Privacy Policy
Last updated:
This policy explains which personal data Don Michi processes when you visit www.donmichi.pt or ask us for a service, what we use it for, who we share it with and what your rights are. It follows Regulation (EU) 2016/679 (GDPR), Portuguese Law 58/2019 and, for cookies, Portuguese Law 41/2004.
In short: the site has no forms that send your data to our server, Google cookies are only set if you accept them, and you can change your mind at any time under Cookies and storage on your device.
1. Data controller
The controller of your data is Don Michi · Transport & Removals, operating in Porto, Portugal.
- General email: geral@donmichi.pt
- Privacy and data protection: rgpd@donmichi.pt
- Phone and WhatsApp: +351 915 861 579
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| What you send us by WhatsApp, phone or email: name, phone number or email, pick-up and delivery addresses, dates, description and photos of the items | Preparing the quote, arranging and carrying out the service, and answering your questions. | Pre-contractual steps and performance of the contract — Art. 6(1)(b). |
| Invoicing data: what the invoice requires, such as name, tax number and address | Issuing the invoice and meeting tax and accounting obligations. | Legal obligation — Art. 6(1)(c). |
| Contact alert: button tapped, page, type of device and source of the visit, with no name or identifiers (section 4) | Knowing which pages and campaigns bring us enquiries. | Legitimate interest — Art. 6(1)(f). |
| Technical data of the visit: IP address, browser and page requested | Delivering the pages, keeping the site secure and stopping abuse; aggregate, cookie-free statistics on visits and performance (section 6). | Legitimate interest — Art. 6(1)(f). |
| Measurement with Google Analytics and Google Ads (sections 5 and 7) | Statistics on how the site is used, and measuring and personalising our ads. | Consent — Art. 6(1)(a) — which you can withdraw at any time. The cookieless signals described in section 5 rely on our legitimate interest in measuring traffic in aggregate. |
You are not obliged to give us your data, but without the details of the job (contact, addresses and a description of the items) we cannot quote for or provide the service.
3. Contact by WhatsApp, phone and email
Requests reach us through the channel you choose: WhatsApp, a phone call or email. We use what you send — name, contact details, addresses, dates, description and photos of the items — only to quote for, organise and carry out the service, and to contact you about it.
- WhatsApp. The buttons on the site open a chat with us in the WhatsApp app, with a pre-written message you can edit before sending. The conversation takes place on WhatsApp, which processes your data under its own privacy policy.
- Online booking. The form on the online booking page does not send to our server or store what you fill in: it composes, in your browser, a WhatsApp message with those details and opens WhatsApp for you to send it. We only receive it if you send it on WhatsApp. Submitting the form sends only the contact alert described in section 4, without the details you entered.
- Invoicing. Invoice data is processed and kept because tax law requires it.
4. Contact alert (WhatsApp and call buttons)
So that we know which pages and campaigns bring us enquiries, when you tap a WhatsApp or call button the site sends our server a short alert containing:
- the type of contact (WhatsApp or call) and the name of the button you tapped;
- the page you were on and the page through which you entered the site;
- whether you are on a phone or a computer;
- the source of the visit, by category (ad, Google, another search engine, AI assistant, social media, a link shared on WhatsApp, another website or direct access) and, depending on the case, the name of the ad campaign or the domain of the site you came from;
- only if you accepted cookies and reached the site through an ad in the last 30 days: how many days ago that was.
The alert does not include your name, your phone number, the content of your message or any identifier of you or your device. The site's server forwards it, without your IP address, to our internal management system, which records it and notifies the team by Telegram. When you later make a request, we may match it to the alert by the time it arrived.
The source of the visit is kept only in your browser (see dm_origen in section 7) and is only sent if you tap one of those buttons.
5. Google Analytics and Google Ads
The site loads the Google tag (gtag.js) for Google Analytics 4 and Google Ads, services provided by Google Ireland Limited. The tag runs in Consent Mode v2 and always starts with everything denied:
- Before you decide, or if you reject. The tag neither reads nor sets cookies on your device, and ad-click identifiers are redacted. It may still send Google cookieless signals — for example, that a page was opened or that a contact button was tapped. As with any connection on the Internet, Google receives your IP address and browser type in those requests.
- If you accept. You allow Google Analytics and Google Ads to set and read the cookies listed in section 7 and to use the data from your visit for statistics, to measure our ads and to personalise them (signals
analytics_storage,ad_storage,ad_user_dataandad_personalization). Page views, scrolling, clicks on links that leave the site (with the destination address), starting and submitting the booking form (with the type of service) and taps on the WhatsApp and call buttons (with the button name, the page and, where applicable, the campaign or the service chosen in the calculator) are recorded. Google's tag may also detect contact details typed into forms on the site (email, phone or address) and send them to Google, in what Google describes as an encoded (hashed) form, to measure conversions. Taps on the WhatsApp button are also reported to Google Ads as a conversion. - If you change your mind and reject. The site goes back to denying everything and deletes the Google cookies and data stored on this domain. Cookies Google has set on its own domains can only be deleted in your browser settings.
