Privacy & personal data
Privacy Policy
Last updated: 1 September 2026
Soul Genius, Lda. («Soul Genius», «we») respects your privacy. This document explains what information we collect, how we use it, and how you can exercise your rights as a data subject under the General Data Protection Regulation (GDPR) and other applicable laws.
1. Data controller
The data controller is Soul Genius, Lda., headquartered in Lisbon, Portugal, with a team in São Paulo, Brazil.
For questions about this policy or to exercise your rights, contact us at hello@soulgenius.eu or through the contact/Calendly form on the website.
2. Data we collect
We only collect data strictly necessary to respond to your requests and deliver our services: name, email, company, job title, country and the message you send us.
When you book a meeting through Calendly, the data you provide (name, email, date/time of the meeting) is processed directly by that platform, subject to its privacy policy.
We also collect technical data through cookies and analytics scripts: IP address, device type, browser, pages visited and traffic source. This data is anonymised whenever possible.
3. Purpose of processing
We use your personal data to: respond to contact and quote requests; schedule and manage consulting meetings; send communications about our services when authorised; improve user experience and website security; and comply with legal obligations.
4. Legal basis
The processing of your data is based on your free and informed consent (e.g. newsletter subscription), the performance of a contract or pre-contractual measures (e.g. proposals and meetings), and the legitimate interest of Soul Genius in responding to requests and ensuring system security.
5. Data retention
We keep your data only for as long as necessary for the purpose for which it was collected or for the period required by law. Commercial contact data is retained for up to 24 months after the last active contact, unless you request earlier deletion.
6. Data sharing
Soul Genius does not sell personal data to third parties. We may share data with trusted subcontractors (hosting, email, analytics, meeting scheduling) whenever a GDPR-compliant data processing agreement is in place.
7. International transfers
We prefer providers with infrastructure in the European Union. When we need to use providers outside the EEA, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses.
8. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction, including encryption in transit (TLS/SSL) and restricted access controls.
9. Cookies and similar technologies
We use essential, preference, analytics and advertising/retargeting cookies. By continuing to browse, you agree to the use of non-essential cookies unless you disable this option in the consent banner.
You can manage your cookie preferences through the consent banner or your browser settings.
10. Your rights
- Right of access to your personal data
- Right to rectification of inaccurate or outdated data
- Right to erasure («right to be forgotten»)
- Right to restriction of processing
- Right to data portability
- Right to object to processing based on legitimate interest
- Right to withdraw consent at any time
Exercise your rights
To exercise any of your rights, ask questions about this policy or lodge a complaint, please contact us. You may also lodge a complaint with the Portuguese data protection authority (CNPD).