Privacy policy.

01

Who is the data controller

The controller of your personal data is:

This policy applies to the airluso.com website and to all pages operated by AIRLUSO on this domain.

02

What data we collect

We collect only the data strictly needed to respond to your request and run the website.

Data you provide

• Name, email, phone and company (when you fill in the contact or quote request form).
• Project description, messages and attachments you choose to share with us.
• Payment and billing data (only for contracted clients, processed by our external accountants).

Data collected automatically

• IP address (anonymised for analytics).
• Browser type, operating system, screen resolution.
• Pages visited, time on site, traffic source.
• Cookie identifiers (only with your consent, see section 08).

03

How we use your data

• Responding to requests: contacting you after a form or email, sending commercial proposals and managing the contractual relationship.
• Delivering services: coordinating productions, sharing deliverables and invoicing contracted services.
• Website analytics: understanding which content works and improving the experience (only with analytics consent).
• Direct marketing: measuring campaign effectiveness and showing relevant content (only with marketing consent).
• Legal compliance: tax, accounting and legal obligations that AIRLUSO is subject to.

04

Legal basis for processing

We process your data on one of the following legal bases (Article 6 GDPR):

• Consent (Art. 6(1)(a)): for analytics cookies, marketing cookies and communications you voluntarily sign up to.
• Performance of a contract or pre-contractual steps (Art. 6(1)(b)): when you ask us for a quote, hire our services, or communicate with us as part of a project.
• Legal obligation (Art. 6(1)(c)): for invoicing, accounting and tax obligations.
• Legitimate interest (Art. 6(1)(f)): for website security, fraud prevention and service improvement, always balanced against your rights.

05

How long we keep data

• Quote requests and enquiries: 24 months, unless the relationship becomes a contract.
• Contracted clients: for the duration of the contract and the following 10 years (legal tax and accounting obligation).
• Analytics data (GA4): 14 months, then automatically deleted.
• Cookies: between 24 hours and 12 months, depending on type (see section 08).
• Audiovisual material produced: according to the periods set in the contract with the client, with our own backup copy kept for 24 months after final delivery.

06

Who we share data with

We use technology providers that, in some cases, process personal data on our behalf (sub-processors). All have GDPR-compliant data processing agreements in place.

Transfers outside the EEA (to the US) take place under the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission.

07

Your rights

Under the GDPR, you have the following rights over your personal data:

• Access: to know what data we hold about you.
• Rectification: to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to ask for your data to be deleted, unless we have a legal obligation to keep it.
• Restriction of processing: to temporarily restrict the use of your data.
• Portability: to receive your data in a structured, readable format.
• Objection: to object to processing, in particular for direct marketing.
• Withdrawing consent: whenever processing is based on your consent, without affecting the lawfulness of earlier processing.
• Complaint: to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (www.cnpd.pt).

To exercise any of these rights, email geral@airluso.com. We reply within the legal deadline of 30 days (extendable by a further 60 days in complex cases).

08

Cookies we use

Our website uses cookies in three categories. You can change your preferences at any time.

09

Security

We apply appropriate technical and organisational measures to protect your data: HTTPS across the whole website, access control for internal systems, encrypted backups, and regular supplier reviews. No system is 100% secure. In the event of a data breach that poses a risk to your rights, we notify the CNPD and you within the legal deadlines.

10

Changes to this policy

This policy may be updated to reflect changes in our operations or in the law. The version in force is always the one published at this URL, with the last-updated date shown at the top. Substantial changes are communicated prominently (banner or email to active clients).