Privacy policy

Privacy policy

Last updated: 13 October 2026

In short

  • We only collect the data you send us through the forms, by email or by phone, plus the technical logs needed to run the website securely.
  • We use that data to respond to your request, book the call and prepare a proposal. We do not sell it or use it for advertising.
  • The website does not use advertising or analytics cookies. We count visits in aggregate with Cloudflare Web Analytics, without cookies and without identifying you. During your visit, your browser only stores where the visit came from and the first page you opened.
  • You can ask to access, correct or delete your data at any time by writing to [email protected].

Who is responsible for your data

The controller of the personal data collected on this website is:

Field Details
Entity Salty Swagger, Lda. (“Xcope”)
Company number (NIPC) 518748944
Registered office Rua do Teatro, 193, 1.º andar, 4150-726 Porto, Portugal
Email [email protected]
Phone (+351) 918 086 155
Data protection contact [email protected]

For any question about this policy or your data, write to [email protected].

What data we collect

Contact form (“Book a call”)

Data Required
Name Yes
Company Yes
Work email Yes
Industry No
Message about what you want to solve No
Consent for us to process the data Yes

Question form

Data Required
Your question Yes
Work email Yes
Consent for us to process the data Yes

When a form is filled in on an industry page, the request also includes that page’s industry.

Where your visit came from

Both forms send three fields that you do not see on screen:

  • origem (source): the campaign parameters of the link you arrived from (UTM parameters), the address of the external website that referred you to us, or “direct” if there is neither.
  • pagina_entrada (landing page): the first page of the website you opened during that visit.
  • percurso (path): the pages of the website you opened during that visit, in order, and how many seconds after the first one.

This data is kept in your browser’s session storage (sessionStorage) during your visit, and only reaches us if you submit a form. It does not identify your device or track you on other websites.

Booking the call

After you submit the contact form, you can choose the day and time of the call in a scheduling tool embedded in the page. Your name, email, notes, industry and visit source are passed to that tool so you do not have to type them again. The tool also records the date and time you choose and sends you a confirmation by email.

Contact by email and phone

If you write to us or call us, we process the data you share in that contact: name, email, phone number and the content of the conversation.

Job applications

If you apply for a position, the form on the careers page opens your email with the application addressed to [email protected]: name, email, LinkedIn profile (optional), the position, your message and any CV you choose to attach. We use this data only for the recruitment process, on the basis of your consent and the pre-contractual steps you ask for.

Visit statistics

To know how many people visit the website, which pages they read and where they come from, we use Cloudflare Web Analytics. When you open a page, your browser sends Cloudflare the page address, the page you came from, the type of browser and device and the load time. The country is derived from your IP address, which is not stored. This tool uses no cookies or local storage, creates no identifier for you and does not track you on other websites. We only see aggregated figures.

The website also counts some actions in aggregate, in our internal CRM: clicks on the contact buttons, the phone number, the email address and external links, language changes, forms started and submitted, calls booked, how far a page was read (25, 50, 75 or 100%) and how long it stayed open (in ranges). Each record only keeps the day, the page, the action and the button text or link destination. It does not store your IP address or any identifier, uses no cookies and does not show who did the action.

Hosting technical logs

As with any website, the hosting provider logs technical data about each request made to the server, such as IP address, date and time, the page requested, browser and operating system. These logs are used to deliver the website and protect it against abuse.

Purpose Data Legal basis (GDPR)
Responding to your request or question Form data, email and phone Consent (Art. 6(1)(a))
Booking and holding the call, preparing a diagnosis or a proposal Contact form and booking data Steps taken at your request before entering into a contract (Art. 6(1)(b))
Understanding where requests come from, to assess our channels origem, pagina_entrada, percurso, industry Legitimate interests (Art. 6(1)(f))
Delivering the website and protecting it against attacks and abuse Hosting technical logs Legitimate interests (Art. 6(1)(f))
Counting visits and understanding which pages are useful, in aggregate Page visited, referring page, browser, device and country Legitimate interests (Art. 6(1)(f))
Assessing applications for positions at Xcope Application data Consent and pre-contractual steps (Art. 6(1)(a) and (b))
Complying with legal obligations, where they apply Only the data strictly necessary Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, we have assessed that the processing is limited to what is necessary and does not override your rights. You can object at any time (see “Your rights”).

We do not make automated decisions that have legal effects on you, and we do not carry out profiling based on website data.

