Privacy Policy

Lealia Advisory Partners, Lda. (NIF/NIPC 519187334), with registered office at Calçada da Picheleira, 40 1º Piso, 1900-371 Lisboa, Portugal ('we', 'us', or 'our'), is the controller of your personal data and is committed to protecting your privacy. This Privacy Policy explains how we collect, store, use, disclose and protect your information when you visit our website (lealiaap.com), use our services or make payments through our platform.

We collect information that you provide directly to us, including:

• Name, email address and contact information
• Company name and professional details
• Communication preferences
• Billing and payment data (e.g. cardholder name, billing address, transaction history - sensitive card data is processed directly by our payment service provider, not by us)
• Browsing data collected automatically through cookies and similar technologies (see section 7)
• Any other information you choose to provide

We use the information we collect to:

• Provide, maintain and improve our services
• Process payments and manage billing
• Communicate with you and respond to your inquiries
• Send marketing communications (with your consent)
• Prevent fraud and ensure transaction security
• Comply with legal and tax obligations (e.g. issuing invoices, accounting records)

Your personal data is stored on secure servers, managed by us or by trusted service providers. We retain your data only for as long as necessary to:

• Fulfil the purpose for which it was collected
• Comply with legal and tax obligations (in particular the retention periods for accounting records required by law in Portugal)
• Resolve any disputes and enforce our agreements

After that period, the data is securely deleted or anonymised.

When you make a payment through our website, processing is carried out by Stripe Payments Europe, Ltd., an electronic money institution authorised and supervised by the Central Bank of Ireland, which processes payments by credit/debit card and digital wallets (Apple Pay, Google Pay).

• We do not store full credit/debit card numbers on our own systems - that data is managed directly by Stripe, in compliance with the PCI-DSS Level 1 standard
• We share with Stripe only the data strictly necessary to process the transaction (e.g. amount, service reference, contact details for payment confirmation)
• We keep records of transactions (amount, date, service purchased, payment status) for billing, accounting and customer support purposes
• For more information on how Stripe processes data during payment processing, please see Stripe's privacy policy at stripe.com/privacy

We do not sell, trade or rent your personal data to third parties. We may share your data with:

• Trusted service providers who assist us in managing the website, the business and payment processing, subject to confidentiality obligations
• Competent authorities, when required by law

Our website uses only cookies that are strictly necessary for its operation and for the security of the payment process - namely session cookies and cookies required by our payment service provider (Stripe) to process the transaction securely.

We do not use third-party analytics, advertising or marketing cookies. For that reason, and under the applicable legislation (Law no. 41/2004 and the GDPR), these cookies do not require your prior consent, as they are indispensable for the operation of the website and the provision of the requested service. Should we use analytics or marketing cookies in the future, this policy will be updated and an appropriate consent mechanism will be presented.

You can manage or delete cookies at any time through your browser settings - please note that disabling strictly necessary cookies may affect the functioning of the website, including the payment process.

We implement appropriate technical and organisational measures to protect your personal data - including payment data - against unauthorised access, alteration, disclosure or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure.

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request the deletion of your data ('right to be forgotten'), subject to legal retention obligations (e.g. tax records of payments)
• Object to the processing of your data for marketing purposes at any time
• Lodge a complaint with the Portuguese Data Protection Authority (CNPD)

To exercise these rights, please contact us using the information provided on our website.

Lealia Advisory Partners, Lda. - NIF/NIPC: 519187334 - Registered office: Calçada da Picheleira, 40 1º Piso, 1900-371 Lisboa, Portugal

If you have any questions about this Privacy Policy or about our data and payment practices, please contact us through the form available on the website.

We use browser storage (cookies, localStorage and sessionStorage). Necessary items are always on; analytics, marketing and experience items are only activated with your consent and when the respective tool is enabled. Each line shows category, purpose, provider, duration and activation condition.

• Necessary — cookie choice (lealia_consent, localStorage): store your choice, version and date. Lealia. 12 months or until a new policy version. Always on.
• Necessary — language (language, localStorage; nf_country, Netlify cookie): show the site in your chosen language. Lealia / Netlify. 12 months. Always on.
• Necessary — valuation form progress (localStorage): keep your answers if you reload. Lealia. Deleted on submission. Always on.
• Necessary — visit source (lealia_attribution, sessionStorage): campaign parameters (utm, click identifiers), landing and referring page, no personal data, attached to valuation or contact requests. Lealia. Session; 90 days only with analytics consent.
• Analytics — Google Analytics 4 via Google Tag Manager (_ga, _ga_*): aggregate visit statistics. Google Ireland Ltd. Up to 14 months. Only with analytics consent.
• Marketing — Google Ads (_gcl_*) and LinkedIn Insight Tag (li_*, bcookie, lidc): measure campaigns and conversions. Google Ireland Ltd.; LinkedIn Ireland UC. Up to 90 days (Google) and up to 12 months (LinkedIn). Only with marketing consent and when enabled.
• Experience — Microsoft Clarity (_clck, _clsk): usage maps to improve the site, with form fields masked. Microsoft Ireland Operations Ltd. Up to 12 months (_clck) and 1 day (_clsk). Only with experience consent and when enabled.
• International transfers — Google, LinkedIn and Microsoft may process data in the USA under the EU-US Data Privacy Framework and/or standard contractual clauses.

You can review, change or withdraw consent at any time via “Cookie settings” in the site footer. On withdrawal, optional cookies are deleted; withdrawal does not affect the lawfulness of prior processing. We will ask again whenever this section changes materially.