Privacy Policy

LIZAR Systems Lda. ("LIZAR", "we") operates lizarsystems.com. This policy explains what personal data we collect through this website, why we collect it, and what you can do about it. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679.

Who is responsible

The controller is LIZAR Systems Lda., R. das Fontaínhas 82-86, 1300-257 Lisboa, Portugal. Write to sales@lizarsystems.com about anything in this policy.

We have not appointed a Data Protection Officer, and are not required to.

What this website does and does not do

• No advertising. We show no ads, we build no advertising profiles and we do not share data for advertising.
• Website statistics only with your consent. Unless you accept in the cookie notice, the statistics tool is not loaded and nothing is sent to Google. See "Website statistics" below.
• Fonts are served from our own servers. Opening a page sends no request to any third party; the only exception is the statistics script, which your browser fetches from Google only after you accept.

Cookies

Without your consent, the site sets one cookie for ordinary visitors, named NEXT_LOCALE. It holds a two-letter language code and nothing else, so that the site opens in the language you last read it in. It does not identify you and is not used to track you.

TO CONFIRM: we treat this as a preference cookie exempt from consent, which is why it is not covered by the choice in the cookie notice. Confirm that view, or ask us to switch language detection off — the language is already in the address of every page, so the cookie can be removed entirely.

Staff signed in to the administration area also receive a session cookie. It is strictly necessary for logging in and is not used for anything else.

If you accept statistics cookies in the cookie notice, the Google tag (see "Website statistics" below) also sets two cookies on lizarsystems.com. They are set by a script supplied by Google, and Google processes their content:

• _ga — a random identifier that tells returning browsers apart. Lasts 2 years; the period restarts on each visit.
• _ga_<container-id> — keeps the state of your visit; <container-id> is the identifier of our measurement property. Lasts 2 years; the period restarts on each visit.

Both are set on our own domain, so technically they are first-party cookies, but Google receives and processes the data they carry. The lifetimes are Google's defaults and your browser may shorten them. If you reject, or later withdraw your choice, these cookies are not set or are deleted.

We remember your choice in your browser's local storage (entry lizar.cookie-notice), not in a cookie. It holds only your choice (accept or reject), when you made it and the version of the notice, and it is never sent to our servers or to anyone else. Local storage is not a cookie, but Article 5 of Lei n.º 41/2004 (Article 5(3) of Directive 2002/58/EC) covers it as well. It does not need your consent because it is strictly necessary: without it we could not remember your refusal and would have to ask on every page. It stays until you change your choice with "Cookie preferences" in the footer or clear your browser data. If your browser blocks storage, we ask again on each visit and the statistics tool stays off.

What we collect, and why

Website statistics

If you click "Accept" in the cookie notice, we use Google Analytics 4, a web statistics service provided by Google, to see how the site is used and to improve it. Nothing is sent to Google before you accept.

What is collected: a random identifier stored in the _ga cookies; the pages you view and when; the page or site that referred you; your approximate location (country, region or city), worked out from your network address; your device, operating system, browser, language and screen size; and your interactions with pages, such as scrolling, clicks on outbound links and file downloads. TO CONFIRM: the interactions switched on in our Google Analytics property ("enhanced measurement") and whether city-level location is on.

Your network address is necessarily visible to Google when your browser contacts it. Google states that Google Analytics 4 does not log or store individual network addresses and uses them only to work out approximate location. TO CONFIRM against Google's current documentation before publishing.

This data is pseudonymous, not anonymous: the identifier lets Google recognise the same browser on later visits. We cannot tell who you are from it, we do not link it to the forms on this site and we do not use it to take decisions about you.

We use it to understand which content is read and to improve the site. Our lawful basis is your consent, Article 6(1)(a) GDPR, and, for storing and reading cookies on your device, Article 5 of Lei n.º 41/2004 (Article 5(3) of Directive 2002/58/EC). Refusing has no consequence: the whole site works the same. You can withdraw your consent at any time with "Cookie preferences" in the footer of every page, as easily as you gave it; the cookies are then deleted and the tool is no longer loaded. Withdrawing does not affect processing already carried out. To ask us to delete statistics data about your browser, write to sales@lizarsystems.com and send the value of your _ga cookie, because without it we cannot find the data. TO CONFIRM: that we can run such a deletion in our Google Analytics property.

