Privacy Policy

1. Who we are

Spinnaker Consulting Lda, a company registered in Portugal, is the controller of your personal data.

For any privacy question or request, write to info@spinnaker.pt.

We have not appointed a data protection officer, as the law does not require one for our activity. Messages sent to info@spinnaker.pt reach the managing partner.

2. What we collect

When you complete a diagnostic, we collect:

• Contact details: your name, your email and your company.
• Profile: your role and industry. Depending on the diagnostic, also your geography, the approximate size of your procurement or AI spend, and the share of spend with your top suppliers. The spend questions are optional.
• Answers: your answers to the questions and the scores calculated from them. In the AI in Procurement Practice assessment, your answers include whether they describe your own work or your team's work, which procurement you work on, the procurement tasks done with AI in the last month and why you are taking the assessment.
• Text you write: any free text you choose to add, for example a situation that worries you. Please do not include personal data about other people. In the Supplier Segmentation you can also write the name of a category or supplier. It appears in your report and in the follow-up email, and our team sees it with your results.
• Record of your request: the date and time you sent the form and the exact text of the box you ticked and of the note under it.

We do not store your IP address or your browser with your answers. To protect the forms from bots, Cloudflare Turnstile checks your IP address, your browser and other technical signals when you reach the contact step. To limit repeated submissions, our servers keep a coded form of your IP address and email address for 7 days. It cannot be read without a secret key and is deleted automatically. Our system logs can keep your IP address and email address for a short period.

When you visit any page, our hosting provider records your IP address, the page requested and your browser in the server logs.

If you accept analytics cookies, Google Analytics also records how the site is used:

• Visits and the pages read
• Where the visit came from, such as a search engine, LinkedIn or a link with utm parameters
• When a diagnostic is started and when it is sent
• Clicks on "Book a call"

Google Analytics does not receive your name, your email or your answers. It records the type of device and browser, and an approximate location based on the IP address.

If you refuse analytics cookies, nothing is sent to Google.

If you book a call, the booking page on Cal.com collects your name, your email and anything you write in the booking form.

3. Why we use it and on what legal basis

We use your data for these purposes:

• Your report: we calculate your results and email you the report. This is the service you ask for when you send the form (GDPR article 6(1)(b)). Without your name, email and company we cannot send it.
• One follow-up email: about ten days after you send the form, we send one email about your results. The legal basis is our legitimate interest in following up on a diagnostic you asked for (article 6(1)(f)), under Portuguese Law 41/2004. You can object to it at any time, also before it is sent.
• Reviewing your results: we read your results to decide whether to contact you personally and how soon. Section 4 explains how. The legal basis is our legitimate interest in answering the people most likely to need our help (article 6(1)(f)).
• Security: we check the forms for bots and abuse. The legal basis is our legitimate interest in keeping the site secure (article 6(1)(f)).
• Statistics: we count how many diagnostics are sent each day. The counts have no names or emails. The legal basis is our legitimate interest in improving the diagnostics (article 6(1)(f)).
• List of objections: if you ask us to stop, we keep your email address on a list so that we do not write to you again. We do this to respect your request and to meet Portuguese Law 41/2004 (article 6(1)(c) and (f)).
• Analytics: if you accept analytics cookies, we see which pages are read, where visits come from and how many diagnostics are started and sent. The legal basis is your consent, given in the cookie notice (article 6(1)(a) of the GDPR and article 5 of Law 41/2004). You can withdraw it at any time in "Cookie settings", at the bottom of every page.
• Booking a call: if you book a call, we use the booking details to hold the meeting (article 6(1)(b)).

You can object at any time to the follow-up email and to the review of your results. Use the unsubscribe link at the bottom of any of our emails, or write to info@spinnaker.pt. The link adds your address to our list of objections at once; an email is handled within two working days.

4. How we review your results

Our system scores your answers and sends the results in the weakest bands of each diagnostic to our team, and also, in the Supplier Risk Assessment, the results in the middle band of senior managers who tell us a specific situation worries them. Our team reads them and decides whether to contact you personally, usually within five days.

In the Supplier Segmentation, our team also receives the results of CPOs, procurement directors, CFOs, COOs, operations directors, CEOs and general managers whose supplier is in Anchor Suppliers or Hostage Categories, the two quadrants of high supply risk.

In the AI in Procurement Practice assessment, our team also receives an alert with the results of CPOs, procurement directors and procurement team leads who answer for their team, when the result is in Trying out, the second band from the bottom. The same alert is sent, whatever the score, when one of them tells us there is no rule, or does not know if there is one, for putting bids, prices and contracts into AI tools. If your result is in the Trying out band and does not raise an alert, it reaches our team in a daily summary. How soon we contact you depends on your role and your answers, not only on your score.

We take no decision based only on automated processing that has legal or similarly significant effects on you (article 22 of the GDPR).

You can object to this review at any time, and we will stop it.

