Privacy Policy

1. An overview of data protection

General information

The following information gives you an easy to navigate overview of what happens to your personal data when you visit this website. The term “personal data” covers all data that can be used to identify you personally. Detailed information follows in the sections below.

Who is responsible for the recording of data on this website (the “controller”)?

The data on this website is processed by the operator of the website, whose contact details are available in the section “Information about the controller” of this Privacy Policy.

How do we record your data?

We collect your data when you share it with us, for instance the information you enter into our contact form.

Other data is recorded automatically by our IT systems, or after you give your consent, when you visit the website. This is mainly technical information (e.g., web browser, operating system or time of access).

What do we use your data for?

Part of the data is needed to provide the website without errors. Other data may be used, with your consent, to analyse how visitors use the website. If you contact us, we use your data to answer your request.

What rights do you have regarding your data?

You have the right to receive information about the source, recipients and purposes of your stored personal data at any time and free of charge. You also have the right to ask for your data to be corrected or deleted. If you have given consent to data processing, you can withdraw it at any time, with effect for the future. You also have the right to ask for the processing of your data to be restricted in certain circumstances, and the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time if you have questions about this or any other data protection issue.

2. Hosting, content delivery and backups

Hosting

This website is hosted by webserver.pt, a hosting provider based in Portugal. Personal data collected on this website is stored on the provider’s servers. This may include IP addresses, contact requests, metadata and communications, contact details, names, page views and other data generated through the website. The same provider runs the mail server used to send e-mails from the website.

The hosting serves the secure, fast and efficient provision of our website by a professional provider (Art. 6(1)(f) GDPR) and, where relevant, the handling of requests from current and potential customers (Art. 6(1)(b) GDPR). The provider only processes your data to the extent necessary to fulfil its obligations and following our instructions.

Cloudflare

We use the content delivery network and security service Cloudflare. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). All requests to this website, including your IP address and the technical data your browser sends, pass through Cloudflare’s servers before they reach our host. Cloudflare uses this data to deliver the website quickly and to protect it against attacks and abuse.

The use of Cloudflare is based on our legitimate interest in providing the website as securely and efficiently as possible (Art. 6(1)(f) GDPR). Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework (DPF), and the transfer is also covered by the Standard Contractual Clauses of the European Commission. More information: https://www.cloudflare.com/privacypolicy/.

Backups with UpdraftPlus

We use the WordPress plugin UpdraftPlus to make regular backups of this website (files and database). The backups are stored in our Dropbox account. The storage provider is Dropbox International Unlimited Company, One Park Place, Floor 5, Upper Hatch Street, Dublin 2, Ireland. The backups may contain personal data stored on the website, for instance messages sent through the contact form, if they are kept in the database.

Backups are made on the basis of our legitimate interest in being able to restore the website after a technical failure, an attack or an error (Art. 6(1)(f) GDPR). Older backups are deleted automatically and replaced by newer ones. Dropbox may process data in the USA. Dropbox is certified under the EU-US Data Privacy Framework (DPF), and the transfer is also covered by the Standard Contractual Clauses of the European Commission. More information: https://www.dropbox.com/privacy.

Data processing agreements

Where required by law, we have concluded or will conclude data processing agreements with the providers listed above, so that they process the personal data of our visitors only according to our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data protection

We take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with the statutory data protection regulations and this Privacy Policy.

Please note that the transmission of data over the Internet (e.g., by e-mail) may have security gaps. It is not possible to fully protect data against access by third parties.

Information about the controller

The controller responsible for data processing on this website is:

DRAGONS & ELEPHANTS, UNIPESSOAL, LDA, Quinta do Coito Grande, 7630-291 Colos, Portugal

Phone: +351961327520, E-mail: [email protected]

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g., names, e-mail addresses).

Storage duration

Unless a more specific storage period is stated in this Privacy Policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you make a justified request for deletion or withdraw your consent, your data will be deleted, unless we have other legally permitted reasons to keep it (e.g., tax or commercial retention periods). In that case, the data will be deleted once those reasons no longer apply.

Legal basis for the processing of data on this website

If you have given your consent, we process your personal data on the basis of Art. 6(1)(a) GDPR. If you have consented to the storage of cookies or to the access to information on your device, the processing is also based on Art. 5 of Portuguese Law no. 41/2004. You can withdraw your consent at any time. If your data is required to perform a contract or to take steps before entering into a contract, we process it on the basis of Art. 6(1)(b) GDPR. If your data is required to fulfil a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. The relevant legal basis in each case is given in the sections of this Privacy Policy.

