Privacy policy
What personal data we process when you visit this website or contact us through the form, by email, phone or WhatsApp, and why.
1. Controller
DAILY PROGRESS LDA, sociedade por quotas, NIPC 519646371, registered office at Rua de São Miguel, n.º 197, 4505-522 Lobão, Santa Maria da Feira, Portugal, operating the Zigzag trade name.
Contact for personal data matters: geral@zigzaglimpezas.pt. The company has not appointed a data protection officer.
2. Website visits and hosting
When you visit the website, the hosting server automatically records technical access data such as the IP address, date and time, page requested and browser type. These data are used to display the pages and protect the website.
The website is hosted by Hostinger (HOSTINGER INTERNATIONAL LIMITED, Cyprus), which processes these data on the company’s behalf under its data processing agreement. The website server is located in France and backups are stored in Lithuania. Server access logs are kept for up to 7 days, unless a legal obligation or a security investigation requires otherwise.
Legal basis: legitimate interest in keeping the website working and secure (Art. 6(1)(f) GDPR).
The website’s code does not set cookies and does not use analytics or advertising tools (see the cookie information).
3. Contacts and quote requests
We use the information you send us to answer your request and prepare your quote.
Please only send the photos needed to assess the work and, where possible, avoid people, number plates, house numbers or documents.
- Channels: the website form, email, phone and WhatsApp.
- Website form: your request and any photos you choose to attach (up to 5) are sent by email, via Microsoft 365, to geral@zigzaglimpezas.pt. Before sending, the website removes the photos’ metadata, including location.
- The website server does not keep the content of your request: files used while sending are deleted once it has been processed.
- To limit abusive submissions (legitimate interest in the website’s security), the server temporarily keeps a technical counter linked to a fingerprint of the IP address calculated with a secret key, without the address in clear.
- Photos are used only to prepare the quote and do not authorise publication (see section 5).
- Data: whatever you tell us, usually your name, contact details, town, service required, description of the request and any photos you choose to send.
- Purposes: replying to you, preparing the quote and, where needed, arranging a visit.
- Legal basis if you are a private individual (or a sole trader asking for yourself): steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
- Legal basis if you contact us on behalf of a company or other organisation: legitimate interest in handling that organisation’s request and communicating with the person it designates (Art. 6(1)(f) GDPR).
4. Business management and performing the services
- Data: identification, contact details, address of the work site, agreed terms, communications, records and photos of the work, billing data.
- Private customers: performance of the contract (Art. 6(1)(b) GDPR).
- Contact persons of business customers, who are not personally parties to the contract: legitimate interest in performing the contract concluded with the business (f).
- Invoicing and accounting: compliance with legal obligations (c).
- Photos kept as evidence of the work: legitimate interest in documenting the service and defending legal claims (f).
5. Publishing photos of our work
We only publish photos of our work with the customer’s own, separate written authorisation. It is optional and does not affect the quote or the service.
You may withdraw it at any time, without affecting earlier publication. Withdrawal leads to the photos being taken down, but does not require us to delete documents we must keep for another reason, such as evidence of the service or tax obligations.
6. Marketing communications
We do not send newsletters and do not use the contact details we receive for direct marketing campaigns.
7. Legitimate interests pursued
Keeping the website working and secure; answering requests from companies and other organisations and performing the contracts concluded with them; documenting our work and defending legal claims. You may object to this processing (section 12).
8. Data required
To reply to you we need a way to contact you. To conclude and invoice a contract, the identification and billing data required by law are necessary. Other data and photos are optional; leaving them out may only make the quote less precise.
We do not take decisions based solely on automated processing and do not carry out profiling.
9. Recipients
We do not sell personal data.
- The two people working in the company, as far as necessary.
- Providers processing data on the company’s behalf: Microsoft 365 (email and, where needed, file sharing and remote communication), website hosting (Hostinger and the sub-processors it uses) and invoicing software.
- Accounting firm, for accounting and tax obligations.
- WhatsApp (Meta), if you choose to contact us via WhatsApp: the conversation goes through that service, which applies its own terms and privacy policy.
- Public authorities, where required by law.
10. Transfers outside the European Economic Area
We use Microsoft 365 for email and, where needed, for file sharing and remote communication. According to our account’s admin centre, these services’ data at rest are stored in the ‘European Union/EFTA’ geography. Some processing may take place outside that area, in the cases provided for in Microsoft’s contractual documentation. For transfers outside the European Economic Area, that documentation provides for the European Commission’s standard contractual clauses.
According to the terms published by its supplier, the invoicing software is installed in data centres in Portugal.
The website server and its backups are located in the European Union (France and Lithuania).
Hostinger may use sub-processors, whose list is published in its data processing agreement. Technical visit data may therefore be processed outside the visitor’s country. For transfers to countries outside the European Economic Area without an adequacy decision, that agreement provides, in general terms, for the European Commission’s standard contractual clauses.
11. Retention periods
- Requests and quotes not followed up, including photos sent with the request: 12 months after the last relevant contact. We keep only the photos needed to follow up the request and delete earlier anything that is no longer useful. Exception: a request still in progress, a complaint or a dispute, only for as long as needed to handle it.
- Photos and records of completed work: for as long as needed to evidence the service and defend legal claims.
- Invoices and accounting records: 12 years, in line with our accounting firm’s instructions, or longer where a legal obligation so requires.
- Published photos: while the authorisation remains in force, with an annual review.
12. Your rights
Under the conditions laid down in the GDPR (Arts. 15 to 22), you may request access to your data, its rectification or erasure, or the restriction of processing, and object to processing based on legitimate interest.
The right to data portability only applies to data you have provided to us, where processing is based on your consent or on a contract and is carried out by automated means.
Each right applies under the conditions and within the limits set by law; for example, some data must be kept to meet a legal obligation.
Where processing is based on consent, such as publishing photos, you may withdraw it at any time, without affecting earlier processing.
Write to geral@zigzaglimpezas.pt. We reply within one month, which may be extended under Art. 12(3) GDPR.
You have the right to lodge a complaint with the Portuguese data protection authority (CNPD).
13. Source of data
The data are provided by you or by the organisation on whose behalf you contact us.