5. How long we keep it

• Diagnostics: your answers, scores and contact details are deleted automatically 24 months after you send them.
• Failed emails: if the email with your report cannot be delivered, we keep a copy for up to 30 days, without your email address, so that we can send it again.
• Submission limits: the coded IP address and email address are deleted automatically after 7 days.
• Emails and contacts: emails in our mailbox with your data, including alerts and replies, and your contact details in our address book are kept for as long as needed for the business relationship.
• Technical logs and backups: system logs, database backups, the delivery records of our email provider and the server logs are kept for a limited period set by each provider.
• List of objections: if you ask us to stop, we keep only your email address and the date, for as long as it is needed so that we do not write to you again.
• Analytics: Google Analytics keeps the event data for 14 months and then deletes it. The analytics cookies stay in your browser for 13 months from your first visit and are not renewed. The cookie with your choice stays for 6 months.
• Daily counts: the daily counts have no personal data and are kept without a time limit.

You can ask us to delete your data sooner by writing to info@spinnaker.pt.

6. Who we share it with

We do not sell your data.

We use a small number of service providers ("processors") to run the site and our email. Supabase, Resend, Cloudflare and Cal.com work for us under data processing agreements that follow the GDPR, and Microsoft and Google under the data processing terms of their services.

• Supabase: stores the diagnostics and runs the functions that send the emails. Your data is stored in Ireland. Supabase Inc. is based in the United States.
• Resend: sends the emails, including your report, through Amazon Web Services in Ireland. Resend Inc. is based in the United States.
• Cloudflare: runs Turnstile, the check against bots on the forms, and processes your IP address and browser signals. Cloudflare also uses these signals to improve Turnstile, and for that use it acts as a separate controller under its own privacy notice.
• PTisp: hosts the site in Portugal and keeps the server logs.
• Microsoft 365: hosts our email. info@spinnaker.pt is a Spinnaker mailbox, forwarded to the managing partner.
• Cal.com: runs the booking page, only if you book a call.
• Google Ireland Limited: runs Google Analytics, only if you accept analytics cookies. It receives the usage data listed in section 2, never your name, email or answers.

We disclose data to public authorities only when the law requires it.

7. Where it's stored and transferred

Your diagnostic data is stored in the European Union, in Ireland.

Supabase, Resend, Cloudflare and Cal.com are companies based in the United States, and Microsoft and Google belong to groups based there. They may access data from outside the European Union to support and maintain their services, and Cloudflare checks the forms on its global network. Supabase also transfers some data to Singapore, for billing, support and service logs. If you accept analytics cookies, Google Ireland Limited can transfer the analytics data to Google LLC in the United States.

These transfers rely on the EU-US Data Privacy Framework for the companies certified under it, and on the standard contractual clauses approved by the European Commission in the other cases. You can ask us for a copy of these safeguards at info@spinnaker.pt.

If you refuse analytics cookies, nothing is sent to Google.

8. Your rights

Under the GDPR, you have the right to:

• Access the data we hold about you, including the scores and the result of the review in section 4
• Correct inaccurate data
• Have your data deleted
• Restrict how we use your data while a request is being checked
• Receive the data you gave us for your report in a portable format
• Withdraw your consent at any time, including for analytics cookies in "Cookie settings" at the bottom of every page. Withdrawing does not affect what was done before.
• Complain to a data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD). You can also complain in the EU country where you live or work.

Your right to object

You can object at any time to the follow-up email, to the review of your results in section 4 and to any other email from us. Use the unsubscribe link at the bottom of any of our emails, or write to info@spinnaker.pt. The link adds your address to our list of objections at once; an email is handled within two working days.

To exercise any of these rights, email info@spinnaker.pt from the address you used on the form, so that we know the request is yours. We answer within one month. If a request is complex, we can take two more months, and we tell you why within the first month.

9. Cookies and analytics

On your first visit, a notice asks if you accept analytics cookies. Refusing takes one click, the same as accepting. Until you choose, and if you refuse, Google Analytics is not loaded and nothing is sent to Google. The analytics cookies are not renewed on later visits.

You can change your choice at any time in "Cookie settings", at the bottom of every page. If you refuse after having accepted, the _ga cookies are deleted from your browser.

The cookies set by this site are:

Cloudflare Turnstile, the check against bots on the diagnostic forms, reads technical signals from your browser only when you reach the contact step of a diagnostic. This is strictly necessary to send the form you asked to send, so it does not need your consent.

While you answer a diagnostic, your answers are kept in this browser tab, so that going back or reloading the page does not lose them. Nothing is sent to us until you press Get my report, and the answers are deleted when you send them or close the tab.

There is no advertising on spinnaker.pt and no cross-site tracking. Google Signals and ad personalization are switched off in our Analytics account, so the analytics data is not linked to your Google account and is not used for advertising.

Our Google Analytics measurement ID is G-YC9TVK32HX.

10. Changes to this policy

We may update this policy. When we do, we change the date at the top. If a change affects how we use data you already gave us, we tell you by email before it applies. Earlier versions are available on request.

11. How to contact us

Spinnaker Consulting Lda, Portugal
Email: info@spinnaker.pt

If you are not satisfied with our answer, you can contact the Comissão Nacional de Proteção de Dados (CNPD), Portugal's data protection authority, at www.cnpd.pt.