Privacy
Short version: nothing non-essential is stored or loaded until you say so, and the only personal data we process is what you send us when you get in touch or become a client.
Who is responsible
Montra Web is the trading name of Justin Sterrenberg, a sole trader based in Alfeizerão, Portugal (NIF 301835241). For anything about your data, write to info@montraweb.com.
What we collect, and why
When you send the contact form: your name, business name and type, a WhatsApp number or e-mail address, your message and the language you wrote in. We use it to reply and to prepare a proposal. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). Submissions are stored by our host's form service and in our e-mail. If we don't end up working together, we delete them within 12 months; if we do, we keep them for the duration of the engagement and for as long as Portuguese tax and accounting law requires.
When you write to us on WhatsApp or by e-mail: whatever you send us, for the same purpose and on the same basis. WhatsApp is operated by Meta Platforms Ireland; their privacy policy applies to the transmission.
When you accept a project: your name, role, business name, NIF, invoice address, e-mail and phone, the details of the project, the version of our terms you accepted, the date and time and technical data such as your IP address and browser. We use them to perform the agreement, to invoice you and as proof of what was agreed. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legal obligations to issue and keep invoices (Art. 6(1)(c)). Invoices and accounting records are kept for 10 years, as Portuguese tax law requires; the acceptance record for as long as claims under the agreement can be made.
When you fill in the project brief: your answers about your business and any files you upload (logo, menu, photos). We use them only to build and look after your website. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Answers and files are stored by our host's form service and then moved to our project storage; uploads are removed from the form service within 60 days. We keep project material for the duration of the work and your care plan and delete it within 12 months after that, except what has to be kept with invoices. While you fill in the brief, your answers are saved only in your own browser so you don't lose them; nothing is sent to us until you press send, and the draft is deleted when you do.
Your customers' data on a site we host: when we host or look after your website, we process the data your site collects on your behalf, as your processor. That is governed by Annex A of our terms of service, not by this notice.
When you simply visit: our host processes technical data (IP address, browser, pages requested) to deliver the pages and protect the site against abuse, on the basis of legitimate interest (Art. 6(1)(f) GDPR). These logs are kept for a limited period and we don't use them to identify you.
Visit statistics (only if you allow Statistics): our own script records which pages are viewed, the site you came from, browser language, screen width, time on the page, scrolling, clicks on contact and booking links, that a form was sent (not what you typed), page-speed measurements and errors, with city, country and device type estimated from the request. It uses no cookies and no identifier that follows you from one visit to the next, and we look at the results only in aggregate, to improve the site. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in “Cookie settings”. The data is stored by Netlify and kept for up to 12 months.
Google Analytics (only if you allow Statistics): alongside our own script we use Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It records the pages you view, where you came from, your browser language, device type, approximate location (from a truncated IP address), time on the page and clicks on contact and booking links, and sets two first-party cookies (_ga, _ga_S0982VZQ4E, 180 days) to tell visits apart. We have switched off advertising features, Google Signals and data sharing with other Google products. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in “Cookie settings”; user and event data is kept in Google Analytics for 2 months. Google may process this data in the United States; Google LLC is certified under the EU–U.S. Data Privacy Framework and our contract with Google includes the EU Standard Contractual Clauses.
Cookies and tracking
We ask before setting any cookie that isn't strictly necessary. The only thing stored without asking is your own choice (a first-party cookie, kept 180 days). Statistics and marketing tools run only if you allow them in the cookie banner; every tool, cookie and duration is listed on the cookie policy page.
You can change or withdraw your choice at any time via “Cookie settings” in the footer. Fonts and scripts are served from montraweb.com, so simply opening a page sends nothing to Google or anyone else.
Who else sees your data
Netlify, Inc. (San Francisco, USA) hosts the site and stores form submissions. Netlify is certified under the EU–U.S. Data Privacy Framework and its data processing agreement includes the EU Standard Contractual Clauses.
Google LLC (Gmail and Google Drive, via Google Workspace) delivers our e-mail and stores project files for clients. Google is certified under the EU–U.S. Data Privacy Framework.
Google Ireland Limited (Dublin, Ireland) provides Google Analytics, described above. It runs only if you allow Statistics in the cookie banner. See Google's privacy policy and how Google Analytics uses data.
Cal.com, Inc. (United States) provides the booking calendar. It is loaded only if you allow embedded content in the cookie banner. If you book a call, what you enter — your name, e-mail address, an optional phone number and your answers to the short booking form — is processed by Cal.com and reaches us by e-mail and in our calendar. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). See Cal.com's privacy notice for how they handle it.
Payment providers. When you pay a deposit or invoice online, the payment is processed by the provider named on the payment page (for example Stripe or PayPal) under their own privacy notice. We receive confirmation of the payment, your name and e-mail and the amount — never your card details. Legal basis: performance of a contract and our legal obligations (Art. 6(1)(b) and (c) GDPR).
Meta Platforms Ireland Ltd. (WhatsApp), only if you choose to message us there.
We don't sell or share your data with anyone else, and we never use it for advertising.
Your rights
You can ask to see the data we hold about you, correct it, have it deleted, restrict or object to its use, or receive it in a portable format. Write to info@montraweb.com and we'll answer within a month. You can also complain to the Portuguese supervisory authority, the CNPD (cnpd.pt), or to the authority in your own country.
Security
The site is served over HTTPS only, with a strict Content Security Policy and other protective headers, and we collect as little as we can. The contact form is protected against spam without any tracking.
Changes
Last updated 20 September 2026. If we change how we handle your data, we'll update this page.