SECURITY.txt

Legal Documentation

Complete GDPR & EU compliance documentation for VelmoraDigitalCraft.

EU 2016/679 GDPR Compliant ePrivacy Directive Consumer Rights 2011/83/EU
README.md — legal documentation
UTF-8 GDPR

# Privacy Policy

Last updated: 2026-08-27 | Version: 2.0.0 | Regulation (EU) 2016/679

COMPANY: VelmoraDigitalCraft

ADDRESS: Avenida 25 de Abril 240, 2750-511 Cascais, Portugal

EMAIL: [email protected]

PHONE: +351 91 7425360

NIF: Registered in Portugal under applicable commercial law

DPO: Data Protection Officer appointed per GDPR Art. 37

DPA: Autoridade Nacional de Proteção de Dados (ANPD)

1. Data Controller (Art. 4(7))

VelmoraDigitalCraft, located at Avenida 25 de Abril 240, 2750-511 Cascais, Portugal, is the data controller responsible for your personal data processing in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). The Data Protection Officer can be contacted at [email protected].

2. Data We Collect (Art. 13 & 14)

We collect the following categories of personal data:

  • Identity Data: Name, username, or similar identifier (Art. 6(1)(b))
  • Contact Data: Email address, telephone numbers, delivery address (Art. 6(1)(b))
  • Technical Data: IP address, browser type, operating system, device identifiers (Art. 6(1)(f))
  • Usage Data: Page views, session duration, navigation patterns (Art. 6(1)(f))
  • Marketing Data: Communication preferences and consent records (Art. 6(1)(a))
  • Transaction Data: Payment details, purchase history (Art. 6(1)(b))

3. Legal Basis for Processing (Art. 6(1))

We process your data based on the following legal bases:

  • Art. 6(1)(a) Consent: Marketing communications, analytics cookies, newsletter subscriptions
  • Art. 6(1)(b) Contract: Service delivery, order processing, payment handling, account management
  • Art. 6(1)(f) Legitimate Interest: Website security, fraud prevention, service improvement
  • Art. 6(1)(c) Legal Obligation: Tax records, accounting, regulatory compliance

4. Data Retention (Art. 13(2)(a))

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected:

  • Contract data: 6 years after contract termination (Portuguese Commercial Code Art. 164)
  • Tax records: 10 years (Portuguese Tax Code Art. 123)
  • Marketing data: Until consent is withdrawn
  • Website analytics: 26 months maximum
  • Cookie consent records: 3 years

5. Your Rights Under GDPR (Art. 15–22)

You have the following rights regarding your personal data:

  • Right of Access (Art. 15): Request a copy of all personal data we hold about you
  • Right to Rectification (Art. 16): Request correction of inaccurate personal data
  • Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
  • Right to Restrict Processing (Art. 18): Request restriction of processing in certain circumstances
  • Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
  • Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing
  • Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting lawfulness of prior processing
  • Right to Lodge a Complaint (Art. 77): File a complaint with the ANPD or any EU/EEA supervisory authority

6. International Data Transfers (Art. 44–49)

Your data may be transferred to countries outside the European Economic Area (EEA). We ensure adequate protection through:

  • EU Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequacy decisions where applicable (Art. 45)
  • Binding Corporate Rules where applicable

7. Data Security (Art. 32)

We implement appropriate technical and organizational measures to protect your data, including: encryption of data in transit (TLS 1.3) and at rest, regular security assessments, access controls, pseudonymization where appropriate, and regular staff training on data protection.

8. Automated Decision-Making (Art. 22)

We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you. If this changes, we will inform you and provide the right to object.

9. Contact for Data Requests

Exercise your rights by contacting: [email protected]. We will respond within 30 days per GDPR Art. 12(3). If the request is complex, we may extend this period by a further 60 days, informing you within the initial 30-day period.

10. Supervisory Authority

You have the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD): Rua de São Bento 148, 1200-821 Lisboa, Portugal | www.anpd.pt | [email protected]

# Terms of Service

Last updated: 2026-08-27 | Version: 2.0.0 | Governed by Portuguese & EU Law

COMPANY: VelmoraDigitalCraft

ADDRESS: Avenida 25 de Abril 240, 2750-511 Cascais, Portugal

EMAIL: [email protected]

JURISDICTION: Portuguese Civil Code (Código Civil) & EU Consumer Law

1. Acceptance of Terms

By accessing services provided by VelmoraDigitalCraft, you agree to be bound by these Terms of Service. If you do not agree, you must not use our services. These terms constitute a legally binding agreement under Portuguese Civil Code Art. 403 et seq.

2. Scope of Services

VelmoraDigitalCraft provides web design, UI/UX consulting, and digital interface development services. Service scope is defined in individual project agreements. All services comply with EU Digital Content Directive (EU) 2019/770 standards for digital service quality.

