This Privacy Policy describes, in general terms, how Flipkick collects, uses and protects the personal data of visitors to this website and of its clients. The processing of personal data complies with the European Union's General Data Protection Regulation (GDPR) and the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL), as applicable.

Data controller

The controller responsible for processing personal data is Flip Kick, Unipessoal, Lda., with its registered office at Rua da Vigorosa 869, Porto, Portugal, and an operational presence in Riyadh (Saudi Arabia). Contact details for privacy-related matters can be found in the "Contact for privacy matters" section.

Data collected

We may collect data that you provide to us directly, as well as data generated automatically while you browse. By way of example:

Contact data provided voluntarily (for example, name, email and company, when submitting a form).
The content of the communications you send us.
Technical and usage data collected automatically (for example, IP address, device type, pages visited), subject to consent where applicable.

Purposes and legal basis

We process personal data for specific purposes, with the corresponding legal basis:

Responding to contact requests and managing the business relationship - performance of a contract or pre-contractual steps, and/or legitimate interest.
Marketing communications - consent of the data subject, where required.
Measuring and improving the website - consent, in the case of cookies and technologies that are not strictly necessary.
Compliance with legal obligations - where required by law.

Data sharing

We may use processors that handle data on our behalf, under appropriate contracts. The third-party services we may use include:

HubSpot - management of contacts and commercial communications, and analysis of website navigation (including aggregated identification of visiting companies), subject to consent.
Google Analytics 4 (GA4), implemented through Google Tag Manager - measurement of website audience and performance, subject to consent.
Amazon Web Services (AWS) - hosting and delivery of the website (S3 and CloudFront), including technical access logs (for example, IP address).
Microsoft 365 - management of the email through which we receive and respond to your communications.

We do not sell personal data to third parties.

International transfers

Due to our presence in Portugal and Saudi Arabia, some data may be transferred between these jurisdictions (PT ↔ KSA), as well as to service providers located in other countries. Whenever this occurs, we adopt appropriate safeguards provided for under the GDPR and the PDPL, such as standard contractual clauses or other legally recognized mechanisms.

Rights of the data subject

Under applicable law, the data subject may exercise, among others, the following rights:

Access to their personal data.
Rectification of inaccurate or incomplete data.
Erasure ("right to be forgotten"), where applicable.
Restriction of and objection to processing.
Data portability.
Withdrawal of consent, at any time, without affecting the lawfulness of prior processing.

The data subject also has the right to lodge a complaint with the competent supervisory authority (in Portugal, the CNPD; in Saudi Arabia, the competent authority under the PDPL).

Retention

We retain personal data only for the period necessary for the purposes for which it was collected, or for the period required by applicable legal obligations. By way of example:

Contact requests and commercial leads - up to 24 months after the last interaction, unless the relationship develops into a contract.
Contractual and billing data - the duration of the contract, plus the legal retention period for tax documents (10 years, under Portuguese law).
Measurement and navigation data (GA4 and HubSpot) - up to 24 months, in line with the duration of the respective cookies.
Cookie consent preference - until removed by the user in their browser.

Once the applicable periods have elapsed, the data is securely deleted or anonymized.

Contact for privacy matters

To exercise your rights or to clarify any question regarding the processing of your personal data, contact us at legal@flipkick.cloud. We will respond within a maximum of one month, as provided for under the GDPR.

Last updated: June 4, 2026.