# Verixian Privacy Policy

> How Verixian (Gonçalo Veríssimo Unipessoal LDA) processes personal data on verixian.com and in the Verixian News newsletter, under the EU GDPR.

Source page: https://www.verixian.com/privacy

Last updated: May 22, 2026

Verixian respects your privacy and complies with the EU General Data Protection Regulation (GDPR: Regulation EU 2016/679). This policy describes what personal data we process on verixian.com and in the Verixian News newsletter service, and how we do it.

## 1. Who we are

- Entity (data controller): Gonçalo Veríssimo Unipessoal LDA, operating as Verixian.
- Email: geral@verixian.com
- Address: Av. Duque de Loulé 12, 1050-093 Lisbon, Portugal

## 2. What data we collect and why

We only collect what is strictly necessary for each purpose.

### 2.1 Contact form

When you submit the contact form: name, email, company, phone, interest and message. This data is delivered through Formspree, which forwards your message to our email. Purpose: to reply to your request.

### 2.2 Verixian News newsletter subscription

When you subscribe to the newsletter we collect:

- Email (required): to send you the newsletter;
- Name (optional): to personalize the communication;
- Topic and area preferences (optional): to select the content you receive;
- Dates of subscription, confirmation and cancellation, and delivery metrics (delivered, bounced, complaint): generated by the system or received from the email provider;
- Open and click metrics: only if you consent separately; this tracking is off by default.

Subscription uses double opt-in: after you submit your email you receive a confirmation message and are only subscribed once you click the link. As proof of consent (GDPR Art. 7) we record the date, the version of this policy, the browser user-agent, and your IP address in pseudonymized form (SHA-256 hash, never in clear text).

### 2.3 Bot protection: Cloudflare Turnstile

The subscription form is protected by Cloudflare Turnstile, an anti-bot system. To verify that the request comes from a person and not an automated program, Turnstile processes your IP address and technical browser signals. It is a privacy-first CAPTCHA: it does not use cookies for advertising or to track you across sites. To work it sets a technical security cookie (cf.turnstile.u) that is strictly necessary and exempt from consent under art. 5(3) of the ePrivacy Directive. It loads only once you start interacting with the form, not on a bare page view. Purpose: to protect the service against abuse (for example, automated sign-ups and misuse of email sending). Legal basis: legitimate interest in the security of the service (art. 6(1)(f) GDPR).

### 2.4 Data collected automatically

The tools below are only activated after you accept analytics cookies in the consent banner (see section 8). If you decline, they are not loaded and write no cookies.

- Google Analytics (GA4): pages visited, time on site, device, country and traffic source. Your IP address is used by Google to approximate geographic location and is not logged or retained by us; GA4 does not store the IP address in its reports. (GA4 has no configurable "IP anonymization" toggle: unlike the legacy Universal Analytics.)
- Meta Analytics (Meta Pixel): aggregated visit and conversion events for performance measurement. We do not build advertising profiles.

We do not use remarketing cookies and we do not share your data for advertising purposes.

## 3. Legal bases

- Consent (art. 6(1)(a) GDPR): newsletter subscription; analytics cookies.
- Separate consent (art. 6(1)(a) + ePrivacy Directive art. 5(3)): tracking of email opens and clicks: optional, can be refused without losing the newsletter, and revocable at any time.
- Pre-contractual measures (art. 6(1)(b)): to reply to the request you sent through the contact form.
- Legitimate interest (art. 6(1)(f)): operation and security of the website, including the anti-bot protection of the subscription form.

## 4. Sub-processors and third parties

Your data may be processed by the following providers, each only to the extent of its respective purpose:

- Formspree (We Are Solid LLC, USA): contact form submissions.
- Mailgun (Sinch): delivery of the Verixian News newsletter. Processes data in the European Union region.
- Cloudflare, Inc.: anti-bot protection of the subscription form (Turnstile) and protection and delivery of the service infrastructure. Processes IP addresses and technical request metadata.
- Vercel Inc.: hosting and delivery (CDN) of the verixian.com website. Processes HTTP requests and their technical metadata (including the IP address) in order to serve the site.
- Google Analytics (Google Ireland Limited / Google LLC): website analytics.
- Meta Platforms Ireland Limited: performance measurement pixel.

All process data under data processing agreements and, where applicable, the EU Standard Contractual Clauses. Your data is not sold or shared with third parties for marketing purposes.

## 5. International transfers

Newsletter emails are processed by Mailgun in the EU region. The other providers (Formspree, Cloudflare, Vercel, Google, Meta) may process data outside the European Economic Area; in those cases, processing is covered by the European Commission's Standard Contractual Clauses and the additional safeguards of the respective providers.

## 6. Retention periods

- Contact form submissions: up to 12 months after the last meaningful contact, unless required otherwise by law.
- Newsletter subscriber data: while the subscription is active.
- Never-confirmed subscriptions: deleted after 30 days.
- Cancelled subscribers: anonymized after 365 days.
- Technical send history: 60 days. Backups: 14-day rotation.
- Consent events: kept as proof of compliance.
- Google Analytics: user data retained for up to 14 months.

## 7. Your rights

Under the GDPR you have the right to access, rectify, erase (right to be forgotten), restrict or object to processing, to data portability, and to withdraw consent at any time, without affecting the lawfulness of prior processing.

- Newsletter: self-service: every email includes footer links to change topics and unsubscribe.
- Data access, export or erasure: contact geral@verixian.com and we will handle your request.

You may also lodge a complaint with the supervisory authority: the Portuguese DPA (CNPD, www.cnpd.pt).

## 8. Cookies and consent

- Essential cookies: required for basic site operation, including a first-party cookie that stores your consent choice so we do not ask again on every visit.
- Analytics cookies (Google Analytics, Meta Pixel): loaded only if you accept.

On your first visit we show a consent banner with two equally accessible options, "Accept" and "Reject". Until you choose, or if you reject, no analytics or measurement cookies are written and both Google Analytics and the Meta Pixel stay disabled (consent state defaults to "denied": Google Consent Mode v2). Only when you click "Accept" can these tools start working.

Your choice is stored in a first-party cookie for about 6 months. You can change or withdraw your consent at any time: clear this site's cookies in your browser settings and, on your next visit, the banner reappears so you can choose again.

Cloudflare Turnstile sets a technical security cookie (cf.turnstile.u) that is strictly necessary for the form's anti-bot protection and exempt from consent; it is not used for advertising or to track you across sites, and it loads only once you start using the subscription form. You can manage cookies at any time in your browser settings.

## 9. Security

Encrypted communications (HTTPS) and security headers. Restricted access to data. IP addresses pseudonymized and personal data masked in technical logs. Sub-processors operate with recognized security certifications.

## 10. Changes

We may update this policy to reflect legal or operational changes. The version in force is the one shown at the top of this page; material changes affecting subscribers will be communicated by email.

## 11. Contact

- Verixian, Privacy
- Gonçalo Veríssimo Unipessoal LDA
- Email: geral@verixian.com
- Address: Av. Duque de Loulé 12, 1050-093 Lisbon, Portugal