Privacy Policy

Last updated: July 2026 · Version 1.0

1. Data controller and contact details

Under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("GDPR"), Regular & Integral, Lda, trading as JanelaFix, is the controller of the personal data collected through the janelafix.pt website.

Data Protection Officer (DPO): Regular & Integral, Lda is not required to appoint a DPO under Article 37 GDPR and Article 10 of Law 58/2019, since installing and replacing PVC and aluminium windows does not amount to large-scale processing of special categories of data, nor large-scale systematic monitoring of data subjects. For any data protection question, contact us directly at geral@janelafix.pt.

2. Scope and principles of processing

This policy applies to all personal data processed by Regular & Integral, Lda in connection with operating the janelafix.pt website and providing its services, in accordance with the GDPR and Law 58/2019 of 8 August (the Portuguese GDPR implementing act).

Processing follows the principles in Article 5 GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

3. Categories of personal data processed and their source

Personal data is obtained directly from the data subject, voluntarily, through the website forms, by phone, WhatsApp or email. We do not collect data from third-party sources, public databases or social networks.

• Identification data: full name.
• Contact data: phone number, email address, location.
• Request details: type and number of windows, opening dimensions, material and glass requested, and any additional information voluntarily provided in the calculator or form.
• Billing and contract-performance data: installation address and payment details, only after a quote is accepted.
• Technical browsing data: IP address, device type and pages visited, collected via cookies only with consent (see our Cookie Policy).

Whether providing data is mandatory: your name and phone number are needed for us to prepare and send you a quote; without them, we cannot respond to your request. All other fields are optional.

Special categories of data (Article 9 GDPR): we do not collect or process any special categories of personal data.

Children's data: our services are not directed at anyone under 16. We do not knowingly collect data from children.

4. Purposes of processing and legal basis

Where processing relies on legitimate interest, we have carried out a balancing assessment confirming that interest is not overridden by data subjects' fundamental rights and freedoms. You may request information about this assessment at any time.

5. Recipients: sub-processors and third parties

• Website hosting and form processing (e.g. Netlify, Inc.), under a Data Processing Agreement (DPA) as required by Article 28 GDPR.
• Internal staff and technicians, bound by confidentiality obligations and limited to access needed for their role.
• Accountant, for tax compliance, with access limited to billing data.
• Analytics and advertising providers (e.g. Google Analytics, Google Ads), only with your consent.
• Public authorities (Tax Authority, CNPD), when required by law.

Regular & Integral, Lda does not sell, rent or share personal data with third parties for commercial purposes.

6. International data transfers

Data submitted through the website forms is processed by Netlify, Inc., a company based in the United States, certified under the EU-US Data Privacy Framework (verifiable at dataprivacyframework.gov). This transfer primarily relies on the European Commission's adequacy decision for that framework (Implementing Decision (EU) 2023/1795).

Monitoring note: the validity of this adequacy decision is currently under heightened scrutiny at European level, following US judicial developments concerning the independence of the US authority that oversees compliance with the framework. As a precaution, and regardless of the outcome, the transfer of data to Netlify, Inc. is also covered, on a subsidiary basis, by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), which guarantee an equivalent level of protection should the adequacy decision be reviewed or annulled by the Court of Justice of the European Union. We are actively monitoring this situation and will update this policy should there be any material developments. We do not carry out any other data transfers to third countries outside the European Economic Area.

7. Your rights

The GDPR grants data subjects the following rights, free of charge and without special formality. We respond within one month, extendable by two further months for particularly complex requests.

• Access (Art. 15): confirmation of processing and a copy of the data processed.
• Rectification (Art. 16): correction of inaccurate or incomplete data.
• Erasure (Art. 17): where data is no longer necessary, consent is withdrawn, or processing was unlawful.
• Restriction of processing (Art. 18): in the cases set out by law.
• Portability (Art. 20): receive the data you provided in a structured format and transmit it to another controller; this applies only to processing based on consent or contract and carried out by automated means.
• Objection (Art. 21): object to processing based on legitimate interest; for direct marketing, this right is absolute and unconditional.
• Withdrawal of consent (Art. 7(3)): at any time, without affecting the lawfulness of prior processing.

We expressly state that we do not carry out any automated decision-making or profiling that produces legal effects on the data subject (Art. 22). To exercise your rights, contact geral@janelafix.pt.

8. Right to lodge a complaint with the supervisory authority

Without prejudice to any judicial remedy, you have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Portugal's national data protection authority, under Article 77 GDPR: www.cnpd.pt · geral@cnpd.pt · Av. D. Carlos I, 134, 1st floor, 1200-651 Lisbon.

9. Data security and breach notification

We adopt appropriate technical and organisational measures under Articles 25 and 32 GDPR, including encrypted transmission (HTTPS/TLS), need-to-know access restrictions, and GDPR-compliant data processing agreements with sub-processors. In the event of a personal data breach likely to result in a risk to data subjects, we will notify the CNPD within 72 hours (Art. 33) and, where the risk is high, notify affected data subjects directly without undue delay (Art. 34).

10. Cookies

We use necessary cookies and, with your consent, analytics and marketing cookies. Full details are set out in our Cookie Policy, which forms an integral part of this policy.

Manage cookie settings

11. Changes to this policy

This policy may be updated to reflect legislative changes or changes to our data processing practices. The version in force is the one published on this page, dated as shown above. Materially significant changes will be flagged with a prominent notice on the website.

12. Contact

📧 geral@janelafix.pt · 📞 +351 920 675 844 · 🏢 Regular & Integral, Lda · NIF 515 988 561 · Lisboa, Portugal