Data protection & privacy.
Last updated: 3 November 2026.
This policy explains how ALMA handles personal data on the alma.dev website and in its business (enquiries, clients, suppliers), and is the default policy for ALMA products that do not have one of their own.
1. Who is responsible
The controller is Albuquerque de Matos, Unipessoal, Lda (ALMA), NIPC 516746596, Rua Canto da Maya 1, 8.º, 1070-372 Lisboa, Portugal. For any privacy matter, write to legal@alma.dev. ALMA has not appointed a data protection officer.
We process personal data under the General Data Protection Regulation (GDPR) and Portuguese law (Lei n.º 58/2019).
2. Which policy applies
- Products with a policy of their own are governed by it, and this policy applies only to what it does not cover: Hub, Notch Cleaner and Hard Refresh.
- Lex has its own complete policy, which applies to Lex instead of this one: the Política de Privacidade do Lex (binding Portuguese text) and its English translation.
- Where we process personal data on behalf of a client (for example in a system we build or run for them), the client is the controller and our written agreement with them governs that processing.
3. What we process, why, and for how long
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Answering your enquiries and support requests | Name, email, phone, company and what you write to us | Steps you ask for before a contract, or the contract (Article 6(1)(b)); otherwise our legitimate interest in answering you (point (f)) | As long as needed to deal with the request and its follow-up; then deleted, unless it leads to a contract |
| Providing our services and products to clients, and managing suppliers | Contact details of the people we deal with, the contract and what we need to perform it | The contract (point (b)); for the people representing a client or supplier, our legitimate interest in working with that organisation (point (f)) | For the duration of the contract, then as long as claims relating to it can be brought |
| Invoicing, accounting and tax | Identification, tax number, invoices and payments | Legal obligation (point (c)) | The period required by law, generally 10 years |
| Transactional messages over WhatsApp, where a product offers them and you ask for them (verification codes, confirmations, order notices, support replies; never marketing) | Phone number, message content and times | The service you asked for (point (b)) | As long as needed for the message's purpose |
| News about our products and services | Name and email | Your consent (point (a)); for clients, about services like the ones they bought, our legitimate interest, with a way to opt out in every message (Lei n.º 41/2004, Article 13-A) | Until you withdraw consent or opt out |
| Running and securing the website | IP address and technical data of each request, in our hosting provider's logs | Our legitimate interest in a working, secure website (point (f)) | The short periods set by the hosting provider for its logs |
| Establishing, exercising or defending legal claims, and complying with orders of authorities | The data relevant to the matter | Legal obligation (point (c)) or our legitimate interest (point (f)) | Until the matter is closed and the time to bring claims has passed |
You do not have to give us personal data, but without it we may not be able to answer you or work with you. We do not take decisions about you based solely on automated processing, and we do not sell personal data.
4. Data you give us about other people
If you give us personal data about other people (for example colleagues to copy into a project), you must be entitled to share it with us and you should tell them, pointing them to this policy.
5. Who receives the data
- Service providers who process data on our behalf, under contracts that bind them to the GDPR: our hosting provider, Cloudflare, Inc.; and, for WhatsApp messages, Meta, which provides WhatsApp.
- Software makers, when we register a software product or licence in a client's name.
- Professional advisers (lawyers, accountants, auditors), bound by professional secrecy.
- Authorities, when the law requires it.
6. Transfers outside the European Economic Area
Some of these recipients, or their providers, are in the United States. We only transfer data there with a safeguard the GDPR recognises: the European Commission's adequacy decision for the EU-US Data Privacy Framework, for recipients that participate in it, or the European Commission's standard contractual clauses. You can ask us for a copy of the safeguard at legal@alma.dev.
7. Security
We protect personal data with appropriate technical and organisational measures that follow recognised good practice and are proportionate to the risk (GDPR Article 32), for example encrypted connections, access limited to the people who need it, and service providers bound to the same duties. No method of transmission or storage is completely secure, so we cannot guarantee that a breach will never happen. If a personal data breach occurs, we notify the CNPD as the law requires and, where it is likely to result in a high risk to your rights, we tell you.
You can help: do not send us passwords or more personal data than a request needs, and tell us at once if you think a message from us is not genuine.
8. Your rights
You can ask us to access, correct or delete your data, to restrict its processing, to receive the data you gave us in a portable format, and you can object to processing based on our legitimate interest (always, for marketing). Where processing is based on consent, you can withdraw it at any time, without affecting what was done before. Write to legal@alma.dev; we answer within one month, which the law allows us to extend in complex cases.
You can also complain to the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt, or to the authority of the Member State where you live or work.
9. Cookies and local storage
The alma.dev website sets no cookies of its own and uses no analytics or advertising tools. It keeps your light or dark theme choice in your browser's local storage, which you can clear at any time. Our hosting provider, Cloudflare, may set a strictly necessary security cookie if it has to check that a visit is not automated.
10. Children
The website and our business services are not directed at children, and we do not knowingly collect their data.
11. Changes to this policy
We may update this policy to reflect changes in our practices or in the law. The date at the top of this page shows the version in force. If a change is significant and we have your email, we also tell you before it takes effect.
12. Contact
Albuquerque de Matos, Unipessoal, Lda
Rua Canto da Maya 1, 8.º, 1070-372 Lisboa, Portugal
Privacy and legal matters: legal@alma.dev