Privacy Policy

Last updated:

Your privacy matters. This policy explains what personal data we collect, why, for how long and what your rights are, under the General Data Protection Regulation (GDPR) and Portuguese law.

1. Data controller

The controller of your personal data is Rafael António Jacinto dos Reis, who provides the services under the Controlled Chaos brand. For any question about your data: rafael.jacinto.reis@gmail.com.

2. What data we collect

  • When you book a call or session: your name, email and the answers you give in the booking form.
  • When you sign up for a workshop: your name, email, company or role (if you provide them) and billing details.
  • When you email us: your address and the content of your message.
  • When you subscribe to the newsletter or sign up to hear about upcoming Lead in Chaos dates: your name and email.
  • During coaching: session notes, which may include personal and professional information you choose to share.
  • When you visit the site: technical data, such as IP address and browser type, logged by the hosting provider for security reasons.

If there are online payments, they are processed by payment providers. We do not have access to your card details.

3. Why we use your data, and on what basis

  • To provide the services you contract and manage bookings, sign-ups and related communications (performance of a contract or pre-contractual steps).
  • To reply to your requests and messages (legitimate interest).
  • To issue invoices and meet tax and legal obligations (legal obligation).
  • To keep the site secure and working properly (legitimate interest).
  • To send news or content, only if you have given your consent, which you can withdraw at any time (consent).

We never sell or rent your data to anyone.

4. Coaching session notes

Session notes are confidential, stored securely and used only to support your process. They are not shared with third parties, including any company paying for your coaching, without your explicit consent.

5. How long we keep your data

  • Booking and contact data: up to 2 years after our last interaction.
  • Coaching session notes: up to 2 years after the process ends, then deleted.
  • Billing data: for the period required by tax law (currently 10 years).
  • Technical site logs: for the minimum period needed for security purposes.
  • Newsletter data: until you unsubscribe.

6. Who we share your data with

We use providers that process data on our behalf, only for the purposes above and with the safeguards required by the GDPR:

  • Netlify (site hosting)
  • Calendly (bookings)
  • MailerLite (newsletter delivery)
  • Email, video call, invoicing and payment providers

Some of these providers are based outside the European Economic Area, namely in the United States. In those cases, transfers rely on mechanisms provided for in the GDPR, such as the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

We may also share data when required by law.

7. Cookies

This site does not use advertising or analytics cookies. It only uses one technical cookie to remember the language you choose (Portuguese or English), which is needed for the site to work and does not require consent. If this changes, we will update this policy and ask for your consent where required.

External services the site links to, such as Calendly, have their own cookie policies.

8. Your rights

You can, at any time, request access to your data, its correction or deletion, restriction of processing and data portability, or object to processing based on legitimate interest. Where processing is based on your consent, you can withdraw it whenever you want.

To exercise these rights, email rafael.jacinto.reis@gmail.com. We will reply within 30 days at the latest.

You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt.

9. Security

We take appropriate technical and organisational measures to protect your data against loss, unauthorised access or misuse.

10. Minors

Our services are intended for people aged 18 or over. We do not knowingly collect data from minors.

11. Changes

We may update this policy. The version in force is always the one published on this page, with the date of the last update. This is a translation for convenience; in case of any discrepancy, the Portuguese version prevails.