Privacy Policy

1. Data controller

The controller of personal data collected on this website is [TO BE COMPLETED: company name], tax number (NIF) [TO BE COMPLETED], registered at [TO BE COMPLETED: address], trading as ProntAI ("ProntAI", "we").

For any privacy question, you can contact us at [TO BE COMPLETED: privacy email].

2. Data we collect

We only collect the data you voluntarily provide through the website forms:

• Contact form: name, email and message.
• Quote request: name, email, phone (optional), company (optional), service type, project description, timeline, indicative budget (optional) and contact language.
• Intro call request: name, email, phone (optional), topic, preferred days, time of day and format, and notes (optional).

To protect the forms against abuse, your IP address is used temporarily, in memory only, to limit the number of requests. It is not stored in a database.

Digital Assessment answers and Bot Lab demo conversations are processed only in your browser and are not sent to our servers, unless you choose to include the assessment summary in a quote request.

3. Purposes and legal basis

• Replying to contact, quote or call requests — pre-contractual steps at the data subject's request (Article 6(1)(b) GDPR) and legitimate interest in replying to enquiries (Article 6(1)(f)).
• Website security and abuse prevention — legitimate interest (Article 6(1)(f)).
• Compliance with legal obligations, where applicable (Article 6(1)(c)).

We do not use your data for automated decisions with legal effects, nor for marketing without your prior consent.

4. Retention

Data from requests that do not lead to a business relationship is kept for a maximum of [TO BE COMPLETED: e.g. 12 months] after the last contact and then deleted. Client data is kept for as long as necessary for the contractual relationship and to meet legal obligations.

5. Recipients and processors

Submitted requests are sent by email through an email (SMTP) and hosting provider: [TO BE COMPLETED: hosting and email providers]. These providers act as processors under Article 28 GDPR.

We do not sell or share personal data with third parties for commercial purposes.

6. International transfers

We favour providers with infrastructure in the European Union. Any transfer outside the European Economic Area will be made with the appropriate safeguards provided for in the GDPR.

7. Your rights

You may at any time exercise your rights of access, rectification, erasure, restriction, portability and objection by contacting us at the email in section 1.

You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD) — www.cnpd.pt.

8. Security

We apply appropriate technical and organisational measures, including encrypted connections (HTTPS), a content security policy, data validation, rate limiting and logging without personal data.

9. Changes

This policy may be updated. The date of the current version is always shown at the top of this page.