Privacy Policy

1. Who is responsible for your data

MAKEITTECH, LDA, a Portuguese private limited company (sociedade por quotas), tax and registration number 515747181, registered office at Rua Fernando Pessoa, n.º 31, 4.º N, 3800-740 Eixo, Aveiro, Portugal ("MAKE IT", "we", "us").

For anything about your data: contact [at] make-it.tech.

We have not appointed a data protection officer, as the law does not require one for our activity. Requests are handled directly by the management.

2. What we collect and why

Contact form. Data: name, email, phone (optional), message, project stage (optional) and how you found us: the page you landed on, the site you came from and the campaign parameters in the link (utm), kept only in the page's memory during your visit. Purpose: to reply to you, understand your project and, where it makes sense, prepare a proposal; the visit source tells us which channels bring us enquiries. Legal basis: if you write on your own behalf, steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); if you write on behalf of a company, our legitimate interest in answering enquiries and managing business relationships with companies (Article 6(1)(f)). The visit source relies on our legitimate interest in measuring how well our communication works. Retention: 3 years after our last contact. If you become a client, your data is then governed by the contract and by the statutory retention periods for accounting and tax records.

Job applications (form at /tetris). Data: name, email, phone (optional) and the message in which you tell us why you would like to work with us, plus anything you choose to include in it. Purpose: to assess your application and talk to you about opportunities at MAKE IT. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR). Retention: 2 years after we receive it; if you want us to delete it sooner, just ask. Please do not include sensitive data (health, beliefs, ethnic origin or other special categories). We do not need it.

Deck requests (/decks). Data: email, profile (for example student, engineer, journalist, investor) and, if you choose "startup" or "company", company, LinkedIn and phone (all optional), language, the deck requested and the visit source (as in the contact form). We also record the date and time of the request and when you first open the link we email you. Purpose: to email you the deck; to know who is interested in our content and, where it makes sense, talk to you about your project. Legal basis: sending the deck is the service you asked for (Article 6(1)(b) GDPR); recording the request, the opening of the link and later requests relies on our legitimate interest in understanding interest in our content and in following up with companies (Article 6(1)(f)). You can object at any time (section 8). Retention: 3 years after your last request; deletion is automatic.

News by email. We only send you news about product R&D, events and Virtual Datasheet if you tick the box for it in the deck form, which is unticked by default. Legal basis: your consent (Article 6(1)(a) GDPR and Article 13-A of Portuguese Law 41/2004). We keep the exact wording you accepted and the date, so that we can prove your consent. You can withdraw it at any time through the link in every email or by writing to contact [at] make-it.tech; withdrawal does not affect anything done before it. Retention: until you withdraw your consent. After that we keep only your email on a suppression list, so we never write to you again, and the record of your consent and its withdrawal for 5 years.

3. Visit statistics

We use Umami to count visits and clicks in aggregate (pages viewed, country, device type and browser, referring site). Umami does not use cookies or store anything in your browser. Your IP address is used to calculate a visitor identifier and is not stored as such. We do not use these statistics to identify you. If your browser sends a "Do Not Track" signal, we do not count your visit.

Legal basis: our legitimate interest in understanding how the site is used and improving it (Article 6(1)(f) GDPR).

4. What is stored in your browser

We do not use our own cookies.

"Remember me" for decks (localStorage, mkit_deck_access): only if you tick "Remember me on this browser", we store your answers in your browser (email, profile and, if you filled them in, company, LinkedIn and phone), so you can open other decks without filling in the form again. Each deck you open after that is recorded as a new request. It expires after 12 months and you can delete it at any time with the "Forget" button on /decks or by clearing this site's data in your browser.

5. Third-party content and links

Homepage video: the Vimeo player only loads when you press "play", with viewer tracking turned off. From then on, Vimeo receives your IP address and technical browser data and applies its own privacy policy.

External links: the site links to LinkedIn, Instagram, YouTube, Notion and Gamma (one of our decks is hosted on Gamma). If you follow them, those sites' own policies apply.

6. Who we share your data with

We do not sell your data or share it for third-party marketing. We use the following providers, who process data on our behalf and on our instructions:

Google (Google Cloud, Firebase and Google Workspace): hosting of the site and of the functions that receive the forms, in the europe-west1 region (Belgium); email, the request spreadsheet and sending the deck emails.

Formspark (Trampoline Software SRL, Belgium): receiving and forwarding contact and job application messages, with data in Ireland and Germany, according to Formspark.

Umami (Umami Software, Inc., USA): aggregate visit statistics.

Some of these providers, or their sub-processors, may process data outside the European Economic Area. In that case the transfer relies on a European Commission adequacy decision (for example the EU-US Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795, for certified companies) or on standard contractual clauses approved by the Commission. You can ask us for a copy of the applicable safeguards at contact [at] make-it.tech.

We may also disclose data to public authorities where the law requires it.

7. Required data

In the contact and job application forms, name, email and message are needed for us to reply. In the deck form, email and profile are needed for us to send you the deck. All other fields are optional. You have no legal obligation to give us this data; if you do not, we simply cannot reply or send you the deck.

We do not make automated decisions or carry out profiling that affects you.

8. Your rights

At any time and free of charge, you can access the data we hold about you, ask us to rectify or erase it, ask us to restrict processing, ask for portability of the data you gave us (where processing is based on consent or contract), withdraw your consent to news by email and object to processing based on our legitimate interest, on grounds relating to your particular situation. You can object at any time, without giving reasons, to the use of your data for direct marketing.

To exercise these rights, write to contact [at] make-it.tech. We reply within one month, which may be extended in the cases provided for in the GDPR. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or with the authority of the EU Member State where you live or work.

9. Security

Forms are sent over an encrypted connection (HTTPS) to functions hosted in the European Union, which validate the data before forwarding it. Access to the request spreadsheet and mailboxes is limited to the MAKE IT team. Server technical logs (for example IP address and time of request) are kept by the hosting provider for 30 days, for security and error diagnosis.

10. Changes

If we change this policy, we will publish the new version on this page with its update date. If the change matters to people who gave us data based on consent, we will let them know by email.