Privacy
What Draypec collects, and why.
Version in force since 21 October 2026
Draypec collects data in three places: the contact form on draypec.com, the Cal.com page where the call is booked and, only with permission, the measurement and advertising tools described in section 6. This page says what happens to that data, in plain language, and how to exercise the rights set out in the General Data Protection Regulation (GDPR).
Who is responsible
The data controller is Duarte Raposo, operating under the Draypec brand, in Portugal. The contact for any privacy matter is [email protected].
What data is collected
Through the contact form, and only when a person fills it in:
- name and email;
- company and phone number, if given. Both are optional;
- the area chosen and the description of the problem, written by the person themselves;
- the preference between a reply by email and a call;
- the page the request came from, and the date.
The form does not ask for, and Draypec does not want to receive, passwords, card details, identity documents or any special category of data.
Whoever books the call leaves, on the Cal.com page, their name, their email, their time zone, the time chosen, the company and, if they wish to answer, the reason for the call.
Data from the measurement and advertising tools, which only exists with permission, is described in section 6.
What it is used for
To read, assess and reply to the request made by the person themselves. The legal basis is taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). When the person writes on behalf of a company, the legal basis is the legitimate interest in replying to a business contact that was requested (Article 6(1)(f)). The same legitimate interest covers protecting the site against abuse.
A contact request does not subscribe anyone to a newsletter or a marketing list. The only automatic emails are those for the call booking, sent by Cal.com: the confirmation, a reminder an hour before and, if the time changes or the call is cancelled, the notice of that change.
Where it is kept and who sees it
Requests are stored in a Cloudflare database (Cloudflare, Inc., USA; standard contractual clauses for transfers outside the European Union). Each new request reaches the person who replies through two channels: a message on Telegram (Telegram FZ-LLC) and an email, sent by Resend (Resend, Inc., USA) to Draypec's mailbox on Google Workspace (Google Ireland Limited). Whoever books the call chooses the time on a Cal.com page (Cal.com, Inc., USA; standard contractual clauses), which opens outside draypec.com. Cal.com stores the booking data (name, email, time zone and the answers given on that page) and creates the event, with the Google Meet video call link, in Draypec's calendar on the same Google Workspace. These providers carry or store the data on Draypec's behalf.
How long it is kept
A request that does not lead to a project is deleted 12 months after the last contact. A request that leads to a proposal or a contract is kept for as long as the relationship lasts and for the period required by the applicable legal obligations. A deletion request brings any of these periods forward. The Cal.com booking and the calendar event follow the same periods.
Cookies and measurement
A cookie is a small file the browser keeps at a site's request, so the site can recognise the browser on the next visit. The site uses cookies from two groups, measurement and advertising, and only switches them on after the person accepts them in the notice shown on the first visit. Until then, none of this is switched on and none of these cookies is created.
The choice is made with the Reject and Accept buttons, or under Choose, to switch on only what the person wants. It is kept in the browser itself for 12 months and never leaves it. After that, the site asks again. Cookie settings, in the footer, opens the same choice at any time. The legal basis is consent (Article 6(1)(a) GDPR), which can be withdrawn at any time without affecting what was done before.
For measurement, Google Analytics 4, from Google Ireland Limited, counts visits, pages viewed and where each visit comes from (search or an ad, for example). Draypec sees numbers per page and per source, with nobody's name or email. Google's code stays blocked until consent is given and, without it, sends nothing (this is Google's own Consent Mode v2).
For advertising, the site uses only LinkedIn Insight Tag, from LinkedIn Ireland Unlimited Company. It shows which LinkedIn ads led to a contact request and lets Draypec show ads again to people who have visited before. It also gives Draypec totals about who visits (industry or job title, for example). Nobody is identified. According to LinkedIn, direct identifiers are removed within 7 days and the rest is deleted within 180 days.
Google Ireland Limited and LinkedIn Ireland Unlimited Company may transfer data to the United States under the safeguards each publishes in its privacy policy.
Cloudflare, which serves the site, may set cookies that are strictly necessary for security and operation; the main one is in the list at the end of this section.
The contact form uses Cloudflare Turnstile to stop spam: a check that runs in the background and, in most cases, shows nothing. For this, Cloudflare receives the IP address, characteristics of the browser and the connection, and the identity of the site. Cloudflare says these signals are used only to detect automated programs and do not let it directly identify anyone. In the configuration the site uses, Turnstile does not create cookies.
Cookie list
Google Analytics 4
_ga, on the draypec.com domain: distinguishes visitors; lasts 2 years._ga_PT26FNPHJM, on the draypec.com domain: keeps the session; lasts 2 years.
LinkedIn Insight Tag
li_fat_id, on the draypec.com domain: indirect member identifier, to measure and re-show ads; lasts 30 days.bcookie, on the linkedin.com domain: browser identifier, used to detect abuse; lasts 1 year.lidc, on the linkedin.com domain: picks which LinkedIn server replies; lasts 24 hours.UserMatchHistory, on the linkedin.com domain: pairs LinkedIn ad identifiers; lasts 30 days.- The rest are listed in LinkedIn's cookie table.
Cloudflare
__cf_bm, on the draypec.com domain: tells people apart from automated programs; expires after 30 minutes of inactivity.
Your rights
Anyone can ask for access to their data, its correction, its erasure, the restriction of processing or data portability, or object to the processing, by writing to [email protected]. The reply arrives within one month. There is also the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt).
Changes
This policy is revised when the site starts collecting something it does not collect today. The date at the top is the date of the version in force.
Privacy contact
[email protected]