Privacy policy.

Data controller

The controller of your personal data is Hidrostation – Comércio de Equipamentos, Lda., tax number (NIPC) 516436643, with its registered office at R. Central de Ardegães 289, 4425-046 Águas Santas, Portugal.

For any question about personal data, or to exercise your rights, write to hidrostation@hidrostation.pt.

What data we process

We only process the data we need:

• Quotation requests and enquiries — name, company, email, phone number and the content of your message. The website form does not send or store anything: it opens your email program with the message filled in, and we only receive the data when you send it.
• Business relationship — if you become a customer, the billing, delivery and contact details needed for the quotation, the order and after-sales support.
• Usage statistics — only if you accept statistics cookies: pages visited, visit duration, device and browser type and approximate location, collected by Google Analytics with a random identifier.
• Technical logs — for security and operational reasons, the server hosting the website logs the IP address, the date and time and the page requested.

We do not process special categories of data or make automated decisions based on your data.

Why we use your data and on what legal basis

• Answering your request and preparing a quotation — pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
• Fulfilling orders and providing support — performance of a contract (Article 6(1)(b)).
• Complying with legal obligations, such as tax and accounting obligations — legal obligation (Article 6(1)(c)).
• Measuring website usage — your consent (Article 6(1)(a)), which you may withdraw at any time.
• Keeping the website secure — Hidrostation’s legitimate interest (Article 6(1)(f)).

We do not use your data for advertising and we do not sell it. We only send you marketing communications if you ask for them or if you are already a customer, and you can opt out at any time.

How long we keep it

• Quotation requests not followed up — up to 3 years after the last contact.
• Customers — for as long as the business relationship lasts and, afterwards, for the statutory periods; accounting and tax records are kept for 10 years.
• Statistics — Google Analytics data is deleted after 14 months; the cookies expire after 2 years, or earlier if you withdraw your consent.
• Technical logs — for the period set by the hosting provider, usually a few days.

Who receives your data

Your data is not disclosed to third parties for their own purposes. We use service providers that process it on our behalf, under contract and with appropriate safeguards:

• Website hosting — Railway Corp.
• Statistics — Google Ireland Limited (Google Analytics), only with your consent. See Google’s privacy policy.
• Email — the provider of our email service.

We may also disclose data to the authorities where required by law.

Transfers outside the European Economic Area

Some of these providers, or companies in their groups, are located in the United States. In those cases, the transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for certified companies, or on standard contractual clauses approved by the Commission.

Your rights

Under the GDPR, you may at any time:

• access your data and obtain a copy;
• ask for inaccurate or incomplete data to be rectified;
• ask for your data to be erased, where it is no longer needed or the processing has no legal basis;
• ask for the processing to be restricted;
• object to processing based on legitimate interest;
• receive the data you provided to us in a structured, commonly used format (portability);
• withdraw your consent, without affecting the processing carried out before then.

To exercise any of these rights, write to hidrostation@hidrostation.pt. We reply within one month, and exercising your rights is free of charge.

Complaints

If you believe your data is not being processed lawfully, you may lodge a complaint with the Comissão Nacional de Protecção de Dados (www.cnpd.pt), the Portuguese supervisory authority, or with the supervisory authority of the Member State where you live or work — in Spain, the Agencia Española de Protección de Datos (www.aepd.es).

Security

The website is served exclusively over HTTPS. We apply appropriate technical and organisational measures to protect data against loss, unauthorised access or disclosure.

Changes to this policy

We may update this policy to reflect legal changes or changes to the website. The date of the last update is shown at the top of the page.