Last updated: October 21, 2026
1. Data controller
The controller of the personal data collected on this site is Invest Madeira, with registered office at Rua Imperatriz Dona Amélia 1B, Galerias Savoy, Fração H, 9000-018 Funchal, Madeira — Portugal.
For any question about your data, contact investmadeira@madeira.gov.pt. The data protection officer can be reached at investmadeira@madeira.gov.pt.
2. What this policy covers
It covers invest-madeira.com in every language, the calculators, the cost report, the members' area, the emails we send from the site and the business contacts the team makes to promote investment.
It does not cover third-party sites we link to (for example YouTube, LinkedIn or Google Maps), which have their own policies.
3. What data we process and why
We only process the data each purpose needs. The table "Purposes, data, legal bases and retention" below describes each processing: what data, what for, on what legal basis and for how long.
In short: the data you give us when you ask for information, request the cost report or create an account; public business data about people the team contacts to promote investment in Madeira; and, only with your permission, anonymous visit statistics and the source of your visit.
We do not process special categories of data (health, ethnic origin, political or religious opinions) and ask you not to include them in messages.
4. Legal bases
Performance of a contract or steps taken at your request (Article 6(1)(b) GDPR): answering your request, sending the report you asked for, managing your member account and the simulations you save.
Consent (Article 6(1)(a) GDPR and Article 5 of Portuguese Law 41/2004): visit statistics, visit source and email news. You can withdraw it at any time, without affecting processing carried out before.
Legitimate interest (Article 6(1)(f) GDPR): site security, abuse prevention and business prospecting to promote investment in the Region. You can object at any time.
Compliance with legal obligations (Article 6(1)(c) GDPR): for example, keeping proof of the consent given in the cookie notice.
5. Business contacts (prospecting)
To promote investment in Madeira, the team may contact professionals at companies that could be interested in the Region. We only use business data (name, role, company, work email and, where available, public professional profile and company phone), obtained from public professional sources through the Hunter.io service, and public information about the company (sector, size, location).
The first contact explains where the data came from and includes a link to stop being contacted. Anyone who uses it is deleted, and the address is kept on a block list only as an irreversible code (hash), so we never contact them again. Data is deleted after 12 months without activity.
6. Visit statistics and cookies
Statistics only run if you allow them in the cookie notice. They use no cookies and store nothing on your device. To count unique visitors, we compute an irreversible code from the IP address and browser with a random key that changes every day and is deleted after 2 days; the IP address is never stored. Only anonymous daily totals remain.
We use no advertising, no social media pixels and no third-party analytics. Fonts and video thumbnails are served by the site itself. The full list of cookies and local storage is in the Cookie policy.
7. Who we share data with
Data is processed by the Invest Madeira team and by the service providers that help us run the site, acting as processors, only on our instructions and under contracts that require them to protect the data (Article 28 GDPR). The table "Recipients and processors" below shows who they are and where they process data.
We do not sell personal data or pass it on for third-party marketing. We may disclose data to public authorities where the law requires it.
8. Transfers outside the European Union
The site's data is stored on servers in the European Union (Google Cloud, Netherlands and Belgium regions). Some providers belong to groups based in the United States and may, in limited cases such as technical support, access data from outside the European Union.
In those cases, transfers rely on a European Commission adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses approved by the Commission, with additional security measures. You can ask for a copy of these safeguards at investmadeira@madeira.gov.pt.
9. How long we keep data
We keep data only for as long as each purpose needs, as shown in the table below. After that, it is deleted automatically or made anonymous.
We may keep data longer only where the law requires it or to establish or defend legal claims.
10. Your rights
You have the right to access, correct and delete your data, to restrict processing, to data portability, to object to processing based on legitimate interest (including prospecting) and to withdraw consent at any time.
If you have an account, you can download your data and delete the account under "My account → Privacy". For any other request, write to investmadeira@madeira.gov.pt. We reply within one month, extendable by two further months for complex requests, and may ask you to confirm your identity.
You can also lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt, or with the authority in your country.
11. Automated decisions
We make no decisions based solely on automated processing that produce legal effects or similarly significant effects on you. The calculators and the report work out indicative figures from what you type, without any decision about you; member accounts are always approved by a person on the team.