Your decision is kept in your browser for 180 days; after that we ask again.
6. Hosting, security and cookie-free statistics
The site is hosted by Vercel Inc. To deliver the pages, the servers receive the technical data of each request (IP address, browser and page requested), which the hosting provider may keep in technical logs for short periods. Our server also uses the IP address, in its temporary memory only, to limit the number of requests per minute and stop abuse; it does not record it in any database.
We also use Vercel Web Analytics and Vercel Speed Insights, loaded on every page, to know which pages are visited and whether the site loads quickly. They produce aggregate statistics, use no cookies and store nothing on your device.
7. Cookies and storage on your device
The site stores very little information on your device. Besides cookies, it uses browser storage (localStorage and sessionStorage), which the law treats in the same way. Google cookies are only set after you accept them.
| Name and type | What it is for and when it is set | Duration |
|---|---|---|
dm_consentlocalStorage | Stores your decision on cookies (accepted or rejected) and its date, so that we do not ask again on every page. Set when you decide in the cookie notice. | 180 days; after that we ask again. |
dm_origensessionStorage | Stores how the visit started: the source by category, the campaign or site you came from, the entry page and, if you arrived through an ad, the time of that click. It holds no identifiers and only leaves the browser in the contact alert (section 4). Set on the first page of each visit. | Until you close the tab. |
dm_ultimo_anunciolocalStorage | Stores the date you last reached the site through an ad, so we know whether a later enquiry came from a campaign. Only set after you accept cookies. | Used for 30 days; deleted if you reject cookies. |
_ga, _ga_<ID>Google Analytics cookies | Tell visitors and sessions apart for usage statistics. Only set after you accept cookies. | Up to 2 years (Google default). |
_gcl_au, _gcl_awGoogle Ads cookies | Measure whether a click on an ad led to an enquiry; the second only exists if you reached the site through an ad. Only set after you accept cookies. | Up to 90 days (Google default). |
The Google cookies listed above are set by Google's script on the donmichi.pt domain; the same script may set others with the prefixes _ga, _gac_ and _gcl_, and the _gcl_ls entry in localStorage. Once you accept, Google may also read and set its own cookies on its own domains (for example, doubleclick.net), which this site cannot delete. Vercel Web Analytics and Vercel Speed Insights store nothing on your device.
How to change your decision
In the notice shown on your first visit you can accept or reject with a single tap; rejecting does not limit your use of the site. To change your mind, use the “Cookies” link in the footer of any page or reopen the notice here:
If you reject after having accepted, the site deletes the Google cookies stored on this domain and the record of the last ad. You can also delete cookies and site data in your browser settings.
8. Who we share data with
- Vercel Inc. (USA): hosting of the site, Web Analytics and Speed Insights.
- Google Ireland Limited: Google Analytics and Google Ads, as described in section 5.
- WhatsApp Ireland Limited: when you contact us by WhatsApp. WhatsApp is an independent controller for the messaging service.
- Telegram: receives the internal notification of the contact alert, which holds no data that identifies you.
- IT service providers we use to manage requests, email and invoicing, who process the data on our behalf and on our instructions.
- Public authorities, where the law requires it.
9. Transfers outside the European Economic Area
Some of these providers, such as Vercel and Google, are based or have servers in the United States, so data may be processed outside the European Economic Area. In those cases the transfer relies on the mechanisms provided for in the GDPR: adequacy decisions of the European Commission (such as the EU-US Data Privacy Framework) or standard contractual clauses.
10. How long we keep data
- Quote requests that do not go ahead: the time needed to reply and follow up.
- Services provided: for as long as our relationship lasts and, afterwards, for the periods during which the data may be needed to answer complaints or meet legal obligations.
- Invoicing: the period required by tax law.
- Contact alerts: they hold no data that identifies you; we keep them for statistics on our campaigns.
- Data on your device: the periods shown in the table in section 7.
- Google Analytics and Google Ads: the retention periods of those tools.
11. Your rights
You can ask us for access to your data, its rectification or erasure, restriction of processing and portability. You can also object to processing based on legitimate interest and withdraw the consent you gave, without affecting what was done until then. Just write to rgpd@donmichi.pt; we reply within one month, which the law allows to be extended in more complex cases.
You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt.
12. Security
The site is served over an encrypted connection (HTTPS) only, and we apply appropriate technical and organisational measures to protect data against unauthorised access, loss or misuse.
13. Changes to this policy
We may update this policy when the site or the law changes. The version in force is the one published on this page, with the date shown at the top.