Last Updated: 28 April 2026

1. Introduction

Welcome to Onda Flow Marketing Solutions Lda., a digital marketing agency incorporated under Portuguese law and headquartered in Portugal. We provide digital marketing services to clients worldwide, including services related to social media management, search engine optimization (SEO), paid advertising, content marketing, email marketing, and web analytics.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you visit our website, contact us, or engage with our services. It applies to all individuals whose personal data we process, including website visitors, subscribers, clients, and business contacts.

We are committed to complying with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), as incorporated into Portuguese law, the Lei n.º 58/2019 (the Portuguese Data Protection Law), and, where applicable, the privacy laws of other jurisdictions in which we operate or serve clients, including the California Consumer Privacy Act (CCPA) and the UK GDPR.

2. Data Controller

For the purposes of applicable data protection law, the data controller is:

OndaFlow

Rua Dr. Leonel Sotto Mayor, 25 Loja 8,

2500-225 Caldas da Rainha

Portugal

Email: hello@onda-flow.com

Phone: +351 913 729 100

NIF (Tax ID): 517444640

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at the above details or reach out to our designated Data Protection point of contact.

3. Information We Collect

3.1 Information You Provide Directly

We collect personal data that you voluntarily provide to us, which may include:

• Name, email address, phone number, and job title when you fill out a contact or inquiry form
• Business name, billing address, and payment information when you engage our services
• Email address and preferences when you subscribe to our newsletter or email communications
• Any information you include in correspondence, messages, or meeting calls with us

3.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical data through cookies and similar tracking technologies, including:

• IP address and approximate geolocation (country/city level)
• Browser type and version, operating system, and device information
• Pages visited, time spent on pages, and navigation paths
• Referring URLs and search terms used to find our website
• Interaction data such as clicks, scrolls, and form engagement

3.3 Data From Third Parties

We may receive data about you from third-party sources in the ordinary course of providing our services, including:

• Business contact information from LinkedIn or other professional platforms
• Analytics data from platforms such as Google Analytics and Meta Pixel
• Data provided by clients in relation to their own customers (in which case we act as a data processor — see Section 10)

4. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to improve your browsing experience, analyze site traffic, and support our marketing efforts. A cookie is a small text file placed on your device when you visit our website.

We use the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the website to function and cannot be disabled. They include cookies that manage your session and security preferences.

Performance / Analytics Cookies

These cookies collect information about how visitors use our website, such as which pages are visited most often. We use tools such as Google Analytics for this purpose. This data is aggregated and anonymized where possible. These cookies are only placed with your consent.

Functional Cookies

These cookies enable enhanced features and personalization, such as remembering your language preference. They may be set by us or by third-party providers. These cookies are only placed with your consent.

Marketing / Targeting Cookies

These cookies track your browsing activity to deliver relevant advertisements, including via Meta Pixel and Google Ads remarketing tags. They are only placed with your explicit consent.

You can manage or withdraw your cookie consent at any time by clicking the “Cookie Settings” link in the footer of our website. You may also configure your browser to refuse cookies; however, some parts of the website may not function correctly if you do so. For more information, please visit www.aboutcookies.org.

5. How We Use Your Personal Data

We use your personal data for the following purposes and on the following legal bases:

• To respond to enquiries and provide our services — Legal basis: Performance of a contract or pre-contractual steps
• To send you our newsletter and marketing emails — Legal basis: Consent (you may unsubscribe at any time)
• To manage our client relationships and fulfil contractual obligations — Legal basis: Performance of a contract
• To process payments and maintain financial records — Legal basis: Legal obligation
• To improve our website and services through analytics — Legal basis: Legitimate interests (we ensure these are balanced against your rights)
• To conduct targeted advertising and remarketing campaigns — Legal basis: Consent
• To comply with applicable legal obligations, including tax and regulatory requirements — Legal basis: Legal obligation
• To pursue or defend legal claims where necessary — Legal basis: Legitimate interests

6. Email Marketing

Where you have subscribed to receive our newsletter or other marketing emails, we will send you updates, industry insights, and information about our services. We use third-party email service providers (such as Mailchimp or similar) to manage our mailing lists and send emails.

Each marketing email we send will include a clear and easy-to-use unsubscribe link. You can opt out at any time, and we will action your request promptly (and in any event within 10 business days). Unsubscribing from marketing communications will not affect any transactional or service-related emails necessary to manage our relationship with you.

We may use tracking pixels within emails to determine whether emails have been opened and whether links have been clicked, in order to improve the relevance of our communications. This data is tied to your email address. If you do not wish to be tracked in this way, you may disable image loading in your email client.

