1. Scope of this list
This list identifies the providers that process personal data on behalf of the entity identified below, to run the site and the consulting business. When I act as a processor for a client, the providers relevant to that project are named in the corresponding data processing agreement.
- Company
- Consultor de Marketing Digital
- NIF (tax ID)
- PT256990727
- Registered address
- Travessa da Estrada Nova 190, 3885-062 Arada, Portugal
- CAE
- 70200
- Phone
- +351916234466
2. Current subprocessors
These are the providers that currently process personal data on my behalf. Where a provider processes data outside the European Economic Area, the safeguards described in section 5 of the Privacy Policy apply.
- Website hosting (Dominios.pt) — Purpose: hosting and operation of the website, technical server logs. Data: IP address, technical browsing data, data submitted in forms. Processing location: Portugal.
- Professional email (Zoho, EU data centre) — Purpose: professional email and communication with clients and prospects. Data: name, email and the content of messages exchanged. Processing location: European Union.
- Make — Purpose: automatic forwarding of form data by webhook. Data: data submitted in the contact, proposal and newsletter forms. Location and transfer safeguards: as described in section 5 of the Privacy Policy.
- Sender — Purpose: sending the newsletter and email marketing, only with consent, and contact management. Data: email, name, consent record and interactions with emails. Location and transfer safeguards: as described in section 5 of the Privacy Policy.
- NeetoCal — Purpose: call booking. Data: name, email, call date and time and answers to the booking questions. Location and transfer safeguards: as described in section 5 of the Privacy Policy.
- Google (Google Tag Manager, Google Analytics 4, Google Ads) — Purpose: measuring website and campaign audience and performance, only after you give consent. Data: online identifiers, browsing data and interaction events. Location and transfer safeguards: as described in section 5 of the Privacy Policy.
- Meta — Purpose: measuring and optimising advertising campaigns, only after you give consent. Data: online identifiers and browsing events. Location and transfer safeguards: as described in section 5 of the Privacy Policy.
- CookieYes — Purpose: cookie consent management (Google Consent Mode v2). Data: consent preferences. Location and transfer safeguards: as described in section 5 of the Privacy Policy.
- Cloudflare — Purpose: website security and automated traffic (bot) management. Data: IP address and technical request data. Location and transfer safeguards: as described in section 5 of the Privacy Policy.
For some services, in particular advertising, Google and Meta may act as independent controllers under their own terms.
3. How I choose subprocessors
I only use providers that offer sufficient guarantees of appropriate technical and organisational measures, with a data processing agreement in place. Where possible, I prefer processing within the European Economic Area.
4. Data processing agreement (DPA) for consulting engagements
Many projects require access to personal data about your shop’s customers, for example in WooCommerce, Google Analytics 4 or your email marketing platform. In those cases your company is the controller and I act as a processor, only on your documented instructions. The GDPR requires a written contract for this relationship.
How to request the DPA
- Write to info@consultordemarketingdigital.pt with the subject “DPA request”, your company details and the proposal reference.
- I work with your company’s data processing agreement (DPA) template.
- The agreement is signed before I receive access to any system containing personal data.
What the DPA covers
- subject matter, duration, nature and purpose of processing;
- types of personal data and categories of data subjects;
- confidentiality obligations and security measures;
- authorised sub-processors;
- assistance with data subject requests and personal data breach notification;
- return or deletion of data at the end of the project;
- audit and information rights.
5. Changes to this list
I update this page when I add or replace a subprocessor. Clients with a DPA in force are notified 30 days in advance and may object to the change, as set out in the agreement.
6. Contact
For questions about subprocessors or data protection, write to info@consultordemarketingdigital.pt.