Privacy Policy

Privacy Policy Content

1. Data Controller & Identity Sersight, Lda. ("Sersight", "we", "us", or "our") is the data controller responsible for the processing of personal data collected through [https://sersight.com](https://sersight.com).

• Legal Entity: Sersight, Lda.

• Registered Office: Portugal

• Primary Contact: contact@sersight.com

• Applicable Framework: EU General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and Portuguese Law no. 58/2019.

2. Categories of Data Collected

• Direct Communication Data: Name, business email address, company name, project scope, and any details submitted via contact forms, assessment requests, or direct correspondence.

• Technical & Session Telemetry: Anonymized IP addresses, browser specifications, operating system details, referring URLs, access timestamps, and device metrics necessary for platform rendering, DDoS mitigation, and system stability.

• Consent & Preference Records: Timestamps and technical records of cookie consent states given through the site interface.

3. Legal Basis and Purposes of Processing

• Pre-contractual Scoping & Inquiries (Art. 6(1)(b) GDPR): Processing contact requests, scheduling architecture consultations, and establishing enterprise BI/AI scopes of work.

• Legitimate Interests (Art. 6(1)(f) GDPR): Ensuring infrastructure security, detecting unauthorized access, defending legal claims, and optimizing website delivery.

• Legal & Fiscal Compliance (Art. 6(1)(c) GDPR): Fulfilling mandatory accounting, commercial, and regulatory record-keeping obligations.

• Explicit Consent (Art. 6(1)(a) GDPR): Where applicable, non-essential functional enhancements or analytics tracking authorized by the user.

4. Cookies and Local Storage

• Functional / Strictly Necessary: Essential for core website operations, language selection, route navigation, and consent state management. These do not require prior consent.

• Statistical / Performance (Optional): Where active, statistical measurement is processed anonymously to analyze aggregated visitor trends without individual profiling.

• Users can modify or withdraw cookie preferences at any time via browser settings or the platform consent manager.

5. Data Retention Periods

• Commercial Inquiries: Retained for a maximum of 24 months after the last active interaction if no contractual engagement is executed, following which data is permanently deleted or anonymized.

• Contractual & Invoicing Records: Retained for the statutory periods mandated by Portuguese tax and commercial legislation (up to 10 years).

• Technical Logs: Server telemetry and security logs are purged within 90 days on a rolling basis.

6. Sub-processors and Third-Party Infrastructure We do not sell, lease, or monetize personal data under any circumstances. Personal data and telemetry are processed exclusively by vetted infrastructure partners under strict Data Processing Agreements (DPAs) and European Standard Contractual Clauses (SCCs):

• Cloud hosting and CDN delivery providers (EU-based data centers).

• Enterprise email and encrypted communication infrastructure.

• Sandboxed analytics environments.

7. Data Subject Rights Under the GDPR, individuals hold the following enforceable rights:

• Right of Access & Data Portability: Request confirmation and structured copies of processed personal data.

• Right to Rectification: Request correction of inaccurate or outdated information.

• Right to Erasure ("Right to be Forgotten"): Request deletion of data when no legal retention obligation exists.

• Right to Restriction and Objection: Restrict processing or object to processing based on legitimate interest.

• Right to Withdraw Consent: Revoke consent at any time without affecting prior lawful processing.

To exercise any of these rights, submit a written request to contact@sersight.com. You also retain the right to lodge a complaint with the Portuguese Supervisory Authority: Comissão Nacional de Proteção de Dados (CNPD) at www.cnpd.pt.