How personal data is handled

MagicPill Mobility may process the following categories of personal data:

• information you submit through the contact or enquiry form on this website;
• your name, organisation, role, email address and telephone number, when supplied;
• messages, attachments and other content you voluntarily send;
• business correspondence exchanged in connection with a possible or existing engagement;
• basic technical, security and server-log data generated when you visit the website (such as IP address, browser type and pages requested);
• cookie or analytics data — only where those technologies are actually used and, for non-essential ones, with your prior consent.

If you subscribe to The MagicPill Brief, MagicPill Mobility processes the email address you provide, the date of subscription, the page or article that was the source of the subscription, and your subscription status (pending confirmation, confirmed or unsubscribed).

• Purpose: to send occasional editorial notes on mobility decisions, ITS, operations and governance to visitors who have actively requested them.
• Legal basis: Article 6(1)(a) GDPR — your consent, given by actively submitting your email address and confirming it through the double opt-in link sent to that address. No messages are sent to unconfirmed addresses.
• Data retained: email address, subscription and confirmation dates, source page, subscription status and unsubscribe date where applicable. Confirmation and unsubscribe tokens are stored only as one-way cryptographic hashes and are not readable by MagicPill Mobility.
• Abuse prevention: to limit unsolicited confirmation emails, short-lived rate-limiting records are kept for up to 24 hours. These records store one-way HMAC identifiers derived from the request IP address and the target email address; the original IP address is not stored.
• Unsubscribe: every message includes a one-click unsubscribe link. You can also unsubscribe at any time by writing to contact@magicpillmobility.com.
• Service providers: subscription records are stored on the same infrastructure that hosts the website (Lovable Cloud, with Supabase as backend sub-processor). Confirmation and Brief messages are delivered through Resend (Resend, Inc.), acting as email delivery sub-processor.

• responding to enquiries received through the website, email or telephone;
• taking steps requested by you before entering into a possible engagement;
• preparing proposals and discussing professional services;
• managing professional and contractual relationships;
• meeting accounting, tax and other legal obligations;
• protecting the security, integrity and availability of the website;
• measuring website use, only where lawful consent has been obtained for non-essential analytics.

• Article 6(1)(b) GDPR — steps taken at your request before entering into a contract, and performance of a contract;
• Article 6(1)(c) GDPR — compliance with legal obligations, including accounting and tax duties;
• Article 6(1)(f) GDPR — the legitimate interests of MagicPill Mobility in managing professional relationships, responding to enquiries and protecting the website;
• Article 6(1)(a) GDPR — your consent, where processing is based on it, such as optional analytics, marketing or non-essential cookies.

Personal data is not sold. It may be shared with the limited categories of recipients strictly necessary to operate the practice and this website:

• website hosting and technical infrastructure — Lovable (hosting platform) and its underlying content-delivery infrastructure;
• backend database and authentication for the editorial content area — Supabase, an infrastructure sub-processor engaged through Lovable;
• web fonts served over the public internet — Google Fonts and rsms.me (Inter);
• online scheduling for optional booking of a diagnostic conversation — Calendly, loaded only when you actively open the scheduling window;
• email delivery for The MagicPill Brief confirmation and messages — Resend (Resend, Inc.);
• email and communications — the personal and professional email systems used by MagicPill Mobility to receive and reply to enquiries;
• professional advisers — such as accountants or legal counsel, where genuinely necessary;
• public authorities — where disclosure is legally required.

Each provider is bound by contractual, confidentiality and security obligations appropriate to its role.

Some providers listed above (for example Google Fonts and Calendly) may process limited technical data outside the European Economic Area, in particular in the United States. Where this occurs, transfers rely on the safeguards published by those providers, including the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. No sensitive personal data is transferred internationally by MagicPill Mobility in the ordinary course of website use.

• General enquiries without follow-up — retained for up to 12 months and then deleted or anonymised.
• Business correspondence related to a possible engagement — retained for the duration of the discussions and for a reasonable period afterwards, typically up to 3 years.
• Contractual and accounting records — retained for the periods required by Portuguese tax and accounting law, typically 10 years.
• Technical and security logs — retained for short operational periods defined by the hosting providers.

Data is never stored indefinitely without a defined purpose.

Subject to the conditions set out in the GDPR, you have the right to:

• access your personal data;
• request rectification of inaccurate or incomplete data;
• request erasure, where legally permitted;
• request restriction of processing;
• object to processing based on legitimate interests;
• request portability, where applicable;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out beforehand;
• lodge a complaint with the Portuguese Data Protection Authority — Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

Requests may be sent to contact@magicpillmobility.com.

MagicPill Mobility uses reasonable technical and organisational measures to protect personal data — including HTTPS encryption in transit, access control for administrative interfaces, and reliance on established hosting and infrastructure providers. No system can guarantee absolute security, and information sent over the internet is transmitted at the sender's risk.

This website may link to third-party websites, including LinkedIn. Those websites operate under their own privacy policies, which apply once you leave this site.

This Privacy Policy may be updated to reflect changes in practice, technology or legal obligations. The date shown below indicates the most recent revision.