Recipients of personal data

We only share personal data with external parties when this is necessary to perform a contract, when we are legally required to do so (e.g., disclosure to tax authorities), when we have a legitimate interest under Art. 6(1)(f) GDPR, or when another legal basis allows it. When we use processors, we only share personal data on the basis of a valid data processing agreement.

Withdrawal of your consent

Many data processing operations are only possible with your express consent. You can withdraw any consent you have given at any time. This does not affect the lawfulness of the processing carried out before the withdrawal.

Right to object (Art. 21 GDPR)

IF DATA IS PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR DATA FOR THAT PURPOSE, INCLUDING PROFILING RELATED TO SUCH MARKETING. IF YOU OBJECT, YOUR DATA WILL NO LONGER BE USED FOR DIRECT MARKETING (ART. 21(2) GDPR).

Right to lodge a complaint with a supervisory authority

If the GDPR is breached, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged breach. In Portugal, the competent supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. This right exists regardless of any other administrative or judicial remedies.

Right to data portability

You have the right to receive the data that we process automatically on the basis of your consent or to perform a contract, or to have it transferred to a third party, in a common, machine-readable format. A direct transfer to another controller will only be made where technically feasible.

Access, correction and deletion

Within the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing, and, where applicable, the right to have this data corrected or deleted. You can contact us at any time about this or any other question about personal data.

Right to restriction of processing

You have the right to ask for the processing of your personal data to be restricted. You can contact us about this at any time. This right applies in the following cases:

  • If you dispute the accuracy of the personal data we hold, for the time we need to check it.
  • If the processing of your personal data was or is unlawful, you can ask for restriction instead of deletion.
  • If we no longer need your personal data but you need it to establish, exercise or defend legal claims, you can ask for restriction instead of deletion.
  • If you have objected under Art. 21(1) GDPR, while it has not yet been determined whose interests prevail.

If the processing of your personal data has been restricted, this data, apart from being stored, may only be processed with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as the requests you send us, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in the address bar of your browser and by the lock icon. When encryption is active, the data you send us cannot be read by third parties.

Rejection of unsolicited e-mails

We object to the use of the contact details published in our Site Notice for sending advertising and information material that we have not expressly requested. We reserve the right to take legal action in the event of unsolicited advertising, for instance through spam e-mails.

4. Recording of data on this website

Cookies

This website uses cookies. Cookies are small text files that are stored on your device and do not cause any damage. They are either stored temporarily for the duration of a session (session cookies) or permanently on your device (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain on your device until you delete them or your browser deletes them automatically.

Cookies can be set by us (first-party cookies) or by third parties (third-party cookies). Some cookies are technically necessary, because certain functions of the website would not work without them (e.g., remembering your language choice or your cookie settings). Other cookies are used to analyse how the website is used.

Technically necessary cookies are stored on the basis of Art. 6(1)(f) GDPR, as we have a legitimate interest in providing the website without technical errors. All other cookies are only stored with your consent (Art. 6(1)(a) GDPR and Art. 5 of Portuguese Law no. 41/2004). You can withdraw your consent at any time.

You can set your browser to inform you when cookies are set, to allow cookies only in certain cases, to block them in general or to delete them automatically when you close the browser. If cookies are disabled, some functions of this website may not work.

The cookies and services used on this website are listed in our Cookie Policy and in the cookie settings.

Consent with Borlabs Cookie

This website uses the consent tool Borlabs Cookie to obtain your consent to the storage of certain cookies in your browser or to the use of certain technologies, and to document this consent in compliance with data protection law. The provider of this technology is Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany.

Borlabs Cookie runs on our own server, so no connection is made to the provider’s servers. Borlabs Cookie stores a cookie in your browser to record the consents you have given or withdrawn. This data is stored until you ask us to delete it, you delete the Borlabs Cookie cookie yourself, or the purpose for storing the data no longer applies. Mandatory legal retention periods remain unaffected.

Borlabs Cookie is used to obtain the legally required consent for the use of cookies. The legal basis is Art. 6(1)(c) GDPR.

Server log files

The hosting provider of this website automatically collects and stores information in so-called server log files, which your browser sends to us automatically. This information is:

  • the type and version of the browser
  • the operating system used
  • the referrer URL
  • the host name of the accessing computer
  • the time of the server request
  • the IP address

This data is not combined with other data sources. It is recorded on the basis of Art. 6(1)(f) GDPR, as we have a legitimate interest in the technically error-free presentation and the optimisation of our website.

