Legal · Fortune Molecule
Privacy policy
Last updated: 28 May 2026 Version: 1.2
This Privacy Policy explains how Fortune Molecule, Lda. ("Fortune Molecule", "we", "us", "our") collects, uses, discloses, and protects personal data when you visit www.fortunemolecule.com (the "Website") or otherwise interact with us. It is provided in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the Portuguese Personal Data Protection Law (Lei n.º 58/2019), and the Portuguese ePrivacy implementation (Lei n.º 41/2004).
1. Data controller
The data controller responsible for the processing of your personal data is:
- Legal name: Fortune Molecule, Lda.
- Registered office: Rua de Júlio Dinis 748, 5.02, 4050-012 Porto, Portugal
- NIPC / VAT number: PT 514 401 222
- Email: trading@fortunemolecule.com
- Privacy contact: gdpr@fortunemolecule.com
- Phone: +351 933 904 676
2. Data Protection Officer
We have not appointed a Data Protection Officer. Our processing activities do not meet the criteria set out in Article 37(1) GDPR (we are not a public authority, our core activities do not require large-scale regular and systematic monitoring of data subjects, and we do not process special categories of data on a large scale). For any privacy-related matter, please contact gdpr@fortunemolecule.com.
3. Personal data we collect
3.1 When you visit the Website
The Website uses two analytics tools:
- Cloudflare Web Analytics — first-party, cookie-free, always on. Cloudflare collects minimal technical data for security and aggregate analytics: IP address (used for security, then truncated), browser type and version, operating system, pages visited, time and date of visit, referring URL, approximate geographic location (country/region). No persistent identifiers, advertising cookies, or cross-site profiles are created.
- Google Analytics 4 (GA4) — third-party, loaded only after you opt in via the cookie banner's "Analytics" category. When loaded, GA4 sets the
_ga/_ga_*cookies and sends pageview / event data to Google LLC. We have configured GA4 with: IP anonymisation enabled, Google Signals (cross-device tracking) disabled, ad-personalisation signals disabled, and data retention set to 14 months (the shortest interval that still allows year-over-year reporting).
No persistent identifiers, advertising cookies, or cross-site profiles are created from your visit unless you have explicitly consented to the analytics category.
3.2 When you contact us through the contact form
When you submit our contact form, we collect:
- First name and last name (required)
- Email address (required)
- Company name (required)
- Phone number (optional)
- Country (optional)
- Inquiry business area (required — used for internal routing)
- The content of your message (required)
- Locale of the page from which the form was submitted (
en/pt/pl)
The submission is protected by Cloudflare Turnstile (a first-party privacy-friendly alternative to CAPTCHA — no Google reCAPTCHA, no cross-site tracking). The Turnstile token is verified server-side and discarded; no profile is built from it.
The form data is then sent server-side from our Cloudflare Pages backend to HubSpot, Inc., which acts as our processor for storing and managing the contact record (see Section 7). No HubSpot scripts run in your browser.
3.3 When you correspond with us by email or phone
We collect the contact details and content of any correspondence you initiate.
3.4 What we do not knowingly collect
We do not collect special categories of personal data (Article 9 GDPR — health, religion, ethnicity, sexual orientation, biometric, etc.) through this Website. Please do not submit such information through our forms or correspondence.
4. Legal bases for processing (Article 6 GDPR)
| Activity | Legal basis |
|---|---|
| Responding to inquiries submitted through the contact form | Pre-contractual measures / performance of a contract — Art. 6(1)(b), with the consent checkbox in the form serving as the explicit Art. 6(1)(a) basis for storing the contact in our CRM |
| Maintaining business correspondence with existing clients and suppliers | Performance of a contract — Art. 6(1)(b) |
| Identifying and reaching out to prospective business contacts in B2B contexts | Legitimate interest — Art. 6(1)(f); balancing test available on request |
| Operating the Website (Cloudflare Pages hosting, Cloudflare Web Analytics, Cloudflare Turnstile spam protection) | Legitimate interest — Art. 6(1)(f); security and basic measurement |
| Google Analytics 4 traffic measurement | Consent — Art. 6(1)(a); loaded only after explicit opt-in via the cookie banner |
| Compliance with legal obligations (tax, accounting, responding to authorities) | Legal obligation — Art. 6(1)(c) |
| Establishing, exercising, or defending legal claims | Legitimate interest — Art. 6(1)(f) |
We do not send unsolicited marketing communications. Any future newsletter or product update would be sent only on the basis of freely-given consent under Article 6(1)(a).
5. Purposes of processing
We process personal data to:
- Respond to inquiries and provide information about our products and services;
- Maintain and develop business relationships across our business areas;
- Manage our customer relationship management (CRM) records;
- Operate, secure, and improve the Website;
- Comply with legal, regulatory, and contractual obligations;
- Protect our legitimate interests and those of third parties.
6. Retention periods
| Category of data | Retention period |
|---|---|
| Cloudflare Web Analytics (aggregate, non-identifying) | Up to 6 months at Cloudflare; no individual records retained on our side |
| Google Analytics 4 (only when consented) | 14 months at Google; aggregate reporting retained internally up to 24 months |
| Contact form submissions (HubSpot CRM contact records) | Up to 3 years from the last meaningful interaction, then archived or deleted |
| Customer / supplier contractual data | Duration of the contract + 10 years (Portuguese commercial and tax retention rules — Art. 40 Código Comercial, Art. 123 CIRC) |
| Email correspondence | 3 years from last message, unless required to be retained longer for legal reasons |
| Records related to data subject requests | 3 years from response date |
After the applicable retention period, data is deleted or irreversibly anonymised.
