Privacy Policy

Draft for review. Last updated: 14 October 2026. This is a courtesy translation; if it differs from the Portuguese version, the Portuguese version prevails.

1. Who we are

The controller of the personal data collected on this website is [Company name], tax number [NIPC], registered office at [Registered office address] ("Darkmoon Innovations", "we"). For any privacy question, write to [email protected].

2. What data we process and why

Contact requests

When you write to us through the contact form, we process your name, email, company (if given), message and the areas of interest you choose, to reply to your request and, where relevant, prepare a proposal.

• Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in following up the business relationship.
• Retention: 24 months after the request is closed or after the last interaction; requests identified as spam are deleted after 30 days.

Newsletter

If you ask to receive our content, we process your email and language to send you the newsletter.

• Legal basis: your consent, which you can withdraw at any time using the link in every email.
• Retention: until you withdraw your consent.

Job applications

When you apply for a position or send an open application, we process your contact details, CV and message to assess the application. Every application is read by a person: we do not use automated screening or decisions.

• Legal basis: steps taken at your request before entering into a contract; your consent, if you allow us to keep your application for future opportunities.
• Retention: 6 months after the process ends; 12 months without activity in an open process; up to 24 months if you allow future opportunities.

Website statistics

Only with your consent, we use Google Analytics to measure, in aggregate, how the website is used (pages visited, traffic sources, device type). See the Cookie Policy.

Security and operation of the website

We use Cloudflare Turnstile to protect the forms against spam. Our hosting and network providers keep technical logs (IP address, date and time, page requested) for short periods, for security reasons.

• Legal basis: our legitimate interest in keeping the website secure and available.

3. Who we share data with

We do not sell personal data. We use providers (processors) that process data only on our behalf and following our instructions:

• SmarterASP.NET: website and database hosting.
• Cloudflare: content delivery, website protection and anti-spam (Turnstile).
• Resend: automatic emails (confirmations and replies).
• HubSpot: customer relationship management (contact requests) and newsletter.
• Microsoft: email, Teams and Microsoft Bookings (meeting scheduling).
• Google: Google Analytics, only with your consent.

Some of these providers may process data outside the European Economic Area. In those cases the transfer relies on the safeguards provided for in the GDPR, such as the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

4. Your rights

You may at any time ask us for access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it without affecting processing already carried out.

To exercise these rights, write to [email protected]. We reply within one month. You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (www.cnpd.pt).

5. Security

Data is transmitted encrypted (HTTPS). Access to the back office requires signing in with a company account, and every access to applicants' data is logged. CVs are stored privately and are never publicly accessible.

6. Changes

We may update this policy. The date of the last update is shown at the top of the page.