Privacy Policy | Ampleshift

Data controller

The controller responsible for processing your personal data is:

Ampleshift Consulting Lda
NIF 519040791
Largo Marquês de Pombal, N 2, 9
2600-222 Vila Franca de Xira, Lisboa, Portugal
info@ampleshift.com

We have not appointed a Data Protection Officer, as we are not required to. For any privacy matter, contact us at the address above.

Scope

This Privacy policy explains how we collect, use and protect personal data through ampleshift.com. Our processing complies with Regulation (EU) 2016/679 ("GDPR") and Portuguese Law No. 58/2019 of 8 August.

Personal data means any information relating to an identified or identifiable natural person. We never request special-category data such as philosophical, political or religious beliefs, or racial or ethnic origin.

Personal data we collect

Contact form: your name, email address, the service you are interested in, and the content of your message.
Protected proposal and deck pages: your business email address and company domain, and a record of when you accessed the page.
Event and campaign pages (QR codes): when you open a campaign page such as /dreamforce, typically by scanning a QR code at an event, we record the visit server-side: IP address, device and browser type, browser language and timezone, screen size, the code that was scanned and the date and time. This is recorded to measure whether our event presence works and to protect the page from abuse. If you also complete the form on that page, we receive the name, email address, company and topic of interest you provide.
Collected automatically: IP address, approximate location, device and browser type, pages viewed, referral source and on-page interactions, gathered through the analytics tools described below.

Purposes and legal bases

We process personal data for the following purposes, each with its legal basis under Article 6 of the GDPR:

Responding to enquiries sent through the contact form. Basis: our legitimate interest in answering you, or taking steps at your request prior to a contract.
Providing access to gated proposals and decks shared with you. Basis: performance of a contract or our legitimate interest.
Website analytics and improvement using Google Analytics 4 and Microsoft Clarity. Basis: your consent, given through the cookie banner.
Measuring event and campaign activity, including QR code scans on pages such as /dreamforce, and following up on details you choose to submit there. Basis: our legitimate interest in understanding whether our event presence works, and taking steps at your request when you ask us to contact you. You can object to this processing at any time using the contact details above.
Security and prevention of misuse of the website. Basis: our legitimate interest.
Complying with legal obligations. Basis: compliance with a legal obligation.

Analytics and session tools

With your consent, we use:

Google Analytics 4 (Google) to measure traffic and understand how the site is used. See the Google Privacy Policy.
Microsoft Clarity (Microsoft) to record anonymised session replays and heatmaps of on-page interactions, which help us improve usability. See the Microsoft Privacy Statement.

These tools stay disabled until you accept optional cookies, and you can withdraw consent at any time from our Cookie policy.

Service providers we share data with

We do not sell your personal data. We share it only with providers who process it on our behalf under a data processing agreement, and with authorities where legally required:

Google, analytics (Google Analytics 4).
Microsoft, analytics and session insights (Clarity).
Resend, delivery of contact-form and notification emails.
Our hosting provider, for operating the website infrastructure.

This website may link to third-party sites. We are not responsible for their privacy practices and recommend reading their policies.

International data transfers

Some of the providers above (Google, Microsoft, Resend) may process personal data outside the European Economic Area, including in the United States. Where they do, transfers are protected by appropriate safeguards, such as certification under the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Retention period

We keep personal data only as long as necessary for the purposes above, or as required by law. As a guide:

Contact-form enquiries: up to 24 months after last contact.
Google Analytics data: up to 14 months.
Microsoft Clarity data: approximately 12 months.
Proposal and deck access logs: up to 12 months.
Event and campaign page (QR code) scan records: up to 6 months after the event.

Security measures

We adopt appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or improper disclosure. Please note that no transmission over the internet can be guaranteed to be completely secure.

Your rights

Under the GDPR and Law No. 58/2019, you may exercise the following rights at any time by emailing info@ampleshift.com with enough information to identify you:

Access your personal data.
Request rectification of inaccurate or incomplete data.
Request erasure ("right to be forgotten").
Restrict the processing of your data.
Object to the processing.
Request data portability.
Withdraw consent, where consent is the legal basis, without affecting processing already carried out.

Right to lodge a complaint

If you believe your data has been handled unlawfully, you have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

Automated decisions

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

Cookies

The website uses cookies and similar technologies. Non-essential cookies are set only with your consent. For details, see our Cookie policy.

Amendments

Ampleshift reserves the right to amend this Privacy policy at any time. Changes will be published on the website with the date of the latest update.