Privacy Policy

1. Who is responsible for your data

W Champion Unipessoal, Lda (“WChampion”), registered office at Rua Manuel Martins Alves n.º 80 A, 2130-143 Santo Estêvão, Portugal, Portuguese company and tax number (NIPC) 514 575 492, is the controller of the personal data collected through this website.

For anything concerning your data, write to [email protected] with “Data protection” in the subject line, or by post to our registered office.

2. What this policy covers

It explains what happens to the data of people who visit the website, who write to us through the website forms (contact, job applications and suppliers) and who, following that contact, receive a proposal or sign a contract with us. It also applies when the enquiry is made on behalf of a company: the name and contact details of the person writing to us are still personal data.

3. What data we process

When you fill in the form. Your name, email address, the country where the project is located and your message, which are required. Your phone number, if you give it. The service you need and the timeframe you have in mind. And any technical details you choose to share, picked from a list, such as type of installation, electricity consumption, area or connection voltage. We also record the language of the page you wrote from, so that we can reply in that language. We only ask for what we need to understand the project and answer with a useful proposal.

In the free-text message, please do not include health data, beliefs, ethnic origin or other special categories of data, nor data about other people without their permission. We do not need them to reply.

To protect the form. The server checks how much time has passed since the form was opened and counts how many submissions arrive from the same IP address within one hour. That count uses a code derived from the IP address with a secret key (a keyed hash). To recognise the same message sent several times, a code derived from the message text is also kept, never the text itself.

IP address of anyone who submits a form. The IP address from which the form was sent is recorded in plain text. It appears in the email we receive with the enquiry, in the weekly summary and in the copy the server keeps for 30 days. It is used to investigate abusive submissions, attempted fraud and attacks. We do not use it for any other purpose, nor do we combine it with other data to identify who is writing to us.

Attached files. The forms accept attachments in PDF, Word, JPG and PNG, up to three files and 7 MB in total. We process whatever the file contains. Please do not send identity documents, health data or data about other people. Larger photographs are reduced by the server before being forwarded.

Job applications (“Work with us”). Your name, contact details, country, area of interest, the introduction you write and the CV you attach. Please keep your CV to what matters for the role: work history, education and skills. A photo is optional. Do not include national identity or tax numbers, health data, trade union membership, beliefs or a criminal record certificate. If we need any of these at a later stage, we will ask for them then and explain why.

Suppliers and service providers. The company name, the name and contact details of the person writing to us, the country, the type of supply, the description of what the company does and any documents attached.

Acknowledgement of receipt. After you submit a form, you receive an automatic message at the address you gave, confirming that your enquiry arrived. The message does not repeat what you wrote.

When you browse. As with any website, the server that hosts it and the network that delivers and protects it receive your IP address, the date and time, the page requested and your browser identification. This is used to deliver pages, keep the site secure and diagnose faults. We do not use advertising tools. If you accept audience measurement in the cookie notice, Google Analytics also records the pages you view, the site you came from, your type of device and browser, your language and your approximate location (country and region), linked to an identifier stored in a cookie. Google Analytics does not store your IP address. Microsoft Clarity also records how you move through each page: mouse movements, clicks, taps and scrolling, so that we can review the visit. What you type into form fields is hidden before it leaves your browser and is not recorded. See the Cookie Policy.

If you go ahead with a proposal or contract, we also process the data that relationship requires, such as the site address, tax number and billing details.

4. What we use the data for, and on what legal basis

Answering your enquiry and preparing the proposal. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) of the General Data Protection Regulation, GDPR).

Performing the contract, if you sign one: planning, execution, handover, warranties and support. Legal basis: performance of a contract (Article 6(1)(b)).

Assessing your job application. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b)).

Assessing offers from suppliers and service providers and keeping the contact details of the person who makes them. Legal basis: WChampion’s legitimate interest in knowing and selecting those who can supply it (Article 6(1)(f)). Where the offer is made by an individual on their own behalf, the legal basis is the steps prior to entering into a contract (Article 6(1)(b)).

