Privacy Policy

1. Data Controller

Go4Consult, Praça do Poder Local 5 Unit A, 8600-524 Lagos, Portugal. Email: hello@go4consult.com. Phone: +351 282 012 793. NIF: PT-XXXXXXXXX.

2. Applicable Legislation

This Privacy Policy complies with: RGPD (Regulamento Geral sobre a Proteção de Dados — EU Regulation 2016/679); Lei 58/2019 (Portuguese data protection law implementing GDPR); Lei 41/2004 (privacy in electronic communications); Decreto-Lei 7/2004 (e-commerce). Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I 134, 1200-651 Lisboa, www.cnpd.pt.

3. Categories of Data Collected

Contact Data: Name, email, phone, company, role, website. Strategy Project Data: Business data, competitive intelligence, customer research data, marketing performance data — strictly confidential under NDA. Payment Data: Processed exclusively by Stripe (PCI DSS Level 1). Website Analytics: Plausible Analytics (cookieless, EU-hosted).

4. Legal Bases and Purposes

Contract performance (Art. 6(1)(b) RGPD). Legal obligation (Art. 6(1)(c)). Legitimate interest (Art. 6(1)(f)). Consent (Art. 6(1)(a)).

5. Strategy Data Confidentiality

All client strategy data, competitive intelligence, and marketing research is protected under mutual NDA, stored encrypted (AES-256) on EU servers, accessible only to assigned team members, and permanently deleted within 90 days of engagement end upon request.

6. Your Rights Under RGPD

Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18), Portability (Art. 20), Objection (Art. 21), Withdraw consent (Art. 7(3)), Lodge complaint with CNPD. Contact: hello@go4consult.com. Response within 30 calendar days.

7. Data Retention

Client data: engagement + 10 years (Portuguese tax law). Strategy documents: engagement + 90 days. Research data: project + 30 days. Marketing consent: duration + 5 years.

8. Security Measures

TLS 1.3, AES-256 encryption, multi-factor authentication, EU-based servers, NDA for all team members, 72-hour breach notification (Art. 33 RGPD).

9. International Transfers

Primary processing within EU/EEA. Stripe (USA): EU-US Data Privacy Framework. No other international transfers.

Last updated: March 2026.