01Data controller
DUMA («DUMA») is the controller for personal data collected through duma.pt and public forms (newsletter, savings simulator, event questionnaires). Address: TecPark | Set.Up Guimarães, Avepark – Parque de Ciência e Tecnologia, Lugar da Gandra, 4805-017 Barco, Guimarães, Portugal. Privacy contact: geral@duma.pt.
02Data we collect
Depending on your interaction we may process: email address (newsletter); name, email, phone, company, role and contact preferences (simulator and events); energy consumption data and invoice files you voluntarily upload; technical browsing data (truncated IP, device, pages visited) when you allow analytics cookies.
03Purposes and legal bases
We handle enquiries and submissions under pre-contractual measures (GDPR Art. 6(1)(b)). Newsletter and marketing communications rely on your consent (Art. 6(1)(a)). Analytics cookies (PostHog, Google Analytics/Firebase, Microsoft Clarity if enabled) require consent. Invoice files are processed to prepare preliminary energy diagnostics you request.
04Retention
We keep contact and simulator submissions as long as needed for commercial follow-up and legal obligations, typically up to 24 months after last contact unless you request earlier deletion. Newsletter data is kept until you unsubscribe. Cookie consent records follow this cookie policy.
05Processors
We use suppliers that process data on our behalf: Google Firebase (data hosting and analytics), PostHog (analytics, preferably EU region), Vercel (web hosting), Microsoft Clarity (optional heatmaps) and Gmail SMTP (email delivery when applicable). We use appropriate agreements where required by GDPR.
06International transfers
Some suppliers may process data outside the European Economic Area. In those cases we rely on GDPR safeguards such as EU Standard Contractual Clauses.
07Your rights
You have rights of access, rectification, erasure, restriction, portability and objection under GDPR. For marketing you may withdraw consent at any time. You may lodge a complaint with your supervisory authority. To exercise rights contact geral@duma.pt — we respond within 30 days.
08Security
We apply appropriate technical and organisational measures, including encryption in transit (HTTPS) and restricted access to authorised teams.
09Children
Our services are not directed at children under 16. We do not knowingly collect data from children.
10Changes
We may update this policy. The last revision date appears at the top. Material changes will be communicated on the website.