You are under no obligation to give us personal data. Without the required form fields we cannot respond to your request that way, but you can always email or call us.

Who we share the data with

We do not sell personal data. We only share it with providers that process it on our behalf (processors), under contracts that comply with Article 28 of the GDPR, and only for the purposes above.

Provider Service Data involved Location
Cloudflare, Inc. Website hosting and delivery Technical logs, form submissions Cloudflare global network, including the EU
Cloudflare, Inc. Visit statistics (Web Analytics) Page visited, referring page, browser, device and country Cloudflare global network, including the EU
Cloudflare, Inc. Hosting of Xcope’s internal CRM, where contact requests are stored Form and booking data, aggregated counts of actions on the website Western Europe
Cal.com, Inc. (until booking moves to the internal CRM, with Google Calendar from Google Ireland Limited) Call booking Name, email, notes, industry, source, date and time of the call United States
Google Ireland Limited (Google Workspace) Company email Emails exchanged with you EU and United States (Google global infrastructure)

We may also disclose data to public authorities where required by law.

Transfers outside the European Economic Area

Some of these providers, or companies in their groups, are based outside the European Economic Area, notably in the United States. Where data is transferred outside the EEA, this is done with the safeguards provided for in the GDPR: an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the provider is certified, or standard contractual clauses approved by the European Commission, with supplementary measures where necessary. You can ask us for more information about these safeguards at [email protected].

How long we keep the data

Data Period
Contact requests and questions that do not lead to a contract Up to 24 months after the last contact
Data from contacts that lead to a contract For the duration of the contractual relationship and then for the applicable legal periods, for example 10 years for tax and accounting records
Visit source in your browser (sessionStorage) Until you close the tab or the browser
Applications that do not lead to a hire 6 months after the process ends. If you allow us to keep your application for future positions, up to 2 years
Hosting technical logs Up to 30 days

If you withdraw your consent or ask for erasure, we delete the data before these periods end, unless the law requires us to keep it.

Cookies and local storage

The website does not use advertising or audience analytics cookies. Visit statistics are collected without cookies (see “Visit statistics”).

  • Session storage (sessionStorage): we store where your visit came from, the first page you opened and the pages you view during the visit, as described above, and the country of the visit (only the country code, read from Cloudflare) to show the systems most used in your market. This data stays in your browser, is deleted when you close the tab, and only reaches us if you submit a form. If your browser blocks this storage, the website still works.
  • Chosen language (cookie xcope_lang): when you pick a language in the site’s switcher, we remember that choice for one year so the next visit opens in the same language. It is used for nothing else, and you can delete it in your browser settings.
  • Excluding team visits (local storage xcope:team): present only in the browsers of Xcope team members who switch it on, so that their own visits are not counted in the statistics.
  • Fonts: these are served from our own website. We do not load fonts from third-party services such as Google Fonts.
  • Scheduling tool: this only loads after you submit the contact form, when you choose the time of the call. It may use its own cookies or local storage needed for it to work, governed by that provider’s privacy policy.

If we start using analytics or other tools that set non-essential cookies in future, you will see a consent notice before they are switched on, and this section will be updated.

Your rights

Under the GDPR, you have the right to:

  • Access: find out whether we process your data and receive a copy.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: ask us to delete your data when it is no longer needed or there is no basis for processing it.
  • Restriction: ask us to suspend processing while an issue is being checked.
  • Portability: receive the data you gave us in a structured, commonly used format, or ask us to send it to another organisation.
  • Objection: object to processing based on legitimate interests.
  • Withdraw consent: at any time, without affecting processing carried out before then.

To exercise any of these rights, write to [email protected] with the subject “Data protection”. We reply within one month, which may be extended in the cases provided for in the GDPR. We may ask you for additional information to confirm your identity. Exercising your rights is free of charge.

If you believe the processing of your data breaks the law, you have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or with the supervisory authority of the country where you live or work.

Security

We use appropriate technical and organisational measures to protect data against loss, unauthorised access and misuse, including encrypted connections (HTTPS), access to the CRM limited to those who need the data, and providers with contractual security guarantees.

Children

This website is intended for businesses and professionals. We do not knowingly collect data from children under 16. If you become aware that a child has sent us data, please write to us so we can delete it.

Changes to this policy

We may update this policy when the data we collect, the providers we use or the law changes. The date of the last update is shown at the top of the page. If a change is significant, we will highlight it on the website.

Contact

For any privacy question: