Last updated: 26 September 2026

Privacy & Cookies

This policy explains how personal data is handled in connection with denisemcastro.com and private Portuguese lessons.

1. Data controller

The controller is Denise M. Castro, independent service provider established in Madeira, Portugal. Privacy enquiries: info@denisemcastro.com.

2. Data we may process

Depending on how you interact with the service, data may include your name, email address, billing information, lesson booking information, communications, learning preferences and information you voluntarily provide for lesson preparation. Payment card details are processed by Stripe and are not stored directly on this website.

3. Why data is processed

to take steps at your request and perform the lesson contract;
to process and document payments and comply with tax/accounting obligations;
to arrange lessons and communicate about bookings;
to respond to enquiries;
to protect the security and integrity of the website and services;
where applicable, to comply with legal obligations.

Consent is used only where it is the appropriate legal basis. Data necessary to perform a contract is generally processed on the basis of contractual necessity rather than consent.

4. Service providers and external platforms

The service may use third parties such as Stripe for payments, Google services for scheduling/video calls and workspace tools, Netlify for website hosting, and WhatsApp when you choose to contact Denise there. Links to YouTube, Instagram, TikTok, Spotify, Substack, LinkedIn and Facebook take you to those providers, whose own privacy terms apply.

5. International transfers

Some service providers may process data outside Portugal or the European Economic Area. Where applicable, transfers must rely on a lawful transfer mechanism under data-protection law. Provider-specific details are governed by the relevant provider documentation and contractual arrangements.

6. Retention

Personal data is kept only for as long as necessary for the purpose for which it was collected and for applicable legal, tax, accounting, dispute-resolution and security retention periods. Enquiry data that is no longer needed is deleted or minimised when reasonably possible.

7. Your rights

Subject to the conditions in the GDPR, you may have rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent where processing relies on consent. You may also lodge a complaint with the Portuguese data-protection authority, CNPD.

8. Cookies and similar technologies

The production site is designed to minimise tracking. It does not intentionally place analytics or advertising cookies in this version. Normal hosting/security infrastructure may still process technical request data necessary to deliver and secure the website. External services are loaded only when needed or when you follow a link. If analytics, advertising pixels, embedded media or other non-essential technologies are added later, this policy and the consent mechanism must be updated before those technologies are activated.

This page describes the intended V7 production configuration. Before launch, the deployed Netlify site should be checked with browser developer tools/cookie inspection to verify the actual technologies loaded in production.