Who processes your data
The data controller is Diagran, Lda., legal person identification no. 510554164, with its registered office at Rua do Outeiro 449, Telões · 4600-755 Amarante · Portugal.
For any questions about this policy or your data, write to comercial@diagran.pt or telephone +351 912 234 087. We will respond in writing.
We have not appointed a data protection officer. For any matter relating to personal data, use the contact details above.
What we collect, and why
You can browse the entire website without identifying yourself. We only collect personal data when you write to us — through the contact form or at the end of the project configurator.
Each line has a single legal basis, not two: what you write to us is processed to respond to your enquiry, not because you ticked a box. The box you tick serves to confirm that you have read this page.
| Data | Where they come from | Purpose | Legal basis |
|---|---|---|---|
| Name, email address, telephone (optional) and country of residence | Written by you in the form | Respond to your enquiry and prepare for the conversation that follows | Pre-contractual steps at your request — Article 6(1)(b) of the GDPR |
| What you tell us: intention, location, project description and timing | Written by you in the form | Understand what you are looking for before responding to you | The same pre-contractual steps |
| The configurator responses and the summary they produce | The choices you make in the configurator | Prepare an initial understanding of your project | The same pre-contractual steps |
| Address of the originating page, browser identification and country inferred from the network | Collected upon submission | Know which page the enquiry came from and respond in the correct language and time zone | Legitimate interest in processing commercial enquiries with context — Article 6(1)(f) |
| Record that you have read this page: which form, which page and at what time | Generated when you click send | Be able to demonstrate that the information was provided to you before collection | Duty to demonstrate compliance — Article 5(2) of the GDPR |
Your IP address
To prevent a robot from filling the form with submissions, we count how many enquiries come from the same place within an hour. This count does not store your IP address: it stores an irreversible fingerprint of it — a truncated cryptographic summary from which the address cannot be recovered.
This fingerprint is deleted after two days. The address itself is never written to the database.
What this site does not do
It is worth stating this in the negative, because it is unusual: as at the date of this update, we measure the pages on this site and a visitor does not contact a single server that is not ours.
- There are no analytics or audience measurement tools.
- There are no advertising, social media or cross-site tracking cookies.
- There are no fonts, maps, videos or buttons loaded from third-party servers.
- We do not build profiles, make automated decisions about you or carry out profiling.
- We do not sell, rent or disclose data to anyone for that third party’s own purposes.
An exception that may arise
The site’s management area allows a page to be illustrated with a photograph or video hosted at another address of ours. The list of what is accepted is short and closed — diaplant.pt, crm.diaplant.pt, dp-crm.code-ahead.com, any address on code-ahead.com and Cloudflare’s r2.dev storage; an address from any other site is rejected by the system.
If this happens, your browser requests that file directly from that server, which then learns your IP address and browser type, as happens with any image on the Internet. We say this here because the possibility exists, even when it is not being used.
Who else handles your data
To function, the site relies on three services, and they are not all the same thing. Cloudflare and Resend process data on our behalf and according to our instructions, under the data processing terms they publish. Telegram is the channel through which the team receives notification that an enquiry has arrived: it receives the minimum indicated in the table and processes it under its own policy — which is why we give it your first name and nothing else.
| Provider | What it does | What data it receives |
|---|---|---|
| Cloudflare | Hosts the site, database and files | Everything you submit, plus the technical data from the connection |
| Resend | Sends an email notification that a new enquiry has arrived | The contents of the notification: name, email, telephone, country and what you wrote |
| Telegram | Sends the team an immediate alert that an enquiry has arrived | First name, country and time only — no email, telephone or text |
Who operates the site
The development and technical operation of the site are handled by Code Ahead, Lda., which acts as Diagran’s processor and has access to the enquiries received in order to forward them and keep the service running.
While the site is in preparation, notifications of new enquiries are also received by this team, to ensure that no enquiry is lost before the site opens to the public.
Where the data is held
The site’s database is hosted in the European Union. The pages are served from Cloudflare’s network, which responds from the point closest to the visitor.
Cloudflare and Resend are North American, and Telegram operates from the United Arab Emirates, so data is transferred outside the European Union. Each relies on the safeguard made available by the service itself — standard contractual clauses approved by the European Commission and, for the North American providers that have joined it, the EU–US Data Privacy Framework.
You may ask us, using the email above, for a copy of or directions to where you can consult the safeguards applicable to each of them.
How long they are kept
The enquiries received are retained for as long as the business conversation arising from them continues and, once that conversation has ended, only for as long as they may be needed as evidence in the event of a dispute. We periodically review older enquiries and delete those that no longer serve any of these purposes.
Technical records have fixed, automatic retention periods, applied by a routine that runs every fifteen minutes: IP address fingerprints are erased after two days; records of rejected submissions after ninety days. The latter retain the reason for rejection, the form type and the country — they do not retain your name, email address, telephone number or the text you wrote.
You may request the erasure of your data at any time, in which case we will erase it, except to the extent that the law requires us to retain it.
Security
Connections to the website are encrypted. Access to the management area is through an individual account, an irreversibly stored password and automatic blocking after consecutive failed attempts.
No measure eliminates the risk completely. If there is a personal data breach, we will notify the CNPD without undue delay and, whenever possible, within seventy-two hours of becoming aware of it; and if it could result in a high risk to you, we will inform you too.
Your rights
You may ask us for access to your data, its rectification, erasure, restriction of processing and portability, and you may object to processing based on legitimate interest.
Where processing is based on consent, you may withdraw it at any time — which does not affect what was lawfully done before then.
Simply write to comercial@diagran.pt. We may need to verify your identity before responding, so that we do not give one person's data to someone else.
If you think we have mishandled your data
Tell us first: it is quicker and gives us a chance to put things right. If you still consider that the processing breaches the law, you may lodge a complaint with the supervisory authority.
Changes to this policy
If we change what we do with the data, this page will change first — never afterwards — and the date at the top will become the date of the change.