Last updated: October 2026
1. Data controller
STCM, Unipessoal Lda, trading as STCM Construção, Portuguese tax number (NIF) 517036932, registered office at Avenida da Cal, Lote 125, 1.º andar, 4750-787 Barcelos, Portugal. Email geral@stcmgrupo.pt, phone +351 938 633 625.
2. What data we collect
- Quote requests: name, phone, email, site location, description of the work and any files you attach.
- Subcontractor and supplier registration: company details, contact person and documents sent.
- Job applications: the details in the CV and message you email to us.
- WhatsApp, phone or email contact: the details you share with us in that conversation.
3. Why we use it and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your request and preparing a quote | Steps taken at your request before a contract, Art. 6(1)(b) |
| Carrying out the contracted works and invoicing | Performance of a contract and legal obligations, Art. 6(1)(b) and (c) |
| Assessing and hiring subcontractors and suppliers | Pre-contractual steps and legitimate interest, Art. 6(1)(b) and (f) |
| Recruitment | Pre-contractual steps and consent, Art. 6(1)(a) and (b) |
4. How long we keep it
- Quote requests that do not go ahead: up to 2 years.
- Clients: for the works and the warranty period, and for the legal retention periods for tax and accounting records.
- Subcontractors and suppliers: while we work together and up to 2 years after.
- Job applications: up to 12 months, unless you allow us to keep your CV longer.
5. Who we share it with
We do not sell data. We only share it with providers that help us operate, such as website hosting and email, under GDPR safeguards, and with public authorities when the law requires it. Project files may be shared with designers and subcontractors only to prepare the quote or carry out the works.
6. Your rights
You can ask to access, correct, erase, restrict, object to or port your data, and withdraw consent at any time, by writing to geral@stcmgrupo.pt. We reply within one month. You can also complain to Portugal’s data protection authority, the CNPD (www.cnpd.pt), or to the authority in your own country.
7. Security
We use technical and organisational measures to protect data against loss, unauthorised access or disclosure.