Privacy Policy

1. Introduction

This Privacy Policy describes how BIGservice, trade name used by Volodymyr Vakaryuk, tax ID (NIF) 240024311, processes and protects the personal data of users of the website bigservice.pt. This Policy applies to personal data collected through the website, namely via the contact form, as well as data processed within the scope of using its services and features. By using this website, the user declares having read and acknowledged this Privacy Policy. Personal data processing is carried out in accordance with applicable legislation, namely Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and applicable national legislation (Law No. 58/2019 of 8 August).

Last updated: August 2026

3. Data Collected

We collect only the data necessary to respond to your requests:

• Contact form: name, email, phone, location, message
• WhatsApp communication: phone number and messages
• Navigation data: IP address, browser type, pages visited

4. Purposes and Legal Basis

In accordance with Article 13(1)(c) of the GDPR, we present the purposes of processing and the respective legal basis (Article 6(1)):

• Responding to your messages and quote requests — legal basis: pre-contractual measures at the request of the data subject (point (b))
• Contacting you for clarification regarding your request — legal basis: pre-contractual measures at the request of the data subject (point (b))
• Analysing website navigation and usage via PostHog (product analytics) to identify technical issues and optimize performance — legal basis: legitimate interest of the controller (point (f))
• Complying with applicable tax and regulatory obligations — legal basis: compliance with a legal obligation (point (c))

5. Data Retention

In accordance with Article 13(2)(a) of the GDPR, we specify the retention periods applicable to each data category:

• Contact form (name, email, phone, location, message): data is not stored in a database. It is sent directly by email to our team and retained in the mailbox for a maximum period of 6 months after responding to the request, after which it is deleted, unless the contact results in a contractual relationship.
• Contractual and service delivery data: retained for the duration of the contractual relationship and, after its termination, only for as long as necessary for the exercise or defense of legal claims, which may extend up to the general 20-year limitation period (Article 309 of the Portuguese Civil Code).
• Tax and accounting data (invoices and receipts): retained for the mandatory legal period of 10 years, in compliance with Article 40 of the Portuguese Commercial Code and Article 123 of the Corporate Income Tax Code (IRC).
• Navigation and usage data (PostHog): technical navigation data and pseudonymous session identifiers are processed on EU infrastructure (Frankfurt) and retained for a maximum period of 12 months, after which they are deleted or anonymised.
• Anti-spam verification data (Cloudflare Turnstile): processed exclusively during the browsing session and not stored by the website.
• Theme preference (localStorage): stored only on the user's device, without transmission to our servers. It can be deleted at any time through browser settings.

You can request deletion of your data at any time by contacting us through the contact form or the email address provided in this policy.

6. Data Recipients and International Transfers

Your personal data is not sold or made available to third parties for commercial purposes. To ensure the operation, security, and provision of the website's services, BIGservice uses technology service providers that may process personal data on its behalf, namely:

• Supabase — database and authentication services;
• Resend — sending and managing emails associated with the contact form;
• Cloudflare — security and anti-spam protection services, including Cloudflare Turnstile;
• PostHog — website usage and performance analytics, where applicable;
• Public authorities and competent entities — when data disclosure is required by law or necessary to comply with legal obligations.

Some of these service providers may perform data processing operations outside the European Economic Area (EEA), namely in the United States of America. Whenever international transfers of personal data occur, they will be carried out in accordance with GDPR requirements using appropriate transfer mechanisms, such as an adequacy decision, standard contractual clauses, or another legally applicable mechanism.

BIGservice seeks to ensure that the service providers used offer adequate guarantees regarding the protection and security of personal data, and that processing is limited to what is necessary for the provision of their respective services.

7. Cookies and Local Storage

This website uses PostHog for product analytics to understand navigation patterns and performance. PostHog operates on infrastructure hosted in the EU (Frankfurt). Collected navigation data (including session identifiers and technical data) is processed in a pseudonymised manner and retained for a maximum of 12 months.

The anti-spam protection system (Cloudflare Turnstile), present on the contact form, may place strictly necessary technical cookies to verify that the visitor is human. These cookies are essential for security and do not require prior consent under Article 5(2) of Portuguese Law No. 41/2004.

We also use local storage (localStorage) to save your theme preference (light/dark). This information remains only on your device and is not transmitted to our servers.

8. Your Rights

Under the GDPR and Portuguese Law No. 58/2019, you have the right to:

• Access: obtain confirmation about data processing
• Rectification: correct incorrect data
• Deletion: request deletion of your data
• Restriction: request restriction of processing of your data
• Portability: in the cases and conditions provided for in Article 20 of the GDPR
• Objection: object to processing of your data
• Complaint: lodge a complaint with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt
• Withdraw consent: withdraw your consent at any time, under Article 7(3) of the GDPR, without affecting the lawfulness of processing based on consent before its withdrawal

We will respond to your request without undue delay and, as a rule, within one month of receiving the request, in accordance with Article 12 of the GDPR.

To exercise these rights, contact us at: geral@bigservice.pt

9. Data Protection Officer (DPO)

Under Article 37 of the GDPR, BIGservice is not legally required to appoint a Data Protection Officer (DPO). Any questions or requests regarding personal data protection should be directed directly to the data controller using the contact details provided in this policy.

10. Automated Decision-Making and Profiling

BIGservice does not engage in automated individual decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, under Article 22 of the GDPR.

11. Security

We implement technical and organizational security measures to protect your data against unauthorized access, alteration, or destruction. The website uses encrypted HTTPS connection.

12. Minors

This website does not intentionally collect data from children under 13 years of age, the minimum age for digital consent in Portugal under Law No. 58/2019. If you want us to delete data from a minor, contact us.

13. Changes to this Policy

We may update this policy periodically. The latest version will always be published on this page with the last updated date.

14. Contact

For questions about this privacy policy or to exercise your rights, contact us via the contact form or email