# Saltmark — Privacy Policy
Last updated: 7 May 2026
This Privacy Policy explains how we collect, use, share and protect personal data when you visit the Saltmark website (the "Website") or contact us through it. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese data protection law, including Lei n.º 58/2019.
## 1. Who we are (data controllers)
"Saltmark" is a trading name used by two independent freelance consultants based in Portugal who act as joint controllers in respect of the personal data collected through the Website:
- Ian Sumpter — Portuguese NIF 288028589
- Rachel Emerson — Portuguese NIF 288028457
You can contact us about anything in this Privacy Policy, including to exercise your rights, at info@saltmark.eu.
We do not have a designated Data Protection Officer, as we are not required to appoint one under Article 37 GDPR.
## 2. The personal data we collect
We only collect personal data that is necessary for the purposes described below.
a. Information you give us when you contact us. If you submit a form on the Website or email us directly, we collect the information you provide in that form or message — typically your name, email address, and any details you choose to share about your enquiry, business, project or context.
b. Information collected automatically when you visit the Website. Like most websites, when you visit Saltmark certain technical information is collected automatically, including:
- information about your browser, device and operating system;
- your IP address;
- the page on the Website you are viewing and the page (if any) you visited immediately before;
- timestamps and basic usage data such as clicks, scrolling and internal navigation;
- general information that helps Squarespace serve and protect the Website.
c. Cookies and similar technologies. See section 5 below.
We do not knowingly collect any "special category" personal data (e.g., data revealing health, racial or ethnic origin, political opinions, religious beliefs, or sex life). Please do not include such data in messages to us unless it is strictly necessary for your enquiry.
## 3. Why we use your personal data, and on what legal basis
We process personal data for the following purposes and on the corresponding legal bases under Article 6 GDPR:
| Purpose | Legal basis |
|---|---|
| Responding to enquiries you submit through the contact form or by email | Article 6(1)(b) — steps taken at your request prior to entering into a contract; or Article 6(1)(f) — our legitimate interest in answering people who contact us |
| Negotiating, agreeing and performing a consultancy engagement (where one results) | Article 6(1)(b) — performance of a contract |
| Issuing invoices and keeping accounting records | Article 6(1)(c) — compliance with our legal obligations under Portuguese tax and accounting law |
| Operating, securing and improving the Website (basic technical logging) | Article 6(1)(f) — our legitimate interest in keeping the Website available, secure and functional |
| Analytics and performance measurement (only after consent given via the cookie banner) | Article 6(1)(a) — your consent |
| Sending occasional marketing emails (only where applicable and where you have opted in) | Article 6(1)(a) — your consent, which you can withdraw at any time |
| Complying with other legal obligations or defending legal claims | Article 6(1)(c) and Article 6(1)(f) |
Where our basis is legitimate interest, we have considered your rights and freedoms and concluded that our use is proportionate and reasonably expected.
## 4. Who we share your personal data with
We do not sell personal data. We share it only with service providers that help us run the Website and our consultancy practice, and only to the extent necessary:
a. Squarespace — our website hosting and platform provider. Squarespace processes the data needed to serve the Website to visitors, store contact-form submissions, and provide its built-in site analytics. You can review Squarespace's privacy practices at https://www.squarespace.com/privacy.
b. Google Fonts and Adobe Fonts — the Website uses these third-party font services to display fonts correctly. To do so, your browser may share certain technical information with them, including your IP address and information about your browser, device and the page you are viewing.
c. Email and productivity providers — our reply to you, and any further correspondence, will be handled through standard email tools and may be stored in our mailboxes and backups in line with normal business practice.
d. Professional advisers, accountants and tax authorities — where strictly necessary to comply with our legal obligations (for example, to issue invoices and submit tax returns under Portuguese law).
e. Public authorities — where we are legally required to disclose information.
We do not use the Website to share personal data with payment processors, shipping carriers, fulfilment partners, scheduling providers, or social-media share-button operators, because the Website does not currently include those features.
## 5. Cookies and analytics
The Website uses cookies and similar technologies — small files placed on your device when you visit a site.
Strictly necessary cookies are always used. These are essential for Squarespace to securely deliver the Website to you (for example, to maintain your session and protect against abuse). They cannot be switched off without breaking core functionality.
Analytics and performance cookies are only used if you accept them through the cookie banner shown on your first visit. These help us understand how visitors find and use the Website (for example, which pages are visited and basic interaction data) so we can improve it. You can withdraw your consent at any time by clearing the cookies in your browser or by re-opening the cookie banner where available.
For details of the cookies Squarespace uses, see Squarespace's cookie information at https://support.squarespace.com.
## 6. International transfers
Some of our service providers (notably Squarespace, Google Fonts and Adobe Fonts) are based in or transfer data to countries outside the European Economic Area, including the United States. Where this happens, we rely on the legal safeguards set out in Chapter V of the GDPR — typically the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework — to ensure your personal data continues to receive an adequate level of protection. You can ask us for a copy of the safeguards in place by emailing info@saltmark.eu.
## 7. How long we keep your personal data
We keep personal data only for as long as we need it for the purpose for which we collected it, or for as long as the law requires. As general guidance:
- Contact-form and enquiry data: kept for up to 24 months from the last contact, unless an engagement results, in which case it becomes part of the client file.
- Client engagement records (correspondence, deliverables, project notes): kept for the duration of the engagement and afterwards for as long as needed to defend or pursue legal claims, generally up to 5 years from the end of the engagement.
- Invoices and accounting records: retained for the period required by Portuguese tax and accounting law (currently 10 years for accounting records).
- Website analytics data: retained according to Squarespace's standard retention periods.
When personal data is no longer needed, we delete or anonymise it.
## 8. Your rights under the GDPR
Subject to the conditions in the GDPR, you have the right to:
- access the personal data we hold about you, and request a copy;
- rectify personal data that is inaccurate or incomplete;
- erase your personal data ("right to be forgotten") in certain circumstances;
- restrict our processing of your personal data in certain circumstances;
- object to processing carried out on the basis of legitimate interests, including profiling;
- data portability — receive personal data you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller, where technically feasible; and
- withdraw consent at any time, where our processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, please email info@saltmark.eu. We may need to verify your identity before responding. We will respond within one month, although that period may be extended by up to two further months for complex or numerous requests.
## 9. Right to complain
If you believe our processing of your personal data infringes the GDPR or Portuguese data protection law, you have the right to lodge a complaint with the Portuguese supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º
1200-651 Lisboa, Portugal
You may also complain to the supervisory authority of the EU member state where you live or work.
## 10. Children
The Website is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
## 11. Security
We take reasonable technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include relying on the security infrastructure of trusted providers such as Squarespace, using strong passwords and access controls, and only sharing data with processors who provide appropriate safeguards. No transmission over the internet is ever fully secure, however, and we cannot guarantee absolute security.
## 12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page shows when the most recent change was made. Where the change is significant, we will take reasonable steps to bring it to your attention before it takes effect.
## 13. Contact
If you have any questions about this Privacy Policy, or you wish to exercise any of your rights, please email info@saltmark.eu.