Privacy and data protection

This is a translation of the Portuguese original, which is the version that prevails in case of any discrepancy.

This notice explains what personal data the buildpor.pt website collects, what it is used for, who else has access to it, how long it is kept and what rights you have over it.

Last updated: 18 August 2026 · version 2. Changes are recorded at the foot of this page.

Who is responsible

Buildpor is a brand of Iberpolymers, Lda, which is the controller responsible for the personal data collected through this website.

For any question about this notice, or to exercise the rights described below, write to it@iberpolymers.pt or to the postal address above, marked for the attention of data protection. We have no designated data protection officer; this is the channel for all privacy matters.

What this site collects

This site is a catalogue. It has no user accounts, it does not sell online and it asks you for nothing in order to browse it: you can read every page, download the datasheets and go through the products without giving us any information about yourself.

There are three situations in which personal data is processed, and they are the three that follow. There is no other.

1. The contact form

What data, and what for

When you send an enquiry through the contacts page, we collect what you wrote in that form — name, company, email address, telephone and message — plus the language of the page you were on, so that we answer you in the same language. Name, email and message are required: without them we have no way to understand the enquiry or to reply. Company and telephone are optional and you can leave them blank with no consequence at all.

That data serves only to read your enquiry, to answer it and, where applicable, to prepare a quote. It is not used for campaigns or any other commercial communication, it is not combined with other sources of information, it does not feed advertising, and it is neither sold nor passed to third parties for purposes of their own.

On what basis

If your enquiry is aimed at a possible quote or order, the processing is necessary for the pre-contractual steps you asked us to take — Article 6(1)(b) of the General Data Protection Regulation. If it is a question of another kind, we process the data on the basis of our legitimate interest in replying to whoever contacts us, under point (f) of the same Article; that interest is exhausted by replying to you.

We do not ask for your consent for this, and that is deliberate: what makes the processing lawful is your own enquiry, not an authorisation from you. That is why the form has no box to tick — only a line saying what the data is for, and a link to this page.

Who has access

The enquiry arrives by email at comercial@buildpor.pt and is read by the Iberpolymers sales team. Three service providers take part along the way, each only so far as its own part requires: Vercel, which hosts the site and runs the form, Resend, which delivers the email, and Microsoft, where the mailbox is. They are identified one by one — with what they do, where they are and under which mechanism — in the Processors and transfers section below.

Beyond these, the data is disclosed only to courts or other authorities where the law requires it.

How long it is kept

If the contact does not lead to a commercial relationship, the enquiry is deleted 24 months after the last exchange of messages — a period that covers the usual decision cycle on a construction project. If it does lead to an order, the data becomes part of the customer file and falls under the applicable statutory retention periods, in particular accounting and tax ones.

2. Cookies and advertising measurement

What loads, and when

This site sets no advertising or analytics cookies before you authorise them. On your first visit you see a notice with two options — Accept and Decline — and until you choose, nothing third-party is loaded. If you decline, nothing is ever loaded. If you accept, Google Tag Manager is loaded, which in turn triggers Google’s advertising conversion measurement (Google Ads).

Which cookies exist

There are three entries, and only these. The first and the third live in the browser’s local storage rather than in cookies proper — the law treats both forms the same way, which is why they are listed together.

On what basis, and how to withdraw

The only basis for these cookies is your consent — Article 6(1)(a) of the General Data Protection Regulation and Article 5 of Portuguese Law 41/2004. You can withdraw it at any time, as easily as you gave it: at the foot of every page on this site there is a Cookies link that reopens the notice and lets you change your choice. On declining, Google’s cookies are deleted from your device and the page is reloaded without them. Withdrawing consent does not affect the lawfulness of what was measured while it lasted.

3. The map on the contacts page

The contacts page can show our location on a map provided by Google, but it loads it only when you ask. Until you press Show map, no Google server is contacted: in the map’s place the address appears as text, on the page itself.

If you do press that button, your browser contacts Google’s servers directly — among others google.com, maps.googleapis.com and fonts.googleapis.com — which receive your IP address and information about the device you are using, and may set cookies of their own. That is why we ask first, and why we say so beside the button and not only here.

