Last updated: 9 July 2026
Who we are
This website is operated by COSMICALLEY — UNIPESSOAL LDA, a company registered in Portugal (NIF 519121821), with registered office at Rua Custódio Vieira, n.º 2, 3.º Esq., 1250-086 Lisboa, Portugal. For anything in this policy, write to hello@cosmicalley.io. Cosmicalley is the controller of the personal data described below.
The short version
This is an informational website. It has no user accounts, no forms, no advertising trackers and no analytics. The personal data we receive comes from two places: what you send us by email, and the technical data any website needs to be delivered securely. We do not sell personal data, and we make no automated decisions about you.
What we process, and why
Email you send us. If you write to us — for example to book a fit call — we receive your email address and whatever you include (typically your name, company and question). We use it to reply and to follow up on your enquiry. Legal basis: steps taken at your request prior to a possible contract, and our legitimate interest in responding to business enquiries (GDPR art. 6(1)(b) and (f)).
Technical and security data. The site is served by Cloudflare, which processes connection data such as your IP address to deliver pages, balance load and block abuse. We see this only in aggregate. Legal basis: our legitimate interest in operating a secure, functioning website (art. 6(1)(f)).
Booking a fit call. If you book a call through the "Book a 30-minute fit call" button, the booking runs on Google Calendar's appointment service: Google collects your name, email address, your answer to the booking question and the slot you choose, and delivers them to our calendar. We use that information to hold the call and follow up on it. Legal basis: steps taken at your request prior to a possible contract (GDPR art. 6(1)(b)). The booking page itself is operated by Google under its own privacy terms.
Measurement — only with your consent. If you press Accept on the cookie notice, we use Google Analytics to understand how the site is used (pages visited, where visitors come from, whether the "book a fit call" button is used) and, when advertising campaigns run, tags from Google and LinkedIn to measure whether they work. Nothing loads and no cookie is set unless you accept. Legal basis: your consent (GDPR art. 6(1)(a)), which you can withdraw at any time below.
Fonts. The site loads its typefaces from Google Fonts. When a page loads, your browser requests the font files from Google's servers, which involves transmitting your IP address to Google. No cookies are set by this request. Legal basis: legitimate interest in a consistent, fast-loading site (art. 6(1)(f)).
Cookies
By default this website sets no cookies. Our hosting provider, Cloudflare, may set strictly necessary cookies used solely for security and traffic management. Beyond that, measurement cookies from Google (and LinkedIn, when campaigns run) are set only after you press Accept on the consent notice — declining sets nothing, and the site works identically either way. Your first visit starts with everything off.
You can change your cookie choice at any time — the consent notice will reappear.
Who handles the data with us
We use two service providers, acting as processors: Cloudflare (website hosting and content delivery), Google (business email via Google Workspace, font delivery, and — with your consent — Google Analytics and Google Tag Manager) and, once advertising campaigns run and only with your consent, LinkedIn (campaign measurement). Both may process data on servers outside the European Economic Area; in that case, transfers rely on recognised safeguards such as the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. Their own privacy documentation: Cloudflare · Google.
How long we keep it
Email correspondence is kept for as long as the conversation or business relationship is active, and afterwards only as long as Portuguese law requires (for example, tax and accounting obligations). Technical logs are retained by our providers on short rolling cycles and are not kept by us. Analytics data, if you consented, is retained for at most 14 months and only in aggregate form.
Your rights
- Ask what personal data we hold about you, and receive a copy.
- Have inaccurate data corrected, or data we no longer need erased.
- Restrict or object to processing based on legitimate interest.
- Receive data you provided in a portable format.
To exercise any of these, email hello@cosmicalley.io — we respond within one month. You can also lodge a complaint with the Portuguese supervisory authority, the CNPD (cnpd.pt).
Changes to this policy
If we change how the site handles data — for example by adding a contact form or analytics — this page will be updated first, with a new date at the top.