Privacy Policy

1. Data Controller

OVR Consulting, R. dos Três Lagares, 6230-421 Fundão, Portugal. Email: hello@ovrconsulting.com. Phone: +351 275 082 873. NIF: PT-XXXXXXXXX.

2. Applicable Legislation

RGPD (EU Regulation 2016/679); Lei 58/2019 (Portuguese GDPR implementation); Lei 41/2004 (electronic communications privacy); Decreto-Lei 7/2004 (e-commerce). Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I 134, 1200-651 Lisboa, www.cnpd.pt.

3. Categories of Data Collected

Contact: Name, email, phone, company, role. Growth project data: Revenue metrics, growth data, customer data, analytics access — strictly confidential under NDA. Payment: Stripe (PCI DSS L1). Analytics: Plausible (cookieless, EU-hosted).

4. Growth Data Protection

When we access your business data for growth consulting: all revenue metrics, customer data, and analytics are NDA-protected; data accessed only by assigned team members; encrypted storage (AES-256) on EU servers; deleted within 90 days of engagement end upon request; we act as data processor (Art. 28 RGPD) for all client business data.

5. Legal Bases

Contract (Art. 6(1)(b)). Legal obligation (Art. 6(1)(c)). Legitimate interest (Art. 6(1)(f)). Consent (Art. 6(1)(a)).

6. Your Rights Under RGPD

Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18), Portability (Art. 20), Objection (Art. 21). Contact: hello@ovrconsulting.com. 30 days. CNPD complaint: www.cnpd.pt.

7. Retention

Client data: engagement + 10 years. Growth models and strategy docs: engagement + 90 days. Marketing consent: duration + 5 years.

8. Security

TLS 1.3, AES-256, MFA, EU servers, NDA for all advisors, 72h breach notification.

Last updated: March 2026.