7. Sharing Your Personal Data

We do not sell your personal data. We may share your data with trusted third parties only in the following circumstances:

• Service providers and sub-processors: We use third-party vendors to operate our business (e.g. cloud hosting, email platforms, CRM, analytics tools). These parties process data strictly on our behalf and under written data processing agreements.
• Clients: Where we act on behalf of a client and your data forms part of a campaign or project, we may share relevant data with that client.
• Legal and regulatory authorities: We may disclose data to comply with a legal obligation, court order, or regulatory requirement under Portuguese, EU, or other applicable law.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the relevant party, who will be bound by the terms of this Privacy Policy.

All third parties with whom we share personal data are required to maintain appropriate security measures and to use your data only for the purposes for which we disclose it.

8. International Data Transfers

As a global agency based in Portugal (within the European Union), we may transfer personal data to recipients outside the European Economic Area (EEA). Where we do so, we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions issued by the European Commission for the recipient country
• Binding Corporate Rules where applicable

You may request a copy of the relevant safeguards by contacting us at the details in Section 2.

9. Data Retention

We retain personal data for only as long as is necessary to fulfil the purposes for which it was collected, and in accordance with our legal obligations. Our general retention periods are as follows:

• Client and contract data: 10 years from the end of the contractual relationship (in accordance with Portuguese commercial and tax law)
• Email marketing subscriber data: Until you unsubscribe, plus 1 year for audit purposes
• Website analytics data: Up to 26 months (Google Analytics default), or as configured
• Enquiry and correspondence data: 2 years from the date of last contact
• Cookie consent records: 3 years

When data is no longer required, we securely delete or anonymize it.

10. When We Act as a Data Processor

In the course of providing digital marketing services to our clients, we may process personal data on behalf of those clients (for example, managing their advertising audiences, email campaigns, or website analytics). In such cases, our clients are the data controllers, and we act as data processors.

We process such data only on the documented instructions of the client and in accordance with a Data Processing Agreement (DPA) as required by Article 28 of the GDPR. If you are an individual whose data is processed as part of a client’s campaign, please contact the relevant client directly for information about how your data is handled.

11. Your Data Protection Rights

Depending on your location and applicable law, you may have the following rights in relation to your personal data:

• Right of access: To request a copy of the personal data we hold about you
• Right to rectification: To request correction of inaccurate or incomplete data
• Right to erasure: To request deletion of your personal data, subject to legal exceptions
• Right to restriction of processing: To ask us to limit how we use your data
• Right to data portability: To receive your data in a structured, machine-readable format
• Right to object: To object to processing based on legitimate interests or for direct marketing purposes

• Right to withdraw consent: Where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing
• Right not to be subject to automated decision-making: We do not currently make decisions about you solely by automated means with legal or significant effects

To exercise any of these rights, please contact us at [privacy@youragency.com]. We will respond within 30 days. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the Portuguese data protection authority:

Comissão Nacional de Proteção de Dados (CNPD)

Website: www.cnpd.pt | Email: geral@cnpd.pt | Tel: +351 213 928 400

12. Additional Rights for California Residents (CCPA)

If you are a resident of California, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, disclose, or sell
• The right to delete personal information we have collected from you, subject to certain exceptions
• The right to opt out of the sale or sharing of personal information (we do not sell your data)
• The right to non-discrimination for exercising your privacy rights

To exercise your California rights, please contact us at hello@onda-flow.com and indicate that you are submitting a CCPA request.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include SSL/TLS encryption, access controls, regular security reviews, and data minimization practices.

While we take reasonable precautions, no method of transmission over the internet is completely secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with our obligations under the GDPR.

14. Third-Party Websites and Services

Our website may contain links to third-party websites or integrate with third-party platforms (such as social media networks and advertising platforms). This Privacy Policy does not apply to those third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you use.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the “Last Updated” date at the top of this page and, where appropriate, notify you by email or by placing a prominent notice on our website.

We encourage you to review this policy periodically. Continued use of our website or services after any changes constitutes your acknowledgement of the updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

OndaFlow

Rua Dr. Leonel Sotto Mayor, 25 Loja 8,

2500-225 Caldas da Rainha

Portugal

Email: hello@onda-flow.com

Phone: +351 913 729 100

NIF (Tax ID): 517444640

We are committed to working with you to resolve any concerns about your privacy. If you are not satisfied with our response, you have the right to contact the CNPD (see Section 11).