Privacy Policy

Last updated: 28 April 2026

Challenging Dawn — Consultancy Ltd. respects the privacy and protection of personal data of its users, clients and partners. This Policy describes how we process data when you use our website, forms or any other communication channel.

1. Data Controller

Challenging Dawn — Consultancy Ltd., VAT PT 518804364, with registered office at Travessa Sobreira, 12, 3640-096 Ferreirim, Sernancelhe, Viseu — Portugal, is the entity responsible for processing personal data collected through its website and other communication channels.

2. Data We Collect

We collect only the data strictly necessary to fulfil the purposes for which it is intended. We may process:

• Identification & contact data: first name, last name, email, phone, company;
• Communication data: messages submitted through the contact form;
• Browsing data: IP address, device type, browser, pages visited (collected by analytical cookies — see Cookie Policy);
• Contractual data: information necessary for the performance of contracts with clients.

3. Purposes of Processing

• Managing contact and information requests;
• Performing contracts and providing services;
• Sending commercial communications, newsletters and institutional information (only with explicit consent);
• Compliance with legal and tax obligations;
• Statistical analysis and website improvement.

4. Legal Basis

The processing of your data is based on one of the following legal grounds, as applicable:

• Consent of the data subject (Article 6(1)(a) GDPR);
• Performance of a contract or pre-contractual steps (Article 6(1)(b));
• Compliance with legal obligations (Article 6(1)(c));
• Legitimate interests of the company (Article 6(1)(f)).

5. Rights of Data Subjects

As a data subject, you may at any time and free of charge:

• Request access, rectification or erasure of your data;
• Restrict or object to processing;
• Request data portability;
• Withdraw consent given, without affecting the lawfulness of processing carried out previously;
• File a complaint with the Portuguese Data Protection Authority (CNPD) — cnpd.pt.

To exercise any of these rights, contact us by email: geral@challengingdawn.pt. We will reply within 30 days.

6. Data Retention

Personal data will be retained only for as long as necessary for the purposes for which it was collected, after which it will be deleted or anonymised:

• Contact requests: up to 24 months after the last interaction;
• Contractual data: for the duration of the contract and the legal retention period (10 years for tax data);
• Newsletters: until withdrawal of consent;
• Browsing data: as per the duration of each cookie (see Cookie Policy).

7. Sharing Data with Third Parties

Your data is not sold, rented or transferred to third parties for commercial purposes. It may, however, be shared with sub-processors acting on behalf of Challenging Dawn under a GDPR-compliant data processing agreement, namely:

• Hosting and infrastructure providers;
• Email and CRM platforms (HubSpot);
• Analytics services (Google Analytics, anonymised);
• Public authorities, when legally required.

8. International Transfers

Some of our sub-processors may process data outside the European Economic Area. In such cases, we ensure appropriate safeguards are in place (Standard Contractual Clauses approved by the European Commission, or country with an adequacy decision).

9. Security

Challenging Dawn implements appropriate technical and organisational measures to protect data against loss, misuse, unauthorised access or disclosure. These include encryption in transit (HTTPS), access control, regular backups and periodic system reviews.

10. Changes to this Policy

This Policy may be updated periodically. The version in force is always the one published on this page, with the date of last update.

11. Contact