3. Pricing & Payment Terms (Art. 6)

All prices are displayed in EUR (€) and include VAT where applicable. Invoices are due within 14 days of issue per EU Late Payment Directive (EU) 2011/7/EU. Late payments incur statutory interest rates as determined by Portuguese law. Project deposits (50%) are non-refundable after work commencement as defined in Art. 4 below.

4. Project Deposits & Pre-Contractual Information

Before any payment is required, we provide: (a) a detailed project specification; (b) a binding price quote valid for 30 days; (c) estimated delivery timeline; (d) cancellation terms per EU Consumer Rights Directive (EU) 2011/83/EU Art. 6.

5. Intellectual Property (Art. 8)

Upon full payment, all deliverables and associated intellectual property rights transfer to the client per Portuguese Industrial Property Code (Código da Propriedade Industrial). VelmoraDigitalCraft retains the right to display work in portfolios unless otherwise agreed in writing. Open-source components retain their original licenses as documented in project handover.

6. Confidentiality (Art. 9)

Both parties agree to maintain confidentiality of proprietary information shared during the engagement per Portuguese Trade Secrets Directive (EU) 2016/943) implementation. This obligation survives termination for a period of 2 years. Exceptions apply for information that: (a) becomes publicly available; (b) was already known; (c) is required by law.

7. Limitation of Liability (Art. 10)

VelmoraDigitalCraft's total liability shall not exceed the total fees paid under the applicable project agreement. We are not liable for indirect, consequential, or punitive damages. This limitation does not apply to: (a) intentional misconduct; (b) gross negligence; (c) liability under mandatory consumer protection law.

8. Warranty & Service Quality (Art. 11)

We warrant that services will be performed with reasonable care and skill per EU Consumer Rights Directive (EU) 2011/83/EU Art. 10. Defects in delivered work will be remedied at no additional cost within a reasonable period. Digital content must conform to the contract per EU Digital Content Directive (EU) 2019/770.

9. Right of Withdrawal (Art. 12)

Under EU Consumer Rights Directive (EU) 2011/83/EU Art. 9, consumers have the right to withdraw from distance contracts within 14 days without giving any reason. This right applies to services not yet commenced. Withdrawal must be communicated in writing to [email protected]. Refunds will be issued within 14 days of withdrawal.

10. Dispute Resolution (Art. 13)

Disputes shall be resolved through: (a) amicable negotiation within 30 days; (b) mediation through the Portuguese Consumer Dispute Resolution Centre; (c) arbitration in Lisbon, Portugal under Portuguese arbitration rules; (d) or through the EU Online Dispute Resolution Platform at https://ec.europa.eu/consumers/odr.

11. Governing Law & Jurisdiction (Art. 14)

These terms are governed by the laws of Portugal and applicable EU regulations. Courts of Lisbon, Portugal have exclusive jurisdiction for disputes, except where EU consumer protection rules grant jurisdiction in the consumer's domicile state per EU Regulation 1215/2012 (Brussels I bis).

# Cookie Policy

Last updated: 2026-08-27 | Version: 2.0.0 | ePrivacy Directive (EU) 2002/58/EC

COMPANY: VelmoraDigitalCraft

ADDRESS: Avenida 25 de Abril 240, 2750-511 Cascais, Portugal

EMAIL: [email protected]

REGULATION: ePrivacy Directive (EU) 2002/58/EC & GDPR (EU) 2016/679

1. What Are Cookies

Cookies are small text files placed on your device when you visit our website. They are used to: (a) ensure the website functions correctly; (b) remember your preferences; (c) understand how you use our site; (d) deliver relevant content. Cookies are classified under the ePrivacy Directive (EU) 2002/58/EC.

2. Legal Basis for Cookies (Art. 5(3))

Under Art. 5(3) of the ePrivacy Directive, we require your consent before setting non-essential cookies. Essential cookies necessary for the website to function are exempt from consent requirements per the ePrivacy Directive Recital 46.

3. Essential Cookies

These cookies are necessary for the website to function and cannot be switched off:

  • session_id: Session management (duration: session) — Legal basis: Art. 6(1)(b)
  • csrf_token: Security protection (duration: session) — Legal basis: Art. 6(1)(f)
  • cookie_consent: Cookie preferences storage (duration: 3 years) — Legal basis: Art. 6(1)(c)
  • lang_pref: Language preference (duration: 1 year) — Legal basis: Art. 6(1)(f)

4. Analytics Cookies (Requires Consent)

We use analytics cookies to understand visitor behavior and improve our services:

  • _ga / _gid: Google Analytics — anonymous visitor tracking (duration: 2 years / 24h)
  • _gat: Google Analytics — request throttling (duration: 1 minute)

All analytics data is anonymized, aggregated, and cannot be used to identify individual users. We use IP anonymization (Art. 25 GDPR) and data processing agreements with all third-party processors.

5. Third-Party Cookies (Requires Consent)

Third-party services that may set cookies:

  • Stripe (payment processing): _stripe_mid, _stripe_sid — fraud prevention and transaction security
  • Google Maps: Cookies for map rendering and geolocation functionality

All third-party processors have their own privacy policies and data processing agreements with VelmoraDigitalCraft per GDPR Art. 28.