Meeting legal obligations, mainly tax and accounting. Legal basis: legal obligation (Article 6(1)(c)).

Protecting the website and the form against abuse, automated submissions and attacks, and keeping technical operating logs. Legal basis: WChampion’s legitimate interest in the security of its systems (Article 6(1)(f)). You may object to this processing, as explained in section 9. This includes recording the IP address of anyone who submits a form.

Understanding how the website is used, in order to improve it: how many visits it receives, which pages are viewed and where visitors come from. This only happens if you accept audience measurement. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time under “Cookie preferences”.

Defending our rights in the event of a dispute. Legal basis: legitimate interest (Article 6(1)(f)).

We do not send marketing communications to people who contact us through the form. Should we ever wish to, we will first ask for your separate consent, which you can withdraw at any time. We do not take automated decisions or build profiles from your data.

5. Do you have to give us your data?

It is neither a legal nor a contractual requirement. But without a name, an email address, a country and a description of the request we cannot reply. The other fields are optional: the more specific they are, the more accurate the proposal can be.

6. Who receives the data

Enquiries arrive in WChampion’s mailbox and are read only by the people handling them within the company. To run the website we use service providers that process data on our behalf, only on our instructions and under a contractual duty of confidentiality and security (Article 28 GDPR):

Brevo (Sendinblue SAS, France). Delivers the enquiries made through the form to our mailbox. The data is hosted in the European Union.

Resend (Plus Five Five, Inc., United States). Backup provider: it is only used when delivery through Brevo fails, so that the enquiry still reaches our mailbox. The data it processes is hosted in the United States.

DIX7 (the agency that built and maintains this website, based in Brazil). It receives a copy of each form sent through the website, with any attachments, to monitor that the service works and to support WChampion in following up enquiries. The copy is received in a mailbox hosted by Google.

Cloudflare, Inc. (United States). The network that delivers and protects the website. Page requests and visitors’ IP addresses pass through it.

Google Ireland Limited (Ireland). Provides Google Analytics, the audience measurement tool, which only runs if you accept it. It processes the browsing data described in section 3 on our behalf. The advertising features of Google Analytics are switched off.

Microsoft Corporation (United States). Provides Microsoft Clarity, the tool that records how pages are used, which only runs if you accept it. Microsoft also processes this data for its own purposes, under the Microsoft Privacy Statement.

Website hosting and maintenance provider. The server on which the website and the form run.

WChampion’s email service provider. Where enquiries are received and stored.

When carrying out a project, we may need to share data with those directly involved in the work, such as equipment suppliers, and with public bodies or grid operators where the law requires it to license or connect the installation. We share only what is necessary. We also disclose data to the authorities where the law obliges us to.

We do not sell or rent personal data. An up-to-date list of our providers is available on request at [email protected].

7. Transfers outside the European Economic Area

Cloudflare is a US company certified under the EU-U.S. Data Privacy Framework, the subject of a European Commission adequacy decision of 10 July 2023. Its data processing agreement also includes the standard contractual clauses approved by the Commission, which apply should that certification cease to be valid. Brevo’s sub-processors located outside the European Union are subject to the same safeguards.

Transfers to Plus Five Five, Inc., which provides the Resend service, are made under the standard contractual clauses approved by the Commission, which are included in its data processing agreement. The company also participates in the same EU-U.S. Data Privacy Framework.

The copy of the forms sent to DIX7 is transferred to Brazil, a country covered by an adequacy decision of the European Commission, adopted in January 2026.

Google Analytics is provided by Google Ireland Limited, which may use Google LLC, in the United States. Google LLC is certified under the same EU-U.S. Data Privacy Framework, and Google’s data processing terms include the standard contractual clauses approved by the Commission.

Microsoft Corporation, which provides Microsoft Clarity, is in the United States and certified under the same EU-U.S. Data Privacy Framework.

If any other provider needs to process data outside the European Economic Area, the transfer will only take place to a country covered by a European Commission adequacy decision or under standard contractual clauses. You may ask us for information about the applicable safeguards and for a copy of them.