The choice applies to that visit and is not stored anywhere: if you come back later, the map waits to be asked again. If you prefer, you can instead open our location in Google Maps, on Google’s own site, from the same block.

What Google does with the data it receives that way is governed by Google’s own privacy policy, at policies.google.com/privacy.

Processors and transfers

Four service providers process personal data on our behalf. All are bound by a processing contract under Article 28 of the Regulation, which obliges them to process the data only on our instructions and not to use it for purposes of their own.

The three established in the United States appear, with active status, on the list of participants in the EU-U.S. Data Privacy Framework maintained by the U.S. Department of Commerce — confirmed on 18 August 2026 at dataprivacyframework.gov/list, where you can confirm it too. The transfers therefore rest on the adequacy decision adopted by the European Commission on 10 July 2023.

We also invoke, in parallel, the standard contractual clauses included in the contract with each of them. This is not redundancy: certification has to be renewed every year and can lapse, in which case it is the clauses that carry the transfer, without anything on this page ceasing to be true. We re-confirm each certification periodically, and the date above says when that last happened.

The mailbox is provided by Microsoft Ireland Operations Ltd., established in Ireland, so there is no third-country transfer to declare there. Under the EU Data Boundary, Microsoft commits to storing and processing customer data for the services in scope within the European Union; support access from outside the European Economic Area rests on standard contractual clauses between Microsoft Ireland and Microsoft Corporation, whose certification under the framework above is likewise active.

You may ask us, through the contact given at the start, for a copy of the safeguards applicable to any of these transfers.

Your rights

Over the personal data we process, you have the following rights:

• Access — to know what data of yours we hold and to obtain a copy.
• Rectification — to correct what is wrong and complete what is incomplete.
• Erasure — to ask for the data to be deleted, where it is no longer necessary for the purpose that justified it.
• Restriction — to ask us to suspend the processing, keeping the data, while a question about it is being resolved.
• Portability — to receive the data you provided to us in a structured, commonly used format.
• Objection — to object to processing that rests on our legitimate interest.
• Withdrawal of consent — for cookies, at any time and in the way described above.

To exercise any of them, write to it@iberpolymers.pt. We reply within one month, extendable by two months for particularly complex requests, in which case we will tell you within the first month. We may need to confirm your identity before acting, and only for that.

We take no automated decisions about you and carry out no profiling with the data collected through this site.

Complaint to the supervisory authority

If you consider that your data has not been handled as it should, you may lodge a complaint with the Comissão Nacional de Proteção de Dados, the Portuguese supervisory authority, at www.cnpd.pt. We would welcome the chance to resolve the matter first, but that right is yours and does not depend on contacting us beforehand.

Security

The site is served exclusively over an encrypted connection (HTTPS). We collect no passwords, no payment data and no special categories of data — there is nothing on this site that asks for them. Access to the enquiries received is limited to those people at Iberpolymers who need them in order to reply, and every service provider that processes them is bound by a processing contract under Article 28 of the Regulation.

Should a personal data breach ever occur with a risk to your rights, we will comply with the duties to notify the Comissão Nacional de Proteção de Dados and, where the risk warrants it, to inform the people affected directly.

Changes to this notice

When this notice changes materially, the version and date at the top of the page change with it, and the change is described below. It is worth returning to this page if you contacted us some time ago.

• Version 2 — 18 August 2026. Notice rewritten in full from the actual inventory of processing on this site. It now identifies the contact form, the existing cookies one by one and the map on the contacts page; and adds the lawful bases, the retention periods, the service providers by name, the transfers outside the European Union and the complete set of rights. It no longer describes processing that does not exist on this site — invoicing, subscriber lists, telephone directories and telemarketing — inherited from the previous version. It also now exists in English, French and Spanish.
• Changes to the site on the same date. The map on the contacts page no longer loads by itself and waits to be asked. Consent to cookies can now be withdrawn through the Cookies link in the footer, which did not exist before — giving and withdrawing now cost the same click. And the contact form no longer carries the mandatory box reading “I confirm that I have read and accept the terms of the Privacy Policy”: consent that cannot be refused without losing the service is not freely given, and a privacy notice is not a thing to agree to. Information stands in its place, and the basis for the processing is declared above.
• Version 1 — June 2023. First published version, shared with several other sites in the group.