7. Recipients and processors
We do not sell personal data. We share personal data only with the following categories of recipients, each of which acts under a written data processing agreement (DPA) where required by Article 28 GDPR:
| Recipient | Role | Purpose | Location |
|---|---|---|---|
| HubSpot, Inc. | Processor | CRM — storing the contact created by the website form; sales follow-up | United States (with SCCs — see Section 8) |
| Cloudflare, Inc. | Processor | CDN, DDoS protection, edge hosting (Cloudflare Pages), spam protection (Turnstile), aggregate web analytics (Cloudflare Web Analytics) | Global edge network with EU presence; processing for EU visitors occurs in EU edge locations where possible |
| Google LLC | Processor | Google Analytics 4 — traffic measurement, loaded only with your consent | United States (under the EU–U.S. Data Privacy Framework — see Section 8) |
| Public authorities and law enforcement | Independent controller | Where required by law (Art. 6(1)(c) GDPR) | EU / national jurisdiction |
| Professional advisors (lawyers, accountants, auditors) | Independent controllers / joint where applicable | Legal, tax, audit obligations | Portugal / EU |
A current list of sub-processors used by HubSpot is available at: https://legal.hubspot.com/subprocessors Cloudflare's sub-processor list: https://www.cloudflare.com/gdpr/subprocessors/ Google's privacy framework and sub-processors: https://business.safety.google/privacy/
8. International transfers
Personal data processed by HubSpot, Inc. is transferred to and stored on servers located in the United States. To safeguard this transfer, we rely on the European Commission's Standard Contractual Clauses (SCCs) as set out in Implementing Decision (EU) 2021/914, incorporated into our Data Processing Agreement with HubSpot, supplemented by the technical and organisational measures detailed in HubSpot's Trust Center.
Cloudflare operates a global edge network. EU visitor traffic is processed on EU-located edge nodes wherever practical; certain back-end management functions occur in the United States under the SCCs and Cloudflare's Data Processing Addendum.
Google Analytics 4 data is processed by Google LLC in the United States under the EU–U.S. Data Privacy Framework (Google LLC is a certified participant; see https://www.dataprivacyframework.gov). Supplementary safeguards include IP anonymisation, disabled Google Signals, disabled ad-personalisation, and 14-month data retention. This transfer occurs only after you opt in via the cookie banner — withholding consent means no GA4 data is sent.
Following the Schrems II judgment (CJEU C-311/18), we have assessed and apply additional supplementary measures including encryption in transit (TLS 1.2+) and at rest, access controls, pseudonymisation where feasible, and contractual restrictions on government data access requests.
A copy of the safeguards in place can be requested at gdpr@fortunemolecule.com.
9. Your rights under the GDPR
You have the following rights with respect to your personal data:
- Right of access (Art. 15) — obtain confirmation of whether we process your data and a copy of it;
- Right to rectification (Art. 16) — have inaccurate or incomplete data corrected;
- Right to erasure ("right to be forgotten", Art. 17);
- Right to restriction of processing (Art. 18);
- Right to data portability (Art. 20) — receive your data in a structured, machine-readable format;
- Right to object (Art. 21) — including an absolute right to object to direct marketing;
- Right not to be subject to a decision based solely on automated processing, including profiling (Art. 22);
- Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).
To exercise any of these rights, contact gdpr@fortunemolecule.com. We will respond within 30 days (Art. 12(3) GDPR), extendable by up to two further months for complex requests, with notification.
You also have the right to lodge a complaint with the Portuguese supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD) Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa Phone: +351 213 928 400 Website: www.cnpd.pt Email: geral@cnpd.pt
10. Automated decision-making and profiling
No decision producing legal or similarly significant effects on you is made solely by automated means. All sales and business decisions involving you are made or reviewed by a human. You may request more information at gdpr@fortunemolecule.com.
11. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage (Art. 32 GDPR). These include:
- Encryption in transit (HTTPS / TLS 1.2+) and at rest where applicable;
- A strict Content Security Policy (CSP) limiting which scripts may run on the Website;
- Access controls and the principle of least privilege;
- Multi-factor authentication for administrative accounts;
- Periodic review of processors' security practices.
No method of transmission over the Internet is 100% secure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours and, where required, inform affected individuals without undue delay (Art. 33–34 GDPR).
12. Children
The Website is intended for adults and B2B audiences. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data, please contact gdpr@fortunemolecule.com so we can delete it.
13. Cookies
This Website uses a small number of cookies and similar technologies. Detailed information is set out in our separate Cookies Policy.
14. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated via a Website notice and, where appropriate, by email to contacts who have provided one. Previous versions are available on request.
15. Contact
For any question, request, or concern about this Privacy Policy or our processing of your personal data:
Email: gdpr@fortunemolecule.com Postal: Fortune Molecule, Lda., Rua de Júlio Dinis 748, 5.02, 4050-012 Porto, Portugal
