Privacy
What the site collects, and why.
Version in force since 16 October 2026
The draypec.com website collects data in two places: the contact form and, only with permission, the measurement and advertising tools described in section 6. This page says what happens to that data, in plain language, and how to exercise the rights set out in the General Data Protection Regulation (GDPR).
Who is responsible
The data controller is Duarte Raposo, operating under the Draypec brand, in Portugal. The contact for any privacy matter is [email protected].
What data is collected
Through the contact form, and only when a person fills it in:
- name and email;
- company and phone number, if given. Both are optional;
- the area chosen and the description of the problem, written by the person themselves;
- the preference between a reply by email and a call;
- the page the request came from, and the date.
The form does not ask for, and Draypec does not want to receive, passwords, card details, identity documents or any special category of data.
Data from the measurement and advertising tools, which only exists with permission, is described in section 6.
What it is used for
To read, assess and reply to the request made by the person themselves. The legal basis is taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). When the person writes on behalf of a company, the legal basis is the legitimate interest in replying to a business contact that was requested (Article 6(1)(f)). The same legitimate interest covers protecting the site against abuse.
A contact request does not subscribe anyone to a newsletter or a marketing list. There are no automatic sequences.
Where it is kept and who sees it
Requests are stored in a Cloudflare database (Cloudflare, Inc., USA; standard contractual clauses for transfers outside the European Union). Each new request reaches the person who replies through two channels: a message on Telegram (Telegram FZ-LLC) and an email, sent by Resend (Resend, Inc., USA) to Draypec's mailbox on Google Workspace (Google Ireland Limited). These providers carry or store the data on Draypec's behalf.
How long it is kept
A request that does not lead to a project is deleted 12 months after the last contact. A request that leads to a proposal or a contract is kept for as long as the relationship lasts and for the period required by the applicable legal obligations. A deletion request brings any of these periods forward.
Cookies and measurement
A cookie is a small file the browser keeps at a site's request, so the site can recognise the browser on the next visit. The site uses cookies from two groups, measurement and advertising, and only switches them on after the person accepts them in the notice shown on the first visit. Until then, none of this is switched on and none of these cookies is created.
The choice is made with the Reject and Accept buttons, or under Choose, to switch on only what the person wants. It is kept in the browser itself for 12 months and never leaves it. After that, the site asks again. Cookie settings, in the footer, opens the same choice at any time. The legal basis is consent (Article 6(1)(a) GDPR), which can be withdrawn at any time without affecting what was done before.
For measurement, Google Analytics 4, from Google Ireland Limited, counts visits, pages viewed and where each visit comes from (search or an ad, for example). Draypec sees numbers per page and per source, with nobody's name or email. Google's code stays blocked until consent is given and, without it, sends nothing (this is Google's own Consent Mode v2).
For advertising, the site uses only LinkedIn Insight Tag, from LinkedIn Ireland Unlimited Company. It shows which LinkedIn ads led to a contact request and lets Draypec show ads again to people who have visited before. It also gives Draypec totals about who visits (industry or job title, for example). Nobody is identified. According to LinkedIn, direct identifiers are removed within 7 days and the rest is deleted within 180 days.
Google Ireland Limited and LinkedIn Ireland Unlimited Company may transfer data to the United States under the safeguards each publishes in its privacy policy.
Cloudflare, which serves the site, may set cookies that are strictly necessary for security and operation; the main one is in the list at the end of this section.
The contact form uses Cloudflare Turnstile to stop spam: a check that runs in the background and, in most cases, shows nothing. For this, Cloudflare receives the IP address, characteristics of the browser and the connection, and the identity of the site. Cloudflare says these signals are used only to detect automated programs and do not let it directly identify anyone. In the configuration the site uses, Turnstile does not create cookies.
Cookie list
Google Analytics 4
_ga, on the draypec.com domain: distinguishes visitors; lasts 2 years._ga_PT26FNPHJM, on the draypec.com domain: keeps the session; lasts 2 years.
LinkedIn Insight Tag
li_fat_id, on the draypec.com domain: indirect member identifier, to measure and re-show ads; lasts 30 days.bcookie, on the linkedin.com domain: browser identifier, used to detect abuse; lasts 1 year.lidc, on the linkedin.com domain: picks which LinkedIn server replies; lasts 24 hours.UserMatchHistory, on the linkedin.com domain: pairs LinkedIn ad identifiers; lasts 30 days.- The rest are listed in LinkedIn's cookie table.
Cloudflare
__cf_bm, on the draypec.com domain: tells people apart from automated programs; expires after 30 minutes of inactivity.
Your rights
Anyone can ask for access to their data, its correction, its erasure, the restriction of processing or data portability, or object to the processing, by writing to [email protected]. The reply arrives within one month. There is also the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt).
Changes
This policy is revised when the site starts collecting something it does not collect today. The date at the top is the date of the version in force.
Privacy contact
[email protected]