6. Cookie Consent Management (Art. 7)

Our cookie consent banner provides granular control over non-essential cookies. You can: (a) Accept all cookies; (b) Reject non-essential cookies; (c) Withdraw consent at any time via the cookie settings in your browser. Consent is stored in localStorage and can be revoked at any time per GDPR Art. 7(3).

7. Managing Cookies via Browser

You can control cookies through your browser settings. Disabling essential cookies may affect website functionality. Browser-specific instructions:

  • Chrome: Settings → Privacy and Security → Cookies
  • Firefox: Options → Privacy & Security → Cookies and Site Data
  • Safari: Preferences → Privacy → Manage Website Data
  • Edge: Settings → Privacy, Search, and Services → Cookies

8. Your Rights Regarding Cookies

Under the ePrivacy Directive and GDPR, you have the right to: (a) be informed about cookies (this policy); (b) give or withdraw consent; (c) access data collected via cookies; (d) request deletion of cookie data. Contact: [email protected]

9. Updates to This Policy

We may update this Cookie Policy when: (a) new cookies are introduced; (b) regulations change; (c) our practices evolve. Changes will be posted on this page with an updated revision date. For material changes, we will re-request consent per GDPR Art. 7.

# Refund Policy

Last updated: 2026-08-27 | Version: 2.0.0 | EU Consumer Rights Directive (EU) 2011/83/EU

COMPANY: VelmoraDigitalCraft

ADDRESS: Avenida 25 de Abril 240, 2750-511 Cascais, Portugal

EMAIL: [email protected]

CURRENCY: All refunds issued in EUR (€)

1. General Policy

VelmoraDigitalCraft is committed to client satisfaction and compliance with EU consumer protection law. Refund eligibility depends on the service type and stage of delivery as outlined below, in accordance with EU Consumer Rights Directive (EU) 2011/83/EU and Portuguese Civil Code Art. 879 et seq.

2. Right of Withdrawal — 14-Day Cooling-Off Period (Art. 9 CRD)

Under EU Consumer Rights Directive (EU) 2011/83/EU Art. 9, consumers who enter into a distance contract have the right to withdraw within 14 calendar days without giving any reason. The withdrawal period expires 14 days from the date of conclusion of the contract.

  • How to exercise: Send a clear written declaration to [email protected]
  • Model withdrawal form: Available upon request per Art. 11 CRD
  • Refund timeline: Within 14 days of withdrawal notification
  • Exception: If service commencement is requested during the withdrawal period, you acknowledge that your right to withdraw is lost once the service is fully performed

3. Pre-Project Deposits

The initial 50% deposit is refundable only if work has not commenced. Once project work begins, the deposit becomes non-refundable as resources are allocated to your project. This is communicated in the pre-contractual information provided per CRD Art. 6.

4. Completed Deliverables & Digital Content (Art. 16 CRD)

Full payment is required upon delivery of completed milestones. For digital content not supplied on a tangible medium, the right of withdrawal is lost upon download/performance with your prior consent and acknowledgment per CRD Art. 16(e). Partial refunds may be considered if deliverables materially deviate from the agreed project specification per EU Digital Content Directive (EU) 2019/770 Art. 14.

5. Cancellation by Client

Cancellations made:

  • Before work begins: Full refund minus administrative fee (10%) per CRD Art. 14(3)
  • After first milestone: 50% refund of remaining balance
  • After 50% completion: No refund of remaining balance
  • Non-conformity: Full refund if deliverables fail to conform per Digital Content Directive Art. 14

6. Cancellation by VelmoraDigitalCraft

If we cancel a project, you will receive a full refund of all payments made within 14 business days per Portuguese Civil Code Art. 879. We reserve the right to terminate projects that violate our terms of service or applicable law.

7. Refund Process & Timeline (Art. 13 CRD)

Refunds will be processed using the same payment method used for the original transaction. Refund timeline: within 14 days of: (a) withdrawal notification; or (b) agreement on refund amount. We may withhold the refund until we have received the goods back or you have provided evidence of return.

8. Dispute Resolution

Refund disputes should be submitted to [email protected] within 30 days of the relevant invoice. We will review and respond within 5 business days. If unresolved: (a) Complaint to the Portuguese Consumer Dispute Resolution Centre; (b) EU Online Dispute Resolution Platform at https://ec.europa.eu/consumers/odr; (c) Competent courts in the consumer's domicile per EU Regulation 1215/2012.

9. Consumer Rights Summary (CRD Art. 6)

Before the conclusion of any distance contract, you will receive clear information about: (a) the trader's identity and contact details; (b) the total price including all taxes; (c) payment and delivery arrangements; (d) the right of withdrawal (14 days); (e) the cost of using distance communication; (f) the contract's duration and termination conditions; (g) the minimum duration of consumer obligations.

Ln 1, Col 1 UTF-8
VelmoraDigitalCraft GDPR Compliant