Privacy policy
Last updated: 31 October 2026
This privacy policy explains how AISP-GEDOC processes the personal data collected through the gedoc.pt website and through the business enquiries that reach us by this means. It has been drawn up in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and with Law No. 58/2019 of 8 August, which ensures its implementation in Portugal.
1. Data controller
The controller of the personal data referred to in this policy is AISP Advanced Industry Support Partners, Lda., legal entity identification number (NIPC) 508 521 688, with registered office at PCI – Creative Science Park, Via do Conhecimento, 3830-352 Ílhavo, which trades under the AISP-GEDOC brand (hereinafter “AISP-GEDOC” or “we”).
- Email for privacy matters: geral@aisp.pt
- Telephone: +351 234 040 475
- Address: PCI – Creative Science Park, Via do Conhecimento, 3830-352 Ílhavo, Portugal
2. Scope of this privacy policy
This policy applies to the personal data we process as controller, in particular when you visit the website, fill in the contact form, send us an email or contact us by telephone to request information or a demonstration.
It does not apply to the data of workers, contractors and other users registered on the document management and HSE platforms that we implement or operate for our clients. In those cases, the controller is the client entity, and AISP-GEDOC acts as processor, in accordance with the instructions of, and the contract entered into with, that entity (Article 28 GDPR). If you have any questions about such data, you should first contact the entity responsible for the platform.
3. What personal data we process
- Contact form data: first name, surname, email address, telephone number (optional) and the content of the message you send us.
- Direct contact data: the data you provide to us by email or telephone, such as name, job title, company and the subject of the request.
- Business contact data of clients, partners and suppliers: name, job title, company, and business email address and telephone number of the people we deal with in the context of a business relationship.
- Technical and security data: IP address, date and time of access, pages requested, browser and operating system, recorded by the server and by the website’s security mechanisms to protect the website against abusive access.
Please do not include unnecessary personal data in your message, in particular special categories of data (for example, health data).
4. Purposes and lawful bases
| Purpose | Lawful basis (GDPR) |
|---|---|
| Responding to requests for information, demonstrations or proposals | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b)) and legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Managing the business relationship with clients, partners and suppliers | Performance of a contract (Art. 6(1)(b)) and legitimate interest in managing the relationship with the entity you represent (Art. 6(1)(f)) |
| Complying with legal obligations, in particular tax and accounting obligations | Compliance with a legal obligation (Art. 6(1)(c)) |
| Ensuring the security and operation of the website and preventing abuse and cyberattacks | Legitimate interest in information security (Art. 6(1)(f)) |
| Establishing, exercising or defending rights in judicial or out-of-court proceedings | Legitimate interest (Art. 6(1)(f)) |
We do not use your data for automated decision-making, including profiling, that produces legal effects or similarly significant effects. Nor do we send marketing communications without your prior consent, where such consent is required by law.
5. How long we keep the data
- Contact requests that do not lead to a business relationship: up to 24 months after the last contact.
- Business relationship data: for the duration of the relationship and, after it ends, for the period necessary to comply with legal obligations (for example, the retention periods for tax and accounting records) and for the exercise or defence of rights.
- Technical and security logs: for the period strictly necessary for the security of the website, up to 90 days, unless they are needed to investigate an incident.
Once these periods have expired, the data are deleted or anonymised.
6. Recipients and processors
Personal data are processed by the members of the AISP-GEDOC team who need them to respond to your request. They may also be processed by service providers acting on our behalf as processors, under a contract that complies with Article 28 GDPR, namely:
- the website hosting and maintenance provider;
- the email service provider;
- backup and IT security service providers;
- accounting, legal support and audit services, where necessary.
Data may also be disclosed to public authorities where this results from a legal obligation or a court decision. We do not sell personal data to third parties.
7. International transfers
We give preference to providers that process data within the European Economic Area. If any provider processes data outside the European Economic Area, the transfer only takes place with the safeguards provided for in Chapter V of the GDPR, such as an adequacy decision of the European Commission or standard contractual clauses.
8. Security
We apply technical and organisational measures appropriate to the risk, such as an encrypted connection (HTTPS), a web application firewall and protection against abusive access attempts, access control to the website administration, regular updates and backups. No system is completely immune to incidents; therefore, if we detect a personal data breach, we will act in accordance with Articles 33 and 34 GDPR.
9. Your rights
Under the GDPR, you may exercise the following rights:
- Access: to know whether we process your data and to obtain a copy;
- Rectification: to correct inaccurate or incomplete data;
- Erasure: to request the deletion of your data, in the cases provided for by law;
- Restriction of processing: to request that your data be restricted, for example while we verify their accuracy;
- Portability: to receive the data you have provided to us in a structured, commonly used format, where the processing is based on a contract or on consent and is carried out by automated means;
- Objection: to object to processing based on legitimate interest, on grounds relating to your particular situation, and to object at any time to marketing communications;
- Withdrawal of consent: where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise these rights, send a request to geral@aisp.pt. We will respond within one month of receipt of the request, a period that may be extended in the cases provided for in Article 12 GDPR. We may ask for additional information to confirm your identity.
10. Complaints to the supervisory authority
If you consider that the processing of your data infringes the applicable legislation, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD, the Portuguese data protection authority), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt. We would, however, be grateful if you contacted us first, so that we can clarify or resolve the matter.
11. Cookies
How the website uses cookies and similar technologies is described in the cookie policy.
12. Changes to this privacy policy
We may update this policy to reflect legal or technical changes or changes to our services. The current version is always available on this page, with the date of the last update shown at the top.