Privacy Policy

1. Who handles your data

The controller is Telescópio Mágico, Lda, a company trading under the brand Wash Elite Madeira, with its address at Rua do Pombal n.º 31, Bloco A, 6.º B, 9050-075 Funchal, NIF 519611632.

For anything to do with privacy, write to washelitemadeira@gmail.com or call +351 936 824 507.

2. What data we collect

When you request a quote

• Identification and contact: name, phone, email and preferred contact method.
• Where the work is: address, postcode, town and type of property.
• Details of the space: number of rooms, approximate area and any notes you write.
• Photos you choose to attach to the request.
• Preferred dates and time of day.

When you become a client

• Billing details: tax number and billing address, when you ask for an invoice in your name.
• History of services, quotes, invoices and payments.
• Access information you give us (for example, who holds the key or where to park), used solely to carry out the service.

When you write to us on Instagram, Facebook, WhatsApp or email

• The name and username — or phone number — you contact us from.
• The content of the messages you send and of our replies, including photos and attachments.
• The date and time of each message.

Instagram and Facebook messages reach us through Meta's official tools; WhatsApp messages through the company phone. We keep them in our internal app, alongside those from the other channels, so that anyone on the team can see the whole request and answer without having to ask you everything again.

We only receive the messages you send to us. We have no access to the rest of your account, your posts, your other conversations or your contacts.

Technical data

We keep an encrypted, irreversible version of the IP address of whoever submits the form, purely to stop automated submissions and abuse. It cannot be used to identify you. The website uses no tracking cookies and no advertising.

3. On what basis and what for

Purpose	Legal basis (GDPR)
Answering the request, preparing the quote and carrying out the service	Art. 6(1)(b) — pre-contractual steps and performance of the contract
Issuing and keeping invoices and tax documents	Art. 6(1)(c) — compliance with a legal obligation
Receiving, organising and answering the messages you send	Art. 6(1)(b) — pre-contractual steps, at your request
Preventing abuse and automated submissions through the form	Art. 6(1)(f) — legitimate interest in protecting the service
Sending offers and news by email	Art. 6(1)(a) — consent, given separately and revocable

4. How long we keep it

Data	Period
Requests that did not lead to a service	24 months
Message conversations that did not lead to a service	24 months
Photos you sent	12 months after the service is completed
Invoices and tax documents	10 years (legal obligation)
Active clients' data	For as long as the relationship lasts, plus 5 years
Marketing consent	Until you withdraw it

Once those periods end, the data is deleted or irreversibly anonymised.

5. Who we share it with

We never sell or hand over your data. We share it only with the suppliers the service needs in order to work, all bound by a data processing agreement:

• Supabase — hosting of the database and files (servers in the European Union).
• Vercel and Cloudflare — hosting and delivery of the website.
• Resend — sending transactional emails.
• Certified invoicing software — issuing invoices, where applicable.
• Anthropic — an artificial intelligence assistant that summarises conversations and drafts replies for the team. It receives the text of the messages for that purpose only, does not use it to train its models, and processes it outside the European Union with the safeguards the GDPR requires (standard contractual clauses). No reply is sent without being read by someone on the team.

The messages you send us through Instagram, Facebook or WhatsApp also pass through Meta's systems, which handles them under its own privacy policy. Meta is not our processor: it is the controller of its own platforms.

We may also pass data to the Portuguese tax authority and other public bodies, where the law requires it.

6. Security

• All website traffic is encrypted (HTTPS).
• Photos are held in private storage, reachable only through temporary links generated at the time.
• Access to the internal app requires authentication and is limited to the company's partners.
• Access to and changes made to client data are logged.
• We apply the minimisation principle: we only ask for what actually gets used.

7. Your rights

Under the GDPR, you have the right to:

• Access the data we hold about you;
• Rectify incorrect or incomplete data;
• Erase your data, except where the law requires us to keep it (invoicing);
• Restrict or object to certain processing;
• Portability — receive your data in a readable format;
• Withdraw marketing consent at any time, without giving a reason.

To exercise any of these rights, just write to washelitemadeira@gmail.com. We reply within 30 days at most.

If you believe your data is not being handled properly, you can complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD).

8. Minors

Our services are for people over 18. We do not knowingly collect data about minors. If that happens by mistake, we delete it as soon as we become aware.

9. Changes to this policy

If we change this policy, we publish the new version on this page with an updated date. Where the change is significant, we tell active clients by email.