymous, cookieless ping (Google Consent Mode v2) used only for traffic estimation — no personal data, no identifiers.

2.2 Contact forms (brief, contact modal)

When you submit a project brief or contact form we collect: name, email, optional company name, your message, plus any fields you fill in (budget range, services, attached description). Used only to reply to your request.

Legal basis: steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)).

We use hCaptcha to prevent spam submissions. hCaptcha may process your IP and a bot-score hash on its servers. Legal basis: legitimate interest in preventing abuse (Art. 6(1)(f)).

2.3 Strictly necessary cookies

A small consent cookie (cc_cookie) records your cookie preferences so the banner doesn't reappear on each page. A locale cookie remembers your language. These are set without consent under the ePrivacy "strictly necessary" exemption (Art. 5(3) ePrivacy Directive, transposed by Lei n.º 41/2004 in Portugal).

3. Who has access to your data

Google LLC (Mountain View, CA, USA) — Google Analytics 4 processor. Data is transferred to the United States under the EU-US Data Privacy Framework. Google is DPF-certified.
Intuition Machines, Inc. (hCaptcha) — bot detection on form pages. EU-US DPF-certified.
Hosting provider — infrastructure operator that runs the server. Data stays on EU infrastructure.
Email provider — used only to receive your form submissions in our inbox.

We do not sell, rent or share your data with advertising networks. We do not profile you for behavioural advertising.

4. International transfers

Some processors (Google, hCaptcha) are based in the United States. Transfers rely on the EU-US Data Privacy Framework adequacy decision adopted by the European Commission on 10 July 2023. No transfers to other third countries take place.

5. How long we keep your data

Analytics events: 14 months in Google Analytics 4 (default retention), then automatically deleted by Google.
Form submissions: kept in our inbox for the duration of our conversation plus up to 24 months if a project is initiated (for tax and contract records under PT law). Otherwise deleted after 6 months of inactivity.
Cookie preference cookie: 6 months from your last visit.

6. Your rights (GDPR Art. 15–22)

You have the right to:

Access — get a copy of the data we hold about you.
Rectification — correct inaccurate data.
Erasure — ask us to delete your data (subject to legal retention obligations).
Restriction — limit processing while a dispute is resolved.
Portability — receive your data in a structured, machine-readable format.
Object — to processing based on legitimate interest.
Withdraw consent — for analytics, at any time via Cookie settings.

To exercise any of these rights, email hi@alexgoes.dev. We respond within 30 days (GDPR Art. 12(3)).

7. Right to lodge a complaint

If you believe your data is being processed unlawfully, you can file a complaint with the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º · 1200-651 Lisboa
cnpd.pt

8. Children

This site is not directed to children under 16. We do not knowingly collect data from minors. If you believe a minor has submitted data, contact us and we will delete it.

9. Changes to this policy

We may update this policy when our processing changes (new processor, new feature) or when the law evolves. The "Last updated" date at the top reflects the current version. Material changes are flagged at the top for at least 30 days.