(GDPR – Regulation (EU) 2016/679 and Portuguese Law no. 58/2019)

1. Data Controller

The data controller responsible for processing personal data is:

Foot Draft

Address: Rua Cidade da Horta nº6, 6A, 2605-785 Casal da Cambra, Portugal

NIF: 515188336

Phone: (+351) 915 702 578

Email: geral@foot-draft.com

2. Personal Data We Collect

We may collect and process the following personal data, depending on your interaction with the website:

• Identification and contact data (name, email, phone number)
• Billing data (invoicing details, including tax number if provided)
• Booking and purchase data (selected packages, dates, preferences, messages)
• Technical and usage data (IP address, device, browser, pages visited, cookie identifiers)

We only collect data that is necessary for the purposes described in this Privacy Policy.

3. Purposes of Processing

We process personal data for the following purposes:

• To manage bookings and provide the Services
• To communicate with customers regarding bookings, changes, and support
• To process payments and issue invoices
• To comply with legal and tax obligations
• To prevent fraud and improve platform security
• To improve the website and user experience
• To send marketing communications only where legally permitted and/or with your consent

4. Legal Bases

We process personal data based on one or more of the following legal grounds:

• Contract: processing necessary to perform a contract or take steps at your request before a contract
• Legal obligation: compliance with tax and consumer law requirements
• Legitimate interests: website security, fraud prevention, service improvement (balanced against your rights)
• Consent: where required (e.g., non-essential cookies, certain marketing)

5. Data Retention

We retain personal data only for as long as necessary for the purposes stated above and to comply with legal obligations
(including tax and accounting retention requirements). When no longer needed, data is securely deleted or anonymised.

6. Data Sharing

We do not sell or rent personal data. We may share data only with service providers strictly necessary to operate the business,
such as:

• Payment service providers
• Accounting and invoicing service providers
• Hosting and IT providers
• Authorities, when required by law

Service providers are bound by confidentiality and data protection obligations and may process data only under our instructions.

7. International Transfers

If any service provider processes data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place,
such as Standard Contractual Clauses (SCCs) or an adequacy decision, as required by GDPR.

8. Your Rights

Under GDPR, you may exercise the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object (in certain cases)
• Right to withdraw consent at any time (where processing is based on consent)

To exercise your rights, contact us at geral@foot-draft.com.

9. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access,
alteration, loss, or disclosure. However, no online system is 100% secure.

10. Supervisory Authority

You have the right to lodge a complaint with the Portuguese supervisory authority:
CNPD – Comissão Nacional de Proteção de Dados
https://www.cnpd.pt

11. Updates to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on this website.