Privacy Policy

1. Data controller

The data controller responsible for processing personal data collected through this website is:

ONRIGHTS — European debt-claim escalation
Registered office: Lisbon, Portugal
Contact: hello@onrights.com

ONRIGHTS operates as a joint venture with the international law firm Ontier.

2. Personal data we process

We process the following categories of personal data:

• Contact-form submissions: name, email address, company, subject and the content of the message you send us.
• Technical data: IP address (temporarily, for security and abuse prevention), user-agent, timestamps of requests, referrer.
• Analytics data (only with your consent): anonymised page views, country of visit, aggregate performance signals via Vercel Analytics.

We do not collect special-category data (health, political opinions, etc.) and we do not use profiling or automated decision-making.

3. Purposes and legal bases

• Responding to your enquiry — legal basis: legitimate interest of the controller in replying to a request initiated by you (Art. 6(1)(f) GDPR).
• Security and abuse prevention — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Analytics — legal basis: your consent (Art. 6(1)(a) GDPR), collected via the cookie banner. You may withdraw consent at any time.

4. Data recipients (processors)

We rely on the following processors, each bound by a Data Processing Agreement under Art. 28 GDPR:

• Vercel Inc. — hosting and CDN. All servers pinned to the EU region (Frankfurt, fra1).
• Resend — transactional email delivery of contact-form submissions to our team inbox.
• Iubenda — consent management platform (banner + preference storage).

We do not transfer personal data outside the European Economic Area.

5. Retention

• Contact-form messages: 24 months from the last exchange, then deleted.
• Server access logs: 30 days.
• Analytics data: retained by Vercel Analytics per its retention policy (13 months).

6. Your rights

Under the GDPR you have the right to:

• Access your personal data (Art. 15).
• Request rectification (Art. 16) or erasure (Art. 17).
• Restrict processing (Art. 18) or object to it (Art. 21).
• Data portability where applicable (Art. 20).
• Withdraw consent at any time (Art. 7(3)).

To exercise any of these rights, write to hello@onrights.com. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority — in particular the Garante per la protezione dei dati personali (Italy), Comissão Nacional de Proteção de Dados (Portugal), or the authority of your habitual residence.

7. Changes to this policy

We may update this policy from time to time. Material changes will be signalled at the top of this page with a new version number and date.