Privacy Policy

1. Controller

INDIGIT ® is a brand of Evil Corporation, Unipessoal Lda., tax number (NIPC) 513815643, Freamunde, Paços de Ferreira, Portugal. We are the controller of the personal data collected through this website and of the data of our clients and business contacts. When we process personal data on a client’s behalf in a project, we act as that client’s processor.

For any privacy question, write to hi@indigit.pt.

2. Data we process

• Enquiries: name, email, company, phone number and the content of the messages you send us.
• Call bookings: name, email, date, time and any notes you add when you book a call through Cal.com.
• Clients: name or company name, tax number (NIF), address, contact details, proposals, contracts, invoices and payments.
• Technical data: IP address, browser type and pages visited, processed by Cloudflare to deliver and protect the website.
• Website usage: pages visited, clicks on external links, device type and approximate country, measured by OpenPanel without cookies and, with your consent, by Google Analytics.
• Support conversations: the name, email and messages you send us through the Crisp chat.
• Error reports: the error message, page, browser and operating system, sent to Sentry when a page fails, without your name or email.

Billing details are required to meet legal obligations. Without them, we cannot enter into the contract.

We do not use behavioural advertising on this website.

3. Purposes and legal bases

• Answering enquiries and chat messages and preparing proposals: steps taken at your request before a contract or, when you contact us on behalf of a company, our legitimate interest in answering that company’s request.
• Providing the contracted services: performance of the contract or, for the contact persons of a business client, our legitimate interest in performing that contract.
• Invoicing, accounting and tax duties: compliance with legal obligations.
• Website security and operation: legitimate interest in keeping the website available and protected.
• Measuring usage without cookies (OpenPanel) and fixing errors (Sentry): legitimate interest in improving the website.
• Measuring with Google Analytics: your consent, which you can withdraw at any time under "Cookie settings".
• Establishing, exercising or defending legal claims: legitimate interest.
• Sending news and marketing messages: only with your consent, which you can withdraw at any time.

4. Recipients

We share data only with the following recipients, and only as far as each purpose requires:

• Cloudflare: hosting, delivery and protection of the website.
• Cal.com: call bookings.
• Crisp: support chat.
• Google: Google Analytics, only with your consent.
• OpenPanel and Sentry: usage measurement and error reports.
• Email provider: sending and receiving messages.
• Certified accountant: invoicing and tax duties.
• Providers named in the proposal or, for the INDIGIT Subscription, before we start work on each request, when the work needs them.
• Courts and other authorities, when the law requires it.

5. International transfers

Some providers, such as Cloudflare, Cal.com and Google, may process data outside the European Economic Area. In those cases, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission. You can request a copy of the applicable safeguards at hi@indigit.pt.

6. Retention

• Enquiries and proposals without a contract: up to 2 years after the last contact.
• Client data: for the duration of the contract and up to 2 years after it ends.
• Invoices and accounting records: 10 years, as required by Portuguese tax law.
• Technical logs: for the short periods set by Cloudflare.

At the end of these periods, we delete the data or make it irreversibly anonymous, unless the law or legal proceedings require us to keep it.

7. Your rights

You can ask to access, correct, erase, restrict or port your data, or object to its processing. You can withdraw any consent you gave, without affecting the lawfulness of processing carried out before the withdrawal. Send your request to hi@indigit.pt. We reply within one month, extendable by two further months where the GDPR allows.

You can also lodge a complaint with the Portuguese Data Protection Authority (CNPD), at www.cnpd.pt, or with the supervisory authority of the country where you live or work.

8. Security

We use encrypted connections (HTTPS), restricted access to data, and providers with appropriate security and data protection safeguards.

9. Changes

We may update this Policy to reflect changes in the law, our providers or our services. The date at the top of the page shows the version in force.