Who is responsible for your data
The data controller is KDS Offshore, Lda., a private company registered in Portugal under NIPC 514 248 091, with its registered office at Rua Ernesto Veiga de Oliveira, Oeiras, Portugal. You can reach us at geral@kdsoffshore.pt or +351 929 111 655. Given the size of the office and the limited scope of personal data we process, we have not formally appointed a Data Protection Officer; data protection enquiries should be addressed to the email above.
Categories of personal data
We process the following personal data:
From the contact form
Name (required), company (required), role (optional), email (required), phone (optional), project type, indicative budget, a free-text description of the project, and an optional NDA flag. You provide this information directly when you submit the form.
From email and phone correspondence
The contents of any messages you send to geral@kdsoffshore.pt and the metadata of phone calls you initiate.
Server logs and technical data
Standard web server logs (IP address, user agent, requested URL, timestamp, referrer) recorded by our hosting provider. These logs are kept transiently for security and diagnostic purposes.
We do not knowingly collect special-category data (Article 9 GDPR) and we do not process data of children under 16.
Purposes and legal basis
We process personal data for the following purposes, on the legal bases shown:
- Responding to your enquiry and assessing whether we can take on your project — Article 6(1)(b) GDPR (steps prior to entering a contract).
- Performing a contract for engineering services and managing the engagement — Article 6(1)(b) GDPR.
- Issuing invoices and meeting our legal accounting and tax obligations — Article 6(1)(c) GDPR (compliance with Portuguese tax law).
- Maintaining the security of the website and our systems — Article 6(1)(f) GDPR (legitimate interests in protecting our infrastructure, balanced against the limited intrusion on you).
- Sending occasional office updates if you have specifically subscribed — Article 6(1)(a) GDPR (consent), which you can withdraw at any time.
Recipients and processors
We do not sell personal data. We share it only with carefully selected processors who act on our instructions under written agreements that comply with Article 28 GDPR:
- Hosting and database — our website and contact-form storage are operated on infrastructure provided by Supabase, Inc. (with EU-region storage where available) and our website host.
- Email — our business email is provided by a standard EU or EU-adequate email provider.
- Accounting — invoicing data is shared with our accountants and the Portuguese tax authority (Autoridade Tributária e Aduaneira) as required by law.
- Professional advisers — lawyers, auditors, or insurers, only when strictly necessary and under duties of confidentiality.
We disclose data to public authorities only where we are legally compelled to do so and only to the extent required.
Transfers outside the EEA
Where a processor (for example, a US-headquartered provider) transfers personal data outside the European Economic Area, the transfer is protected by an adequacy decision of the European Commission, by Standard Contractual Clauses, or by another lawful transfer mechanism under Chapter V of the GDPR. You can request a copy of the safeguards in place by writing to us.
Retention periods
- Enquiries that do not lead to an engagement — up to 24 months after the last contact, then deleted.
- Engagement records and project deliverables — for the duration of the engagement plus 10 years, in line with the limitation periods that apply to engineering professional liability and to commercial obligations under Portuguese law.
- Invoicing and tax records — 10 years, as required by Article 123 of the Portuguese Corporate Income Tax Code (CIRC) and the Portuguese General Tax Law.
- Server logs — typically retained for less than 30 days.
Your rights under the GDPR
You have the right to:
- access your personal data and obtain a copy (Article 15);
- have inaccurate or incomplete data corrected (Article 16);
- have your data erased where the legal grounds apply (Article 17);
- restrict the processing of your data (Article 18);
- receive your data in a portable machine-readable format (Article 20);
- object to processing based on legitimate interests (Article 21);
- withdraw consent at any time where processing is based on consent (Article 7(3));
- not be subject to a decision based solely on automated processing that produces legal effects (Article 22) — KDS Offshore does not carry out such automated decision-making.
To exercise any of these rights, write to geral@kdsoffshore.pt. We will respond within one month, extendable by a further two months for complex requests, in accordance with Article 12 GDPR.
Lodging a complaint with the supervisory authority
You have the right to lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, n.º 134, 1.º, 1200-651 Lisboa, cnpd.pt. You may also lodge a complaint with the supervisory authority of your usual place of residence or place of work in the EEA.
Whether the provision of data is mandatory
The fields marked as required on our contact form are necessary for us to identify you, reply to you, and assess your enquiry. If you choose not to provide them, we will not be able to respond. Optional fields can be left blank without consequence.
Changes to this policy
We may update this policy from time to time to reflect changes in our practices or in the law. The "Last updated" date at the top of the page indicates when the most recent change was made. Material changes will be communicated through this page; for material changes that affect ongoing engagements, we will also notify affected clients directly.