Actualizado a 28 July 2026
Privacy Policy
This policy describes how Quina Ribeiro, Lda — the entity behind the QRA website — collects, uses and protects your personal data.
Data controller
- Legal name: Quina Ribeiro, Lda
- Portuguese VAT ID (NIPC): 515 230 111
- Address: Rua da Liberdade 2D, 2550-538 Vermelha, Portugal
- Email: privacidade@qra.pt
- Phone: +351 262 186 260
- Website: https://qra.pt
Data we collect
Data you give us directly
- AI Calculator form — name, email and WhatsApp so we can send you the estimate.
- Quiz — your answers and, at the end, contact details (email/phone) if you request follow-up.
- AI Radar (booking via TidyCal) — TidyCal, as an external provider, collects your name, email and chosen slot. QRA receives that data once the booking is confirmed.
Data collected automatically
- Technical data — IP address, browser user-agent, visited pages, referrer. Used for security and diagnostics.
- Analytics data — with your consent, Google Analytics 4 collects aggregate behaviour on the site (page views, time on page, events).
- Marketing data — with your consent, Meta Pixel, Google Ads and LinkedIn Insight collect interactions that let us measure campaigns and show you relevant content after your visit.
Purposes
- Answer requests — send the calculator estimate, the quiz result, or confirm the AI Radar booking.
- Provide services — when we move to a proposal or engagement, process data necessary to perform the contract.
- Measure and improve — aggregate traffic analysis to learn which content is useful (with consent only).
- Marketing — measure Google Ads, Meta Ads and LinkedIn Ads campaigns, and re-contact visitors with relevant ads (with consent only).
- Legal obligations — comply with tax and other legal duties.
Legal basis
- Consent (Art. 6(1)(a) GDPR) — for analytics and marketing cookies and for unsolicited communications.
- Pre-contractual steps (Art. 6(1)(b)) — to handle your request via the calculator, quiz or AI Radar booking.
- Contract performance (Art. 6(1)(b)) — when you become a QRA client.
- Legitimate interest (Art. 6(1)(f)) — for site security, fraud prevention and service improvement with aggregate data.
- Legal obligation (Art. 6(1)(c)) — to meet tax and other legal duties.
Who processes your data on our behalf
We do not sell, rent or trade personal data. However, to provide the service we contract processors who handle data on our behalf under a Data Processing Agreement (Art. 28 GDPR):
- Hosting — the site runs on a cPanel host in the European Union.
- TidyCal (AI Radar bookings) — United States, under the EU-U.S. Data Privacy Framework.
- Google Ireland Ltd. (Google Analytics 4, Google Ads) — data may be transferred to the United States under the EU-U.S. Data Privacy Framework.
- Meta Platforms Ireland Ltd. (Meta Pixel) — data may be transferred to the United States under the EU-U.S. Data Privacy Framework.
- LinkedIn Ireland Unlimited Co. (LinkedIn Insight Tag) — data may be transferred to the United States under the EU-U.S. Data Privacy Framework.
We may also share data when required by law or court order, or to protect QRA’s legitimate rights in legal proceedings.
International transfers
Whenever a provider above processes data outside the European Economic Area — especially in the United States — the transfer relies on the EU-U.S. Data Privacy Framework adequacy decision (10 July 2023) or, in the alternative, on Standard Contractual Clauses approved by the European Commission.
Retention
We keep your data only as long as necessary for the purpose:
- Contact data — up to 5 years after the last interaction.
- Contract data — 10 years, to meet tax obligations.
- Newsletter (if subscribed) — until you unsubscribe.
- Analytics data (GA4) — 14 months (GA4 retention setting).
- Cookies — see concrete durations in the Cookie Policy.
Your rights
Under the GDPR you have the right to:
- Access — get confirmation of processing and a copy of your data.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion when no longer necessary.
- Restriction — restrict processing in specific circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interest.
- Withdraw consent — at any time, without affecting the lawfulness of prior processing. For cookies, use Cookie settings in the footer.
To exercise any of these rights, email privacidade@qra.pt or write to the address above. We respond within 30 days; complex cases may be extended by 60 days with prior notice.
Security
We apply reasonable technical and organisational measures to protect your data: HTTPS/TLS on every connection, restricted access to internal systems, regular backups and ongoing training. No measure is 100 % foolproof, but we commit to notifying you of any personal data breach affecting you, as required by the GDPR.
Supervisory authority
If you believe your data protection rights have been violated, you may lodge a complaint with the Portuguese supervisory authority:
- Comissão Nacional de Protecção de Dados (CNPD)
- Website: www.cnpd.pt
- Email: geral@cnpd.pt
- Phone: +351 213 928 400
You may also contact your own country’s supervisory authority.
Changes to this policy
We may update this policy whenever the law, the providers used or the site operation require. Changes take effect on publication. We recommend checking this page regularly; the date at the top shows the last update.