Legal
Privacy Policy
Last updated: 5 August 2026
This Privacy Policy explains how Maria João Abrantes (“I”, “me”) collects, uses, and protects your personal data when you visit mariajoaoabrantes.work (the “site”) or get in touch. I am the data controller for the purposes of the EU General Data Protection Regulation (GDPR) and Portuguese data protection law.
If you have any questions, you can reach me at info@mariajoaoabrantes.work.
What data I collect
Information you give me
When you email me or book a call, I receive the details you choose to share — typically your name, email address, and the contents of your message or booking (for example, what you’d like to discuss).
Information collected automatically
Like virtually all websites, my hosting provider records basic technical information needed to serve and secure the site, such as your IP address, browser type, and the pages requested. I also use privacy-friendly, cookieless analytics (Vercel Web Analytics and Speed Insights) to understand aggregate traffic and real-world site performance. These do not set cookies, do not track you across other sites, and do not build a profile of you.
With your consent, I also use Google Analyticsto understand how visitors navigate the site — which pages get read, which case studies get opened, and whether visits lead to a booked call. Google Analytics only runs, and only sets cookies, if you click “Accept” on the cookie banner. You can withdraw consent at any time via “Cookie Preferences” in the footer. This site uses no advertising or marketing trackers.
How I use your data
- To respond to your enquiries and correspond with you.
- To schedule and hold calls you book.
- To operate, maintain, and secure the site.
Legal bases
I process your data on the basis of: your consent and/or steps taken at your request prior to entering into a contract (when you contact me or book a call), and my legitimate interests in running a secure, functional website (Article 6(1)(a), (b) and (f) GDPR).
Third-party services
I rely on a small number of trusted providers who act as data processors. Each has its own privacy practices:
- Cal.com — powers the booking calendar on the Contact page. If you schedule a call, the details you enter are processed by Cal.com to manage the appointment. Cal.com privacy policy.
- Vercel — hosts the site, provides the privacy-friendly cookieless analytics described above, and processes the technical log data. Vercel privacy policy.
- Google Analytics — if you accept the cookie banner, Google processes your browsing activity on this site (pages viewed, case studies opened, buttons clicked) to generate traffic and engagement reports. Data may be processed outside the EEA. Google privacy policy.
- LinkedIn — if you follow the LinkedIn link in the footer, LinkedIn processes your data under its own policy. I do not embed LinkedIn tracking on this site.
Cookies
Some cookies are set automatically, regardless of your choice, because they’re strictly necessary to run a service you’ve actively requested: functional cookies from the Cal.com booking widget on the Contact page (for example, to keep your place in the calendar and complete a booking). Fonts are self-hosted, so no data is shared with third-party font services when you browse.
Beyond that, this site sets no cookies unless you say yes. On your first visit, a banner asks whether you consent to Google Analytics cookies: _ga, which identifies your browser as a returning visitor, and _ga_*, which tracks your current session (pages viewed, time on site). Both persist for up to 2 years. If you decline, or don’t respond, neither is set and no analytics data is collected. You can change your decision at any time via “Cookie Preferences” in the footer.
International transfers
Some providers (such as Cal.com, Vercel, and, if you consent to it, Google Analytics) may process data outside the European Economic Area, including in the United States. Where that happens, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Data retention
I keep emails and booking correspondence only for as long as needed to respond to you and manage our working relationship, after which they are deleted. Technical server logs are retained for a limited period by the hosting provider for security and diagnostics. If you consent to Google Analytics, Google retains event-level analytics data for a limited period (up to 14 months) before automatically deleting it, per Google’s own retention settings.
Your rights
Under the GDPR you have the right to:
- access the personal data I hold about you;
- have inaccurate data corrected;
- request deletion of your data;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time.
To exercise any of these, email info@mariajoaoabrantes.work. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).
Data security
The site is served over encrypted HTTPS connections, and I take reasonable technical and organisational measures to protect your data. No method of transmission over the internet is completely secure, but I work to keep your information safe.
Changes to this policy
I may update this policy from time to time. The “last updated” date above reflects the most recent revision.