Privacy policy
Last updated: 9 November 2026
mest respects your privacy. This policy explains which data we collect when you visit the mest.pt website, what we use it for and what your rights are, under the General Data Protection Regulation (GDPR) and Portuguese Law no. 58/2019.
1. Data controller
Carlos Alberto Estevinha (sole trader), tax number (NIF) 136172504, registered office at Rua Lagoa da Palha, 91, 2955-047 Pinhal Novo, Portugal.
Contact: info@mest.pt · +351 963 862 870
2. Data we collect
- Data you send through the contact form: name, email address and message.
- Technical browsing data: IP address and browser information, sent automatically when the page loads fonts and external content.
- Visit statistics (Google Analytics), only after consent: pages visited, length of visit, browser and device type, and location at country and region level. We have not enabled the collection of detailed device and location data.
- Cookies and local storage: see our Cookie policy.
We do not knowingly collect sensitive data or data from minors.
3. What we use the data for, and on what basis
| Purpose | Legal basis |
|---|---|
| Replying to requests sent through the form or by email | Steps at the request of the data subject (art. 6(1)(b) GDPR) |
| Ensuring the operation and security of the website | Legitimate interest (art. 6(1)(f) GDPR) |
| Showing the third-party video (Vimeo) | Consent (art. 6(1)(a) GDPR), given in the cookie banner |
| Measuring website visits (aggregated statistics, Google Analytics) | Consent (art. 6(1)(a) GDPR), given in the cookie banner |
4. How long we keep the data
Data from contact requests is kept for 12 months after the last communication, unless there is an ongoing matter or a legal obligation. It is then deleted.
Google Analytics statistics data is kept for 14 months.
5. Who we share data with
Hosting is provided by Amen (Teamblue) and email is managed by Microsoft (Microsoft 365). Both act as processors under data processing agreements.
We do not sell or transfer data to third parties for marketing purposes. Data is processed only by service providers who support us in running the website and email, under data processing agreements.
When the page loads external content, your IP address is sent to the provider of that content:
- Google Fonts (typefaces), whenever the website loads;
- Vimeo (São Francisco project video), only after consent;
- Google Analytics (visit statistics), only after consent;
For Google Analytics, Google acts as a processor under the data processing terms of the Google Analytics account. Statistics data is not used for ad personalisation, a feature that is disabled on this website.
The 360º virtual tour of the O|OITO project is hosted on this website and does not send data to other entities.
Some of these providers may process data outside the European Union. In such cases, the transfer relies on the safeguards provided for in the GDPR, including European Commission adequacy decisions such as the EU-US Data Privacy Framework, where applicable.
6. Your rights
Under the GDPR, you may at any time: access your data; ask for its correction or deletion; ask for restriction of processing or object to it; ask for data portability; and withdraw your consent, without affecting the lawfulness of processing carried out before.
To exercise these rights, write to info@mest.pt. We will reply within one month.
You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
7. Security
We apply appropriate technical and organisational measures to protect data against unauthorised access, alteration or loss. Transmission over the internet is never completely secure, so please do not send sensitive data through the form.
8. Changes to this policy
We may update this policy. The version in force is always the one published on this page, with the date of the last update.