Pedro Ganço

Last updated: 15 September 2026

Privacy Policy

This policy explains what personal data we collect when you exchange WhatsApp messages with +351 913 851 981 or sign up through one of our forms, why we collect it, who we share it with, and the rights you have under the GDPR.

1. Who is responsible for your data

The controller is Joana Joaquim & Pedro Ganço, Lda., NIPC 517705770, Rua Manuel Gomes André, 2080-121 Almeirim, Portugal. For anything in this policy, write to pedro@pedroganco.com. We have not appointed a data protection officer, as we are not required to.

2. What we collect

  • Contact details: your WhatsApp phone number, your name, and your email address.
  • Consent records: when and how you agreed to be contacted, and any opt-out you send us.
  • Sales funnel data: the form or page you came from, which of our content you asked for, and what you bought.
  • Delivery metadata: timestamps and delivery or read status returned by WhatsApp.
  • Billing data: for purchases, the invoicing details required by Portuguese tax law.

We do not keep an archive of your conversation content on our own systems. Message content is processed through WhatsApp, under Meta's own privacy terms.

3. Why we use it, and on what legal basis

  • Replying to you and handling your requests. Legal basis: performance of a contract or steps taken at your request, Article 6(1)(b) GDPR.
  • Sending information, content and offers about our products. Legal basis: your consent, Article 6(1)(a) GDPR. You can withdraw it at any time.
  • Delivering and supporting products you bought. Legal basis: performance of a contract, Article 6(1)(b) GDPR.
  • Keeping invoicing and accounting records. Legal basis: legal obligation, Article 6(1)(c) GDPR.
  • Keeping the service secure and proving consent if challenged. Legal basis: our legitimate interest, Article 6(1)(f) GDPR.

4. Who else processes your data

We use the following providers, each bound by a data processing agreement:

  • Meta Platforms Ireland Ltd. for WhatsApp message delivery through the Cloud API.
  • Hetzner Online GmbH (Germany) for hosting our servers and databases.
  • Anthropic PBC and OpenAI, where an AI model helps draft, translate or classify a message. Providers are instructed not to train their models on this data.
  • Resend for email delivery, where we email you.

We do not sell your personal data and we do not share it with advertisers. We may disclose it to our accountant, or to a public authority, where the law requires it.

5. Transfers outside the European Economic Area

Some of the providers above are established in the United States or may process data there. Those transfers rely on the European Commission's Standard Contractual Clauses, on the EU-US Data Privacy Framework where the provider is certified, or on both, together with additional technical measures such as encryption in transit.

6. How long we keep it

  • Contact and funnel data: while your consent stands, and for up to 24 months after your last interaction with us, after which it is deleted.
  • Consent and opt-out records: for 5 years after the relationship ends, so we can prove we handled your choice correctly.
  • Invoices and accounting records: 10 years, as required by Portuguese tax law.

7. Your rights

Under the GDPR you may ask us to:

  • confirm what data we hold about you and give you a copy;
  • correct data that is wrong or incomplete;
  • delete your data, see our data deletion page;
  • restrict or object to how we use it;
  • send you or another provider a portable copy;
  • withdraw a consent you gave, without affecting what we did before you withdrew it.

Write to pedro@pedroganco.com. We answer within 30 days. If you are not satisfied, you may complain to the Portuguese supervisory authority, CNPD (cnpd.pt), or to the authority where you live.

8. Automated decisions and AI

We do not make decisions with legal or similarly significant effects about you by automated means. Where an AI model helps draft, translate or classify a message, the outcome is reviewed by a person before it reaches you.

9. Children

The service is not directed at people under 16. If you believe we hold data about a child, write to us and we will delete it.

10. Cookies

This website is static and sets no analytics, advertising or tracking cookies. Your language choice is stored locally in your browser and never leaves your device.

11. Changes to this policy

We may update this policy. The date at the top of this page always shows the last revision. Where a change materially affects you and we have a way to reach you, we will tell you.