Legal

Privacy Policy

How Forma Flaga collects, uses, stores, and protects personal data in connection with this website and initial business inquiries.

Last updated: April 2026

1. Controller

Forma Flaga is the controller of personal data processed through this website for the purposes described in this policy. We operate from Lisbon, Portugal. For privacy and data protection matters, you may contact us at privacy@formaflaga.com.

2. Personal Data We Process

We may process the following categories of personal data: contact details you submit through our contact form, including your name and email address; business information you choose to provide, such as business description, revenue range, and details of the issue you want to discuss; technical and security data generated when you use the site, such as IP address, browser and device information, and server request logs; and preference data relating to cookie or consent settings stored on your device. We do not collect payment card data through this website.

3. Purposes of Processing

We process personal data to receive and respond to inquiries, evaluate whether there is a potential fit for an engagement, maintain the security and availability of the website and related systems, remember your privacy or cookie preferences, and where necessary manage pre-engagement communications and follow-up. We do not sell personal data and we do not disclose personal data to third parties for their own marketing purposes.

4. Legal Bases

We process contact form submissions and related correspondence on the basis of our legitimate interests under Article 6(1)(f) GDPR, namely to respond to inbound business inquiries and assess possible client relationships. We process technical and security data on the basis of our legitimate interests in protecting the website, preventing abuse, and maintaining reliable operation. We store privacy and cookie preference choices on the basis that this is necessary to respect and record your choices. If we introduce optional analytics or similar non-essential technologies in the future, they will be activated only on the basis of your consent where required by applicable law.

5. Recipients and Service Providers

Personal data may be processed by service providers acting on our behalf, including website hosting and infrastructure providers, email delivery providers used to route contact form submissions, and content management or technical support providers where relevant. Where a matter progresses beyond an initial inquiry, we may also share limited information with carefully selected professional providers or local partners where this is necessary for evaluating or delivering a potential engagement. Such disclosures are limited to what is reasonably necessary for the relevant purpose.

6. Cookies and Similar Technologies

This site uses cookies and similar client-side storage technologies in the categories below:

EssentialAlways active

Required to operate the site, remember privacy settings, and support essential functionality.

Cookie or privacy preference storage, essential security or routing cookies, and operational site preferences.

Optional AnalyticsRequires consent

At present, optional analytics are not active on the public site. If we enable them in the future, they will be used only with consent where required.

Examples may include basic traffic measurement and page usage statistics. No advertising or cross-site profiling without a further update to this policy.

Your current preference: Not yet set

7. International Transfers

Some of our service providers may process personal data outside the European Economic Area. Where that occurs, we rely on recognised transfer mechanisms under GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where appropriate.

8. Retention

Inquiry data is retained only for as long as reasonably necessary to handle the inquiry and any related follow-up. As a general rule, inquiry data is deleted or anonymised within 12 months unless the relationship progresses into a formal engagement or we need to retain it for legal, compliance, accounting, or record-keeping reasons. Where a formal engagement begins, relevant data may be retained for the duration of that engagement and for an additional period afterwards where required by law or reasonably necessary to establish, exercise, or defend legal claims.

9. Your Rights

Under GDPR you have the following rights. To exercise any of them, email privacy@formaflaga.com. We will respond in accordance with applicable law and, in most cases, within one month.

AccessRequest a copy of personal data we hold about you.

RectificationCorrect inaccurate or incomplete data.

ErasureRequest deletion of your data ('right to be forgotten').

RestrictionAsk us to limit how we use your data.

PortabilityReceive your data in a structured, machine-readable format.

ObjectionObject to processing based on legitimate interests.

Withdraw consentWithdraw any consent given at any time, without affecting prior processing.

Lodge a complaintContact the Portuguese data protection authority (CNPD) at cnpd.pt.

10. Required Data

You are not under a statutory obligation to provide personal data through this website. However, if you do not provide the information requested in the contact form, we may be unable to respond to your inquiry or assess whether we can assist you.

11. Changes to This Policy

We may update this policy from time to time to reflect legal, operational, or service changes. The version published on this page is the current version. Material changes will be reflected by an updated revision date.

Data protection questions?

← Home