Privacy policy

Last updated: 11 November 2026

This page explains what personal data is collected on aldireto.pt, why, how long it is kept and what your rights are (EU General Data Protection Regulation, GDPR).

1. Data controller

BALLES Mehdi, sole trader (ALDireto.pt), 1 Rond-Point de Paris, 75009 Paris, France, SIREN 514 518 123. Contact: web [at] aldireto.pt.

2. Data collected, purposes and legal bases

  • Free audit or quote form: name, email, link to your listing or website (optional), goal, plan and options you are interested in, types of guests, message, referral code. Purpose: to answer your request, carry out the free audit or prepare the quote. Legal basis: your consent (tick box) and pre-contractual steps taken at your request.
  • Contact form: name, email, subject and message. Purpose: to reply to your message (partnership, question, support). Legal basis: your consent (tick box) and legitimate interest.
  • Client form (after an accepted quote): information about the property, texts, photos, contact details. Purpose: to create and update your website. Legal basis: performance of the contract.
  • Contract, invoicing and payment: identity, billing address, payment history. Purpose: to manage the order and the subscription and meet accounting obligations. Legal basis: performance of the contract and legal obligation.
  • Email or WhatsApp exchanges: content of the messages. Purpose: to reply, follow up and provide support. Legal basis: performance of the contract or legitimate interest.
  • Referral: if you arrive through a link containing a ?ref= code, that code is stored in your browser for 60 days so it can be filled into the form. Purpose: to know who referred you. Legal basis: legitimate interest.
  • Security and anti-spam: the forms limit the number of submissions per hour per IP address, the total number of submissions per hour and the number of submissions per email address (3 in 24 hours), using fingerprints kept for 24 hours at most, and check how long the form took to fill in. Legal basis: legitimate interest.

The « Test your website » quiz runs in your browser: your answers are not sent or stored.

3. Cookies and browser storage

This website does not use advertising cookies or audience measurement tools. It only stores, in your browser, the referral code described above (60 days). Payment buttons open a payment page hosted by Stripe, which may use cookies needed for payment and fraud prevention. No Stripe script is loaded on this website.

4. Recipients of the data

Your data is neither sold nor rented. It may be processed by:

  • Hostinger International, Ltd. (Cyprus): hosting of the website, files and emails;
  • Stripe Payments Europe, Ltd. (Ireland): online payment and subscription management;
  • WhatsApp (Meta), if you contact me through that channel;
  • my accountant, for accounting obligations, where applicable.

5. Transfers outside the European Union

Some providers (Stripe, Meta) may process data outside the European Union. These transfers are covered by the mechanisms provided for by the GDPR (adequacy decision or standard contractual clauses).

6. Retention periods

  • Contact requests and prospects: 3 years from the last contact, then deleted.
  • Client data and content: for the duration of the contract, then deleted or returned to the client.
  • Invoices and accounting records: 10 years (legal obligation).
  • Referral code in the browser: 60 days.
  • Anti-spam IP address fingerprint: 1 hour at most.

7. Your rights

You can request access to your data, its rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. Where processing is based on your consent, you can withdraw it at any time. Write to web [at] aldireto.pt: I reply within one month.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (France, cnil.fr) or the CNPD (Portugal, cnpd.pt).

8. Websites built for my clients

On a client's website, the client decides the purposes and means of processing their guests' data: the client is the data controller. ALDireto.pt acts only as a technical provider. A data processing agreement (art. 28 GDPR) can be provided on request.

9. Security

Requests received through the form are stored in a protected folder whose direct access from the internet is blocked, and exchanges with the website are encrypted (HTTPS). No method is infallible: I limit the data requested to what is useful.

10. Changes

This policy may change. The date of the last update is shown at the top of the page.