Requesting documents

When you use the demo request form we collect your name, business email address, company, job title, the topic you selected and which documents you asked to see. We use them to contact you about your request. On the same record we also keep the language you were reading the site in, so we can reply in it. Submitting the form does not send you anything automatically — the documents you tick tell us what you are interested in, and a person follows up.

Every field on the form is required. If you do not provide them the form will not submit and we cannot get back to you; there is no other consequence.

Our lawful basis is your consent, Article 6(1)(a), given by ticking the box on the form. You can withdraw it at any time — see "Your rights" below. Withdrawing does not affect processing already carried out.

Partnership enquiries

When you use the partner form we collect your company, name, email address and the partnership type you selected, and use them to assess and answer your enquiry. Every field is required; without them we cannot assess the enquiry.

Our lawful basis is our legitimate interests, Article 6(1)(f), in responding to a business proposal you chose to send us. You may object at any time.

Preventing abuse of the demo request form

To stop the form being used to flood us with automated submissions, we count recent submissions per email address and per network origin. TO CONFIRM: this limit was originally written to stop the form being used to send unsolicited mail in our name, which it no longer can, since it sends nothing.

The network address itself is never stored. It is put through a keyed one-way function and only the result is kept, which cannot be turned back into the original address.

That covers the application. Our web server also keeps ordinary access logs, and those record the address of every request. TO CONFIRM: how long those logs are kept and who can read them.

Our lawful basis is our legitimate interests, Article 6(1)(f), in the security of the service and of our sending domain. Article 32 requires us to take measures of this kind.

Who else sees it

• Our email provider, which delivers the messages we send you. TO CONFIRM: name and country of the provider.
• Our hosting provider, which runs the servers this site and its database sit on. TO CONFIRM: name and country of the provider.
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which provides Google Analytics and acts as our processor, but only if you accept statistics cookies. Google LLC (United States) and other Google group companies may take part in the processing as sub-processors. TO CONFIRM: the Google entity named in our Google Analytics account terms.

We do not sell personal data, and we do not share it for advertising.

Google may process this data in the United States. We rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which Google LLC is certified, and, failing that, on the standard contractual clauses in Google's data processing terms. TO CONFIRM: Google LLC's current certification at dataprivacyframework.gov, and the link to Google's terms where you can obtain a copy.

TO CONFIRM: whether any other recipient is established outside the European Economic Area and, if so, the safeguard relied on under Article 46 — usually the European Commission's standard contractual clauses — and where you can obtain a copy of it.

How long we keep it

We keep enquiries and document requests until you ask us to erase them, and review them periodically so that records we no longer need are deleted. If you ask us to erase your data we will do so, unless we are legally required to keep it.

Website statistics: in Google Analytics we keep data linked to the identifier for 2 months. After that, only aggregated reports that identify no one remain. The _ga cookies last up to 2 years in your browser unless you delete them or withdraw your consent, which deletes them. TO CONFIRM: the retention period set in the Google Analytics property.

TO CONFIRM: a definite retention period, or the criteria used to arrive at one. Until one is set, records are kept indefinitely unless erasure is requested.

Your rights

Under the GDPR you may ask us to confirm whether we hold data about you and give you a copy (Article 15), correct it (Article 16), erase it (Article 17), restrict how we use it (Article 18), provide it in a portable format (Article 20), or stop processing that rests on our legitimate interests (Article 21). Where we rely on consent you may withdraw it at any time (Article 7(3)). This includes your consent to statistics cookies, which you can withdraw at any time with "Cookie preferences" in the footer of every page.

Write to sales@lizarsystems.com. We will answer within one month.

If you believe we have handled your data improperly you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, www.cnpd.pt. You may also complain to the authority in the country where you live.

Security

The administration area requires a login, and network addresses used for abuse prevention are pseudonymised as described above.

TO CONFIRM: every administration account currently carries the same full access. If enquiry data should be visible only to some staff, a role has to be added — there is none today.

Changes

When this policy changes we update the date shown at the top of this page. We will bring material changes to your attention. If a change affects which cookies we set, we ask for your choice again.