Privacy Policy

1. Data Controller

The data controller is Sandra Marques, based in Lisbon, Portugal.

Email: smarques@sandra-marques.com

2. Personal data collected

This website does not include a contact form, newsletter form, user account area, payment area, analytics tool, or advertising tracker.

Personal data may be processed when you contact Sandra Marques directly by email, phone, LinkedIn, or another channel. Depending on the contact, this may include your name, email address, phone number, organisation, role, message content, and any information you choose to share.

Basic technical data may also be processed by the hosting provider for security and operational purposes, such as IP address, date and time of access, browser information, and pages requested.

3. Purposes of processing

Personal data is processed only where relevant for the following purposes:

• Responding to enquiries and professional requests.
• Preparing, managing, or following up on a possible professional collaboration.
• Maintaining basic business communication records.
• Complying with legal, tax, accounting, or administrative obligations where applicable.
• Maintaining website security and preventing misuse.

4. Legal basis

The legal basis for processing may include:

• Your consent, when you voluntarily contact Sandra Marques or send information.
• Pre-contractual steps, when communication relates to a possible project, proposal, or collaboration.
• Legitimate interest, for ordinary professional communication, relationship management, and website security.
• Legal obligations, where retention or processing is required for accounting, tax, legal, or administrative reasons.

5. Data sharing

Personal data is not sold. Data may be shared only when necessary with trusted service providers, such as hosting, email, IT, accounting, or legal support providers, and only to the extent required for the relevant service or obligation.

This website includes links to external websites, including LinkedIn and partner websites. Those websites are independent and have their own privacy and cookie practices.

6. International transfers

If any service provider processes data outside the European Economic Area, appropriate safeguards should apply under the GDPR, where required. This may include standard contractual clauses or equivalent lawful mechanisms.

7. Retention

Enquiry and professional communication data is kept only for as long as necessary for the purpose for which it was collected. As a working reference, non-contractual enquiries may be kept for up to 24 months after the last meaningful interaction, unless earlier deletion is requested or longer retention is justified.

If a professional relationship becomes contractual, some data may need to be retained for longer to comply with legal, tax, accounting, or contractual obligations.

Hosting logs, if collected by the provider, are normally kept for limited security and operational periods according to the provider's own policies.

8. Your rights

Under the GDPR, you may have the right to request access to your personal data, rectification, erasure, restriction of processing, objection to processing, data portability, and withdrawal of consent where processing is based on consent.

To exercise your rights, contact: smarques@sandra-marques.com.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).

9. Security

Reasonable technical and organisational measures are used to protect personal data against unauthorised access, disclosure, alteration, or loss. No website or email communication can be guaranteed to be completely secure.

10. Updates

This policy may be updated to reflect changes to the website, services, or legal requirements.

Last updated: 5 June 2026.