8. How long we keep the data

Enquiries that do not lead to a proposal: 12 months after the last contact, so that we can pick up the conversation if you write to us again about the same project.

Proposals that do not lead to a contract: 3 years from the date of the proposal, the limitation period for pre-contractual liability under Portuguese law (Articles 227(2) and 498 of the Civil Code).

Clients: for the duration of the contract and the warranty periods of the work. Accounting records and supporting documents, including contracts and invoices, are kept for 10 years, as required by Article 123(4) of the Portuguese Corporate Income Tax Code.

Job applications: 6 months after they are received. The law does not set a period for speculative applications: this is the one we consider necessary to assess them.

Contact details of suppliers and service providers: 12 months after the last contact, where there is no contract. Where there is a contract, the periods stated for clients apply.

IP address of anyone who submits a form: 30 days in the server record. In the email we receive, it is kept for as long as the enquiry it relates to.

Code used to count form submissions: used only for the count over the last hour, and it changes every day. The server deletes it automatically, in the clean-up it runs on every form submission, as soon as it has gone unused for an hour or the day has changed.

Code derived from the message text, used to recognise repeated submissions: it changes every day and the text itself is not kept. The server deletes it automatically, in the clean-up it runs on every form submission, as soon as the day has changed.

Enquiry that could not be delivered because of a technical fault: kept on the server, with its attachments, and the server retries delivery until it succeeds. The server automatically deletes any older than 30 days, in the clean-up it runs on every form submission.

Copy of the enquiry for the weekly summary: each enquiry, with the IP address and the names of the attached files, is also kept on the server, outside the public area of the website, so that it can be included in the summary WChampion receives once a week, which is used to confirm that no enquiry has gone unanswered. The server automatically deletes copies older than 30 days, in the clean-up it runs on every form submission.

Technical delivery record in the email service (Brevo): 1 month.

Message and delivery record at the backup provider (Resend), when it is used: 30 days, plus 7 days in backups.

Audience measurement data (Google Analytics), if you accept it: the data linked to the cookie identifier is kept in Google’s systems for no more than 14 months. The cookies last up to 2 years in your browser, or until you delete them or withdraw your acceptance.

Microsoft Clarity records, if you accept it: no more than 13 months in Microsoft’s systems. The cookies last up to 1 year.

Technical logs of the server and delivery network: the period set by each provider to keep systems secure and diagnose faults. We do not use them to identify visitors.

At the end of these periods the data is deleted or anonymised. If a dispute is pending, we keep what is necessary until it is resolved.

9. Your rights

You may request access to your data, rectification of inaccurate data, erasure, restriction of processing and portability of the data you provided to us. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. Where processing is based on consent, you may withdraw it whenever you wish, without affecting what was done before.

To exercise any of these rights, write to [email protected]. We reply within one month, which may only be extended in the cases provided for in Article 12 GDPR. We may ask you for information to confirm your identity, solely to avoid disclosing data to someone else. Exercising your rights is free of charge.

If you believe your data has not been handled properly, you may lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Protecção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, www.cnpd.pt, or with the supervisory authority of the EU country where you live or work.

10. Security

The website runs only over an encrypted connection (HTTPS) and has a content security policy that only allows expressly authorised third-party code to load: Google Analytics and Microsoft Clarity, if you accept measurement, and the YouTube film on the About page. The form validates data on the server, limits the number of submissions and does not store enquiries in a database: they are sent by email and handled from there. The server keeps only, for 30 days, the copy used for the weekly summary, with the sender’s IP address, and, if delivery fails, the undelivered enquiry with its attachments, in files outside the public area of the website. Access keys to the services are kept out of the published code.

Attachments are accepted only in the formats stated and up to the size limit, and the server checks the actual type of each file. Delivered attachments are not kept on the server: they are forwarded by email.

No system is infallible. If a personal data breach occurs that poses a risk to you, we will notify the CNPD and, where the law requires, inform you directly.

11. Minors

The website is intended for businesses and adult individuals. We do not knowingly collect data from minors.

12. Changes to this policy

We update this policy when the website or the law changes. The date of the last update is shown at the top of the page.