Contact form

If you send us a request through the contact form, the information you enter, including your contact details, is stored in order to handle your request and any follow-up questions. The form is sent to us by e-mail through the WordPress plugin WP Mail SMTP, which delivers the e-mails through our hosting provider’s mail server. We do not share this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your request is related to a contract or is necessary for pre-contractual measures. In all other cases, the processing is based on our legitimate interest in handling the requests sent to us effectively (Art. 6(1)(f) GDPR).

The data you enter in the contact form remains with us until you ask us to delete it, you withdraw your consent to its storage, or the purpose for storing it no longer applies (e.g., once your request has been fully handled). Mandatory legal provisions, in particular retention periods, remain unaffected.

Requests by e-mail or telephone

If you contact us by e-mail or telephone, your request, including all personal data it contains (name, request), is stored and processed in order to handle it. We do not share this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your request is related to a contract or is necessary for pre-contractual measures. In all other cases, the processing is based on our legitimate interest in handling the requests sent to us effectively (Art. 6(1)(f) GDPR).

The data you send us remains with us until you ask us to delete it, you withdraw your consent to its storage, or the purpose for storing it no longer applies (e.g., once your request has been fully handled). Mandatory legal provisions, in particular retention periods, remain unaffected.

5. Analysis tools

Google Analytics

With your consent, this website uses the web analysis service Google Analytics 4, integrated through the WordPress plugin MonsterInsights. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics allows us to understand how visitors use the website, for instance which pages are visited, how long visitors stay, which device, browser and operating system they use, from which country or region they come and from which page they arrived. Google Analytics also records interactions such as scrolling, clicks on external links and file downloads. For this purpose, Google Analytics uses cookies that make it possible to recognise your browser.

Google Analytics 4 does not store IP addresses. The data recorded is generally transferred to Google servers, which may be located in the USA.

Google Analytics is only loaded after you have given your consent in the cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR and Art. 5 of Portuguese Law no. 41/2004. You can withdraw your consent at any time through the cookie settings.

The transfer of data to the USA is based on the Standard Contractual Clauses of the European Commission (https://privacy.google.com/businesses/controllerterms/mccs/). Google is also certified under the EU-US Data Privacy Framework (DPF): https://www.dataprivacyframework.gov/participant/5780.

We have concluded a data processing agreement with Google. More information on how Google Analytics handles user data: https://support.google.com/analytics/answer/6004245?hl=en.

6. Plug-ins and tools

Google Fonts

This website uses Google Fonts, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to display fonts consistently. The fonts are only loaded from Google’s servers after you have given your consent in the cookie banner. Your browser then connects to Google’s servers, and Google learns that this website was accessed from your IP address. The legal basis is your consent under Art. 6(1)(a) GDPR and Art. 5 of Portuguese Law no. 41/2004, which you can withdraw at any time.

More information: https://developers.google.com/fonts/faq and https://policies.google.com/privacy?hl=en.

WP Mail SMTP

We use the WordPress plugin WP Mail SMTP so that the e-mails sent by the website (for instance the messages from the contact form) are delivered reliably. The plugin sends these e-mails through the mail server of our hosting provider in Portugal. No other e-mail service is involved. The legal basis is our legitimate interest in the reliable delivery of the messages you send us (Art. 6(1)(f) GDPR).

ManageWP

We manage this website with the tool ManageWP, provided by GoDaddy.com WP Europe, Trg republike 5, 11000 Belgrade, Serbia (“ManageWP”). ManageWP allows us to monitor the security and performance of the website and to keep it up to date. For this, ManageWP has access to the content of the website, including the database. ManageWP is hosted on the provider’s servers.

The use of ManageWP is based on our legitimate interest in a website that works as effectively and securely as possible (Art. 6(1)(f) GDPR). Data may be transferred to Serbia and to the USA. The provider’s parent company is certified under the EU-US Data Privacy Framework (DPF): https://www.dataprivacyframework.gov/participant/4957.

WordPress plugins without data transfer

The following plugins run only on our own server and do not send your personal data to third parties: Polylang (language versions; stores your language choice in a cookie), Contact Form 7 (contact form), All in One SEO (search engine settings) and OMGF (font optimisation).

7. Changes to this Privacy Policy

We may update this Privacy Policy when the website or the legal requirements change. The current version is always available on this page.

Last updated: October 2026