Privacy Policy

1. What Data We Collect

2. Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Article 6): • Consent — when you submit a contact form or opt into communications • Legitimate interests — to respond to enquiries and improve our services • Contract — when processing is necessary to fulfil a service agreement • Legal obligation — when required by applicable law

3. How We Use Your Data

We use your personal data to: • Respond to your enquiry or audit request • Prepare and send proposals or service information • Communicate about your project or engagement • Improve our website and services • Comply with legal obligations We do not sell, rent, or trade your personal data to third parties.

4. Data Retention

We retain your personal data only for as long as necessary: • Enquiry data — up to 12 months if no engagement follows • Client data — for the duration of the engagement plus 5 years for legal/accounting purposes • Analytics data — up to 26 months

5. Third-Party Services

We use the following third-party services that may process your data: • Netlify — website hosting and form submissions (US-based, GDPR compliant) • Google Analytics — website analytics (you can opt out via browser settings) • Google Workspace — email communications All third-party providers are required to handle your data in compliance with GDPR and applicable data protection laws.

6. Cookies

Our website uses cookies to improve your browsing experience. These include: • Essential cookies — necessary for the website to function • Analytics cookies — help us understand how visitors use the site You can control cookies through your browser settings. Disabling cookies may affect website functionality.

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights: • Right of access — request a copy of your personal data • Right to rectification — request correction of inaccurate data • Right to erasure — request deletion of your personal data • Right to restrict processing — request we limit how we use your data • Right to data portability — receive your data in a portable format • Right to object — object to processing based on legitimate interests • Right to withdraw consent — at any time, where processing is based on consent To exercise any of these rights, contact us at bernardo@metriqshouse.com. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data transmitted via our website is encrypted using SSL/TLS.

9. International Transfers

Some of our third-party service providers are based outside the European Economic Area (EEA). Where data is transferred internationally, we ensure appropriate safeguards are in place in accordance with GDPR requirements.

10. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this policy periodically.

12. Complaints

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Portuguese data protection authority: CNPD — Comissão Nacional de Proteção de Dados Website: www.cnpd.pt Rua de São Bento, 148-3º, 1200-821 Lisboa

13. Contact Us

For any privacy-related questions or to exercise your rights, contact us at: Email: bernardo@metriqshouse.com Location: Lisbon, Portugal