Privacy Policy

We respect the privacy of everyone who visits this website, everyone who gets in touch with us and our clients. This policy explains what personal data we process, why, on what basis and for how long, and how you can exercise your rights.

Who is responsible

The controller of your personal data is Âmago — Energia Inteligente. For any question about this policy or about your data, please contact us:

What data we process and why

We only process the data we need for each purpose. We do not create profiles or make automated decisions about anyone.

Website visitors. This website has no contact forms and no analytics or advertising tools. As with any website, the server that hosts it logs technical data about each request — the IP address, the date and time, the page requested and the browser —, which we use only to keep the website running and protected against abuse, and which we keep for up to 90 days. Legal basis: our legitimate interest in having a secure website (Article 6(1)(f) GDPR). The website’s typeface comes from Google Fonts, which means your IP address also reaches Google; we explain this further below.

1

People who contact us. When you write to us or call us, we process your name, your contact details and whatever you tell us, in order to reply and, where appropriate, prepare a proposal. Legal basis: our legitimate interest in answering those who approach us, and the pre-contractual steps you ask us to take (points (f) and (b)). If the contact does not lead to a relationship with Âmago, we delete the data once the matter is closed.

Client Portal users. For those with access to the portal, we process the account data — the name, the username, the email address, the password (stored irreversibly, so that not even we can read it) and the date of the last login —, the documents the client and Âmago share, the document requests and the record of what each side uploads, moves or deletes. If you wish, we notify you by email when there are new documents; you can switch these notifications off in your account. Legal basis: the provision of the contracted service (point (b)). Uploaded files are checked on our own server for malicious content, without leaving it. We keep this data for as long as the account exists: when it is deleted, the documents, requests and record are deleted with it.

Clients and suppliers. To prepare and perform our contracts — audits, design projects, energy performance contracts, maintenance —, we process the data of our clients’ and suppliers’ contact persons (name, job title, email address and phone number) and billing data. Legal basis: the performance of the contract (point (b)). We keep it for the duration of the contractual relationship and, after that, for as long as the law requires or as needed to defend legal claims.

Accounting. Invoices and other accounting records, with the data of the people named in them, are kept for ten years, as Portuguese tax law requires. Legal basis: compliance with a legal obligation (point (c)).

Job applications. If you send us an application, we use your data only to assess it. Legal basis: the pre-contractual steps you ask us to take by applying (point (b)). If there is no position for you, we delete it when the process ends, unless you allow us to keep it for future opportunities.

2

Cookies

This website does not use analytics, advertising or social media cookies. It only uses the cookies that are strictly necessary for it to work and, for that reason, does not ask for your consent to them:

  • sessionid — keeps you signed in to the Client Portal. It is deleted when you sign out or, if you do not, after two weeks.
  • csrftoken — protects the Client Portal forms against requests forged by other websites. It lasts one year.
  • messages — carries a short message from one page to the next (for example, “Signed out.”) and is deleted as soon as it is shown.

Who we share data with

We do not sell or pass on your data to third parties. We use service providers that process it on our behalf — website hosting, the email service and our management and invoicing tools —, always under contracts that require them to protect it and to use it only for what we ask (Article 28 GDPR). We only disclose data to other bodies when the law requires it, such as the Portuguese Tax Authority.

Transfers outside the European Union

We give preference to providers that process data in the European Union or the European Economic Area. Where a provider is outside them, we only use it with the safeguards the GDPR requires, such as an adequacy decision by the European Commission or standard contractual clauses.

This is the case for the website’s typeface, served by Google Fonts: to deliver the font file, Google LLC, in the United States, receives the IP address of the person visiting the page. The transfer is covered by the EU-US Data Privacy Framework, under which Google is certified.

3

How we protect your data

We apply technical and organisational measures appropriate to the risk: the connection to the website is encrypted, passwords are stored irreversibly, Client Portal documents are kept in private storage that can only be reached once signed in, each client sees only their own folder, and internal access to the data is limited to those who need it for their work.

Your rights

With regard to your personal data, you have the right to:

  • Access — find out whether we process data about you and which, and receive a copy.
  • Rectification — correct data that is inaccurate or incomplete.
  • Erasure — ask us to delete it when it is no longer needed or there are no grounds for keeping it.
  • Restriction — ask us to store it without using it, for example while a correction is being checked.
  • Objection — object to processing based on our legitimate interest.
  • Portability — receive the data you gave us in a commonly used format, or ask us to send it to another organisation.
  • Withdrawal of consent — where processing is based on it, at any time and without affecting what was done before.

To exercise any of these rights, write to us at amago@amago.pt. We reply free of charge within one month, and we may ask you to confirm your identity.

If you believe we are not handling your data as we should, you can also lodge a complaint with the Portuguese data protection authority, the CNPD, at www.cnpd.pt.

Changes to this policy

We may update this policy when the processing we carry out or the law changes. The version in force is always the one on this page.

Last updated: 2 October 2026.