Machaltech, Lda. (tax ID pending, registered office at Parque Industrial de Laundos, lote 28, 4570-311 Póvoa de Varzim, Portugal) is the controller of personal data collected through this website, in accordance with Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019.
Data we collect
We collect data you voluntarily provide through contact and quote-request forms: name, email, phone, company name, tax ID (optional), category of interest and message. We also collect anonymised IP (hashed) and browser technical data for fraud and abuse prevention.
How we use the data
- Reply to your request — legal basis: pre-contractual measures (art. 6(1)(b) GDPR).
- Newsletter and campaigns — only with separate explicit consent. You may revoke at any time (art. 6(1)(a) GDPR).
- Legal obligations — invoicing, accounting.
Retention
We keep contact data for as long as needed to reply to the request and fulfil resulting business relationships. Marketing data is retained while consent is active.
Your rights
You have the right to access, rectify, erase, restrict, object and port your data, and to withdraw consent. To exercise these rights contact dpo@machaltech.com. In case of breach you may complain to the CNPD.
Photographs and video of the work carried out
When we provide technical assistance or carry out work at a client's premises, our technicians record photographs and video of the equipment and of the work carried out. These records are attached to the corresponding service intervention or internal task.
- Equipment service history and delivery of the service — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Proof that the work was carried out, invoicing and complaint handling — legitimate interest (Art. 6(1)(f) GDPR).
Our technicians are instructed to photograph the work, not people. Even so, someone may be captured incidentally; if that happens, the person concerned may request deletion of the image at dpo@machaltech.com.
Retention: photographs attached to technical interventions are kept with the equipment's service history, for the duration of the contractual relationship and any applicable legal periods; files submitted as proof of completion of internal tasks are automatically deleted 90 days after the task is closed.
We ask our clients to inform their own workers that this recording takes place during our interventions.
Processors
We use third-party services to run the site: Vercel (hosting, US under EU SCCs), Supabase (database, EU), Resend (transactional email), Cloudflare Turnstile (bot prevention), Expo (push notifications, US under EU SCCs). All under data processing agreements.
Client portal and app
If you activate an account on our portal or mobile app, we process the data linked to your account: name, email, phone, tax number (NIF) and customer number, as well as your equipment and service history, the support requests you submit (including any photographs and videos you attach to them) and the device identifier used to send (push) notifications.
- Account management and service delivery — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Operational notifications — legitimate interest (Art. 6(1)(f) GDPR); you can disable them in your device settings.
We keep this data while the account is active and, after closure, for the periods required by legal obligations. You can request account deletion at any time via dpo@machaltech.com or in the app itself.