Privacy policy

Effective Date: April 11, 2025
Last Updated: January 18, 2026

1. Introduction

At Buenatura, Unipessoal Lda ("Buenatura", "we", "us", or "our"), your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you visit our website https://www.buenatura.org, contact us, or use our services.

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Portuguese data protection laws.

By using our website, you agree to the terms of this policy. If you do not agree, please do not use the site or submit any personal information.

2. Who We Are

Data Controller:

Buenatura, Unipessoal Lda
2460-302 Bárrio, Alcobaça, Portugal
VAT: PT514903740
Email: contact@buenatura.org

3. What Data We Collect

We only collect personal data when you voluntarily provide it to us through forms or direct communication. The types of data we may collect include:

  • Contact Information: Full name, email address, phone number, company name, and other identifiers provided in contact forms or emails.

  • Service Details: Information you provide when inquiring about or purchasing our services.

  • Technical Information: Basic usage and traffic analytics (e.g., IP address, browser type, pages visited), collected via HubSpot for performance monitoring and communication optimization.

We do not collect:

  • Sensitive personal data (e.g., health, religious, or biometric data)

  • Data from third-party trackers

  • Behavioral data for profiling or cross-site tracking

  • Data from children under 16

4. How We Use Your Data

We use your personal data only for the following purposes:

  • To respond to your inquiries and provide requested services

  • To schedule consultations or communicate with you

  • To manage and maintain client relationships via HubSpot CRM

  • To send relevant updates or marketing communications (only with your consent)

  • To improve our services, website, and communication processes

We do not sell, rent, or share your data with third parties for advertising purposes.

5. Legal Bases for Processing

We rely on the following lawful bases under Article 6 of the GDPR:

  • Consent: When you opt in to receive updates or marketing emails

  • Contract: When we process data necessary to deliver a service you requested

  • Legitimate Interest: For basic business operations and communication

  • Legal Obligation:** If required to retain data for compliance or tax purposes

6. How We Share Your Data

Your data is only shared with trusted third-party processors necessary for our operations:

HubSpot Inc. – CRM, form submissions, analytics, and email automation
HubSpot Privacy Policy
HubSpot Data Processing Agreement

We ensure that any data processing by HubSpot complies with GDPR through a Data Processing Agreement (DPA) incorporating EU Standard Contractual Clauses (SCCs) and appropriate safeguards.

We do not share your data with any other third party unless required by law.

7. International Transfers

HubSpot may process data outside the European Economic Area (EEA), including in the United States. These transfers are safeguarded by Standard Contractual Clauses (SCCs) and additional compliance measures as required under GDPR.

By submitting your personal data, you acknowledge this transfer and processing outside the EEA.

8. How Long We Keep Your Data

We retain your personal data only as long as necessary for the purposes for which it was collected:

  • Inquiry data: Up to 24 months

  • Client data: 6 years (in line with legal and tax obligations)

  • Email marketing: Until you withdraw consent

You may request deletion of your data at any time (see Section 9).

9. Your Rights Under GDPR

As a data subject, you have the following rights:

  • Access: To know what personal data we hold

  • Rectification: To correct inaccurate or incomplete data

  • Erasure: To request deletion of your data ("right to be forgotten")

  • Restriction: To limit how we process your data

  • Objection: To object to processing based on legitimate interests

  • Portability: To receive your data in a structured, machine-readable format

  • Withdraw Consent: At any time, for data processing based on consent

To exercise any of these rights, contact us at contact@buenatura.org. We will respond within 30 days.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD): www.cnpd.pt

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

  • Secure form submissions

  • Limited access to CRM systems

  • Encryption where applicable

  • Employee awareness and confidentiality agreements

However, no system is 100% secure, and you acknowledge this inherent risk when communicating online.

11. Cookies and Tracking Technologies

We use only essential cookies and HubSpot cookies for site performance, traffic analysis, and CRM functions. We do not use third-party marketing cookies or cross-site trackers.

Types of cookies we use:

  • Strictly Necessary: Required for basic site functionality

  • Analytics: HubSpot cookies to understand site usage and improve user experience

  • Functional: To remember your preferences and settings

You can control or disable cookies via your browser settings. For details on HubSpot cookies: HubSpot Cookie Policy

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal obligations, or tools. Updated versions will be posted on this page with a revised effective date. You should review this page periodically.

13. Contact Us

For any questions or data requests, contact:

Data Protection Contact:
Email: contact@buenatura.org
2460-302 Bárrio, Alcobaça, Portugal

Thank you for trusting Buenatura. We handle your data with care, transparency, and respect.