01 · CONTROLLER
Who is the data controller
Post77, S.A. (NIPC 519065506) is the data controller. Registered seat: Estrada Nacional 254, km 45, Monte da Galvoeira, 7005-210 Évora, Portugal. Hardware engineering and manufacturing operate out of Oeiras Tech Valley, Portugal. For questions about this policy, contact partnerships@post77.com.
02 · WHAT WE COLLECT
Data we collect
Form submissions — when you submit a buyer or partner application we collect the fields you fill in (name, email, organisation, country, role, and free-text context). These are sent to our operations inbox and to a transactional email service (Resend).
Aggregate analytics — we run Plausible, a cookieless, privacy-first analytics product. It records page views, referrer, country (from IP at collection, not stored), and device class. It does not store a cookie, does not identify individuals, and does not export to third parties.
Locale preference — when you pick a language we store your choice in a first-party cookie named 'locale' (365-day max-age, SameSite=Lax). It is used only to honour your language choice on subsequent visits.
03 · LEGAL BASIS
Why we are allowed to do this
Form submissions: legitimate interest (pre-contractual due diligence) and, where relevant, your explicit consent at submission. Analytics: legitimate interest under GDPR Recital 47 (no personal data is stored). Locale cookie: necessary to deliver the service in your chosen language (exempt from consent under ePrivacy Art. 5(3)).
04 · RETENTION
How long we keep it
Buyer and partner application records are retained for up to 36 months from last interaction, then anonymised. Analytics is aggregate only and retained by Plausible according to their defaults. The locale cookie expires after 365 days or when you clear site data.
05 · SHARING
Who we share with
We use Resend for transactional email and Plausible for analytics — both are EU-aligned providers with documented data-processing terms. We do not sell data. We do not share with advertising networks. Where government or court-ordered disclosure applies, we comply with Portuguese and EU law.
06 · YOUR RIGHTS
Your GDPR rights
Access, correction, deletion, portability, restriction, objection, and the right to lodge a complaint with the Portuguese CNPD (Comissão Nacional de Proteção de Dados). Email partnerships@post77.com with the subject 'Data request' to exercise any of these.
07 · SECURITY
How we protect it
Form submissions travel over TLS. The site is hosted on Railway with application-level rate limiting and a honeypot against automated submissions. Internal access to submission records is restricted to the Post77 operations team.