Last updated: 28 October 2026
This policy explains what happens to the personal data collected through the website https://clevidence.pt. It complements Clevidence’s Privacy and Personal Data Processing Policy (PL.06), which covers the company’s other processing.
1. Who processes the data
Clevidence, Lda., tax number (NIPC) 516141287, Taguspark, Edifício Inovação II, Av. Jacques Delors, 411-421, 2740-122 Porto Salvo, Portugal, is the controller of the personal data collected on this website.
Clevidence has a data protection officer (DPO). For any privacy question, write to [email protected] or send a letter to the DPO at the address above.
2. What data we collect, why and for how long
| Situation | Data | Purpose | Legal basis (GDPR, Art. 6(1)) | Retention |
|---|---|---|---|---|
| Contact form | Name, phone, email, company (optional), message and the record that you read this policy | Answer your request and, where relevant, prepare a proposal | Steps taken at your request before entering into a contract, point (b) | The time needed to answer and follow up the request. If no contract follows, up to 24 months after the last contact |
| Newsletter | Email and subscription record | Send the newsletter on health technology assessment | Consent, point (a), which you can withdraw at any time | Until you unsubscribe. Proof of the subscription and of the unsubscription is kept afterwards, to demonstrate consent |
| Website analytics, only if you accept “Analytics” | Cookie identifiers, pages viewed, clicks, scrolling, device and approximate location | Understand how the website is used and improve it | Consent, point (a) | Google Analytics, 14 months of event data retention. Microsoft Clarity, the retention period set by Microsoft for the service |
| Identification of visiting companies, only if you accept “Marketing” | IP address and browser identifier | Know which organisations visit the website, for business contact | Consent, point (a) | The retention period set by Apollo.io for the service |
| Record of your cookie choice | Random identifier, date and time, choice per category, policy version and language, without IP address | Prove consent (GDPR, Art. 7(1)) | Legal obligation, point (c) | The choice stays in your browser for 182 days (6 months). The server record is kept for as long as the data that this consent justifies |
| Website security | IP address, date and time and requests made to the website | Protect the website against attacks and unauthorised access | Legitimate interest in protecting the website, point (f) | Up to 6 months |
| Log of emails sent by the website | Recipient, subject, date and content of the form and newsletter emails | Confirm that emails were delivered and fix sending failures | Legitimate interest in making sure requests arrive, point (f) | The time needed to confirm delivery and fix sending failures |
| Contact request reports | The form and newsletter data, copied by an automation into a spreadsheet | Follow up requests and measure the website’s results | The same as the original form | The same as the original form |
Where the legal basis is legitimate interest, you can object to that processing at any time (section 6).
Required form fields are marked. Without them we cannot answer your request. The other data is optional.
The website does not make automated decisions or build profiles with legal or similarly significant effects on you. Microsoft Clarity records how pages are used and Apollo.io identifies the organisation an IP address belongs to, only with your consent and for the purposes above.
3. Who we share the data with
Data is only available to those who need it for the purposes above. These providers process it on behalf of Clevidence and following its instructions:
| Provider | Service | Where |
|---|---|---|
| Hostinger | Website and database hosting, sending of the website’s emails | European Union (servers in France) |
| Cloudflare | Website delivery and protection against attacks | Global network, company based in the US |
| Google (Google Analytics) | Website analytics, only with consent | US |
| Google (Google Ads) | Conversion measurement, with advertising signals always denied (section 5) | US |
| Google (Google Maps) | Map on the contact pages, only if you click “Show map” | US |
| Google (Google Workspace) | Spreadsheet with the contact request reports | US |
| Microsoft (Clarity) | Website analytics and heatmaps, only with consent | US |
| Microsoft (Microsoft 365) | Clevidence’s email | Microsoft data centres |
| Apollo.io (ZenLeads, Inc.) | Identification of visiting companies, only with consent | US |
| Make.com (Celonis) | Automation that copies the form and newsletter data into the report spreadsheet | European Union |
| Dash Digital, Lda. | Maintenance of the website, the measurement and the automation, and technical monitoring of the website | Portugal |
| flagcdn.com | Flag images in the language selector, which receive the browser’s IP address | Content delivery network |
We may also disclose data to judicial, administrative or supervisory authorities when the law requires it.
4. Transfers outside the European Economic Area
Google, Microsoft, Cloudflare and Apollo.io may process data in the US. These transfers rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, which these companies have joined. Where a provider is not covered, the standard contractual clauses approved by the European Commission are used (GDPR, Art. 46(2)(c)).
5. Cookies
The website uses cookies and similar technologies. Necessary cookies are always active. Analytics and marketing cookies are only activated if you accept them in the cookie notice, and nothing from third parties loads before you choose. Google’s advertising signals (storage, user data and ad personalisation) are always denied, so the email and phone from the form are not sent to Google. Google Maps only loads if you click “Show map”. You can change your choice at any time with the “Manage cookies” link in the footer of every page. The details are in the Cookie Policy.
6. Your rights
You can ask for access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it whenever you want, without affecting what was done before.
To exercise these rights, write to the DPO at [email protected] or at the address in section 1. We reply within one month, which may be extended for complex requests, as the GDPR provides.
You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
7. Security
We apply technical and organisational measures to protect data against loss, unauthorised access or disclosure, including encrypted connections (HTTPS), a firewall and attack protection, backups and access restricted to the people who need the data.
8. Changes
When this policy changes, we update the date at the top. If a change alters the purposes of cookies you have already accepted, we ask for your choice again.