1. Identification of the Data Controller

Pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”), the data subject is hereby informed that the Data Controller is:

Viktoriya Pinto
Sole Trader (Empresária em Nome Individual)
Tax Identification Number (NIF): 271431911
Registered business address: Rua Luís de Camões, 92, 3000-251 Coimbra, Portugal
Email: info@wedoidosweddings.com

Hereinafter referred to as the “Data Controller”.

2. Scope of This Policy

This Privacy Policy governs the processing of personal data collected through the website and in the context of the provision of wedding planning services within Portugal, including services provided to international clients whose events take place in Portuguese territory.

3. Categories of Personal Data Processed

The Data Controller may collect and process the following categories of personal data:

3.1 Data Provided Directly by the Data Subject

Through contact or quotation request forms:

Full name
Email address
Wedding date
Venue status (secured / searching)
Estimated number of guests
Estimated budget
Selected service package (if applicable)
Information contained in the message field

3.2 Contractual Data

Where a service agreement is entered into:

Identification details
Contact information
Billing details
Tax information
Contractual documentation
Event-related information
3.3 Image Data

Photographs and audiovisual content from weddings organized by the Data Controller, where explicit contractual consent has been granted.

3.4 Technical Data

When accessing the website, certain data may be collected automatically, including:

IP address
Browser type and version
Device information
Date and time of access
Server logs

4. Purposes of Processing and Legal Basis

Personal data is processed for the following purposes and under the following legal grounds:

4.1 Pre‑contractual Measures

Legal basis: Article 6(1)(b) GDPR
To respond to contact requests and prepare quotations.

4.2 Performance of Contract

Legal basis: Article 6(1)(b) GDPR
To manage and execute wedding planning services.

4.3 Compliance with Legal Obligations

Legal basis: Article 6(1)(c) GDPR
For accounting, tax, and administrative compliance under Portuguese law.

4.4 Legitimate Interests

Legal basis: Article 6(1)(f) GDPR
For business management, service improvement, and legal defense.

4.5 Consent

Legal basis: Article 6(1)(a) GDPR
For the publication of wedding photographs and any non-essential data processing requiring prior consent.

5. Data Retention Period

Personal data shall be retained only for the period strictly necessary for the purposes for which it was collected, namely:

Contact requests without contract: up to 6 months after the last interaction
Contractual and billing data: 10 years, in compliance with Portuguese tax legislation
Image data: for as long as consent remains valid, unless withdrawal is requested
Data necessary for legal defense: for the duration of applicable limitation periods

Upon expiry of the applicable retention period, data will be securely deleted or anonymized.

6. Data Sharing and Subprocessors

Personal data may be disclosed, where strictly necessary, to:

Accounting and tax advisors
Certified invoicing software providers
Wedding service suppliers (only after contractual engagement and where necessary for event execution)
Cloud storage providers (including Google Drive and Notion)
IT service providers and website hosting providers

All third-party service providers are contractually bound to ensure confidentiality and compliance with the GDPR.

7. International Data Transfers

Some service providers (including cloud-based platforms) may process data outside the European Economic Area (EEA).

In such cases, transfers are safeguarded through:

Adequacy decisions of the European Commission; or
Standard Contractual Clauses (SCCs) approved by the European Commission; or
Other legally recognized transfer mechanisms under Chapter V of the GDPR

8. Publication of Images

Wedding photographs are only published where prior explicit consent has been obtained contractually from the clients.

Data subjects retain the right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

9. Data Subject Rights

Pursuant to Articles 12–22 of the GDPR, data subjects have the right to:

Access their personal data
Rectify inaccurate or incomplete data
Request erasure (“right to be forgotten”)
Restrict processing
Object to processing
Data portability
Withdraw consent at any time
Lodge a complaint with a supervisory authority

Requests may be submitted in writing to:
info@wedoidosweddings.com

The Data Controller reserves the right to request proof of identity before responding.

10. Supervisory Authority

In Portugal, the competent supervisory authority is:

Comissão Nacional de Proteção de Dados (CNPD)
Rua de São Bento, n.º 148, 3º
1200-821 Lisboa
Website: www.cnpd.pt

11. Data Security

The Data Controller implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Such measures include restricted access controls, secure storage systems, and contractual safeguards with service providers.

12. Cookies

The website may use strictly necessary technical cookies to ensure proper functionality.

Where non-essential cookies are implemented, users will be informed through a cookie banner and prior consent will be obtained in accordance with applicable legislation.

13. Minors

The services are directed exclusively to individuals over the age of 18. The Data Controller does not knowingly collect personal data from minors.

14. Amendments

The Data Controller reserves the right to amend this Privacy Policy at any time. Updated versions will be published on the website with the respective revision date.