LEGAL

Privacy Policy

Last updated: June 2026

This Privacy Policy explains how Lisbon by Costa (operated by Patrícia Costa, based in Portugal) collects, uses and protects the personal information of visitors and clients. By using this website or our services, you consent to the practices described below. We are committed to GDPR compliance and to handling your data with the same discretion that defines our concierge work.

1. Who we are

Lisbon by Costa is a Personal & Business Assistant service operated by Patrícia Costa, a sole trader registered in Portugal. The data controller for any personal information submitted through this website is Patrícia Costa.

Contact: hello@lisbonbycosta.com · +351 925 554 588

2. What data we collect

• Contact form data: name, email, phone (optional), location (optional), service areas of interest, engagement preference, and any message you choose to send.
• Technical data: basic browser information (browser type, language, referring URL) and aggregated visit statistics, only if you accept analytics cookies.
• Client data (after engagement): any documents, credentials or personal details you explicitly share with us in the course of providing the agreed service, governed by a separate written agreement and a limited power of attorney.

3. Why we collect it

• To reply to your enquiries and provide the services you request.
• To send relevant communications about a request you have initiated (we do not send unsolicited marketing).
• To meet legal and accounting obligations (e.g. invoicing).
• To improve the website experience (anonymous analytics only, with your consent).

The legal bases for processing are: your explicit consent (forms, cookies), the performance of a contract (active engagements), and legal obligations (accounting, tax records).

4. How we store and protect your data

Form submissions are processed via FormSubmit and delivered directly to our secured business email inbox. Active client credentials (when shared) are stored in an encrypted password manager (1Password) and never used outside the scope you authorise. We do not sell, rent or share your data with third parties for marketing purposes.

5. Third-party services

The website uses the following external services:

• FormSubmit — to deliver form submissions to our inbox.
• Netlify — to host the website.
• Plausible / Google Analytics — for anonymous traffic statistics, only loaded if you accept analytics cookies.

Each provider is GDPR-aligned and processes only the minimum data necessary.

6. Cookies

This site uses minimal essential cookies (for language preference and form anti-spam). Analytics cookies are only loaded after you give explicit consent via the cookie banner. You can change your cookie preferences any time by clearing your browser data and revisiting the site.

7. Your rights (GDPR)

• The right to access the personal data we hold about you.
• The right to correct inaccurate data.
• The right to request deletion of your data (the "right to be forgotten"), subject to legal retention requirements.
• The right to object to or restrict processing.
• The right to data portability.
• The right to lodge a complaint with the Portuguese data protection authority (CNPD).

8. Data retention

Enquiry data (form submissions without an active engagement) is kept for up to 12 months and then deleted. Client data tied to an active or past engagement is kept for the duration legally required for tax and accounting purposes (typically 10 years under Portuguese law), and then deleted.

9. Children

This service is intended for adults relocating to Portugal. We do not knowingly collect data from minors. If you believe a minor has submitted data, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy when laws change or when we add new services. The "Last updated" date at the top reflects the most recent revision. Significant changes will be communicated by email to active clients.