12. Security
We use encrypted connections (HTTPS with HSTS), encryption of data at rest, role-based access with least privilege, sessions in cookies that scripts cannot read, rate limiting, protection against requests from other sites and a content security policy (CSP).
Uploaded images are re-saved without metadata (such as GPS location). Team actions are logged. If a personal data breach poses a risk, we notify the CNPD within 72 hours and, where the risk is high, the people affected.
13. Children
The site is intended for professionals and investors. Member accounts are reserved for people aged 18 or over, and we do not knowingly collect data from children under 16. If you know a child has sent us data, contact investmadeira@madeira.gov.pt and we will delete it.
14. Changes to this policy
We may update this policy when the site or the law changes. The date of the last update is at the top of the page. If the change is significant, we tell members by email and, where it affects what you allowed in the cookie notice, we ask for your choice again.
Purposes, data, legal bases and retention
Each row is a processing of personal data carried out through the site or by the team.
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact requests | Name, email, phone (optional), company, country, topic, preferred contact method, message, page sent from and, if you allowed it, visit source | Answer and follow up the request | Steps at your request (Art. 6(1)(b)); visit source: consent (Art. 6(1)(a)) | 3 years after the request |
| Cost report | Name, email, company (optional), comparison country, team size, whether you accept news | Prepare and send the report; follow up interest in investing | Steps at your request (Art. 6(1)(b)) | Link valid 90 days; request kept 3 years |
| Email news | Name, email, language | Send news about investing in Madeira | Consent (Art. 6(1)(a)), which you can withdraw at any time | Until you withdraw consent |
| Member account | Name, email, company, country, phone, sector, interest, language; Google or Apple profile name and photo if you sign in that way; date the policy was accepted; approval status | Manage the account, approve access to the members' area and send account emails | Contract: terms of use (Art. 6(1)(b)) | As long as the account exists; deleted on request |
| Saved simulations | Values entered in the calculators | Show you your simulations in your account | Contract (Art. 6(1)(b)) | Until you delete them or the account |
| Business prospecting | Name, role, company, work email and phone, public professional profile, public sources, team notes, contact status | Promote investment in Madeira to companies | Legitimate interest (Art. 6(1)(f)), with a right to object | 12 months without activity; block list kept as a hash |
| Visit statistics | Page, language, screen width, time zone, referring site, campaign; daily irreversible code of IP and browser | Learn which pages are useful and improve the site | Consent (Art. 6(1)(a) and Art. 5 of Law 41/2004) | Daily code: 2 days; anonymous daily totals: no limit |
| Consent record | Random code kept in the cookie, choices made, policy version, date | Prove the consent given in the cookie notice | Legal obligation (Art. 6(1)(c) and Art. 7(1)) | 13 months |
| Security and abuse prevention | IP address as an irreversible code (rate limits), server technical logs, log of team actions | Protect the site, accounts and data | Legitimate interest and security obligation (Art. 6(1)(f) and Art. 32) | Rate limits: up to 24 hours; server logs: 30 days; team actions: 2 years |
| Emails sent by the site | Email, name and message content | Confirmations, account emails and reports | The basis of the processing the email belongs to | As for that processing |
Recipients and processors
Who processes personal data on behalf of Invest Madeira, or receives data when the visitor chooses so.
| Entity | What it does | Where it processes data |
|---|---|---|
| Google Cloud / Firebase (Google Ireland Ltd.) | Site hosting, database, files, authentication and technical logs | European Union (Netherlands and Belgium); occasional support from the US under the EU–US Data Privacy Framework |
| Invest Madeira's email provider (securemail.pro) | Sending the site's emails and receiving replies | European Union |
| Hunter.io (Hunter Web Services) | Source of public business data and email verification for prospecting | European Union (France) |
| DSPRO | Development, maintenance and technical support of the site | Portugal |
| Google and Apple | Only if you choose to sign in with your Google or Apple account: they confirm your identity and send us your name, email and photo. They act as independent controllers under their own policies. | European Union and US (EU–US Data Privacy Framework) |
| Groq and OpenWeb Ninja | Machine translation of the site's texts and public market data. They receive no personal data about visitors, members or contacts. | US (no personal data) |
| European Central Bank | Reference exchange rates, requested by the server. It receives no visitor data. | European Union (no personal data) |