Privacy Policy

The data controller is Baltasar Sampaio — Unipessoal, Lda., trading as Balta Brunch. The restaurant operates at R. do Dr. Barbosa de Castro 36, 4050-629 Porto, Portugal. Contact: geral@baltabrunch.pt

This site does not use tracking or advertising cookies. The only data processed is: • Language preference — stored in your browser's localStorage to remember the language you chose. You can delete it at any time in your browser settings. • Aggregated and anonymous visit data — via our analytics tool, we collect: page visited, country/region (derived from IP, which is not stored), browser type and device. This data is fully anonymous, with no possibility of individual identification, and is deleted after 90 days. • Performance data (Core Web Vitals) — via a ferramenta de medição de desempenho, we collect anonymous speed metrics to improve the site experience. • Contact form data — when you fill in the contact form, we collect your name, email, phone (optional), subject and message, so we can respond to your request. This data is validated and sent directly by email to our mailbox via our email delivery provider; it is not stored in any database or file on the site — the submission is not persisted anywhere in our infrastructure. • Job application data — when you fill in the application form on the recruitment page, we collect your name, email, phone (optional), position applied for and message, so we can evaluate your application. We accept unsolicited (spontaneous) applications: even when there are no open positions, we invite you to apply anyway through that form, and those applications are evaluated as well. Just like the contact form data, this data is validated and sent directly by email to rh@baltabrunch.pt via our email delivery provider; it is not stored in any database or file on the site — the submission is not persisted anywhere in our infrastructure. • Quote request data — when you fill in the quote request form on the Services page, we collect your email and message (required) and, if you choose to fill them in, your name, phone and type of service, so we can prepare and reply with a proposal. Just like the other two forms' data, this data is validated and sent directly by email to geral@baltabrunch.pt via our email delivery provider; it is not stored in any database or file on the site — the submission is not persisted anywhere in our infrastructure.

Language preference: legitimate interest (Art. 6(1)(f) GDPR) — functionality strictly requested by the user. Visit data: legitimate interest (Art. 6(1)(f) GDPR) — service improvement using fully anonymous data with no impact on data subjects' rights. Contact form data: taking steps at your request prior to entering into a contract, or, depending on the nature of your request, our legitimate interest in responding to enquiries (Art. 6(1)(b) or (f) GDPR). The box you tick on the form confirms that you have read this policy — it is not the legal basis for the processing; the basis is your own request to be contacted. Job application data: taking steps at your request prior to entering into a contract — including when the application is unsolicited — or, depending on the case, our legitimate interest in evaluating applications for our positions (Art. 6(1)(b) or (f) GDPR). As with the contact form, the box you tick confirms that you have read this policy — it is not the legal basis for the processing; the basis is your own application request. Quote request data: taking steps at your request prior to entering into a contract — preparing a proposal for our breakfast delivery service — or, depending on the nature of your request, our legitimate interest in responding to enquiries for that purpose (Art. 6(1)(b) or (f) GDPR). As with the other two forms, the box you tick confirms that you have read this policy — it is not the legal basis for the processing; the basis is your own quote request.

To operate, this site relies on service providers — in particular for hosting the site and for sending the emails generated by the forms. These providers act as processors: they access only the data needed for the task entrusted to them, are contractually bound to process it on the controller's behalf, and may not use it for their own purposes. Some of these providers are established outside the European Economic Area, in particular in the United States. In those cases, transfers take place under Standard Contractual Clauses approved by the European Commission and/or certification under the EU-US Data Privacy Framework. You can ask us for the current list of processors at geral@baltabrunch.pt.

Under GDPR you have the right to: access, rectify or erase your data; restrict or object to processing; data portability; withdraw consent at any time (where processing is based on consent). To exercise any right, contact us at geral@baltabrunch.pt. You also have the right to lodge a complaint with the CNPD (Portuguese Data Protection Authority): cnpd.pt

Language preference: until you clear your browser's localStorage. Analytics visit data: 90 days. Performance data: 90 days. Contact form messages: kept in the geral@baltabrunch.pt mailbox for up to 12 months after we respond to the request, after which they are deleted, unless a longer period is required by legal obligation. Our site itself does not keep any copy of the message — the only copy we keep is in that mailbox. The provider that handles delivery keeps its own record of it, under its own privacy policy. Applications: kept in the rh@baltabrunch.pt mailbox for up to 12 months after a decision is made on the application, or, in the case of unsolicited applications, after receipt, after which they are deleted, unless a longer period is required by legal obligation. Our site itself does not keep any copy of the application — the only copy we keep is in that mailbox. The provider that handles delivery keeps its own record of it, under its own privacy policy. Quote requests: kept in the geral@baltabrunch.pt mailbox for up to 12 months after we respond to the request, after which they are deleted, unless a longer period is required by legal obligation. Our site itself does not keep any copy of the request — the only copy we keep is in that mailbox, alongside contact form messages (the same address). The provider that handles delivery keeps its own record of it, under its own privacy policy.

The site runs on HTTPS and does not keep your data in any database: forms are validated and sent by email, and the only copy stays in the mailbox named above for each case. If a security breach nonetheless puts your data at risk, we report it to the CNPD within the 72 hours required by the GDPR and, where the risk to your rights is high, directly to you as well.

This site is not aimed at children and we do not knowingly collect data from minors. The recruitment form is intended for people of legal working age. If we become aware that we have received a minor's data without the authorisation of whoever holds parental responsibility, we delete it as soon as we know.

We make no automated decisions and carry out no profiling. Everything you send us through any of the forms is read by a person.

Any material changes will be reflected on this page with an updated date above.