How we contact businesses
This page explains what happens when we write to you at work without your having given us your address. It is the information required by Article 14 of the GDPR — the article that applies precisely when the data was not collected from the person it concerns.
Who is writing
Shiftworks Unipessoal Lda, company number 519245970, registered at Rua de Vergadas, 184A, 4595-290 Penamaior, Paços de Ferreira, Portugal. It is the controller of the data described here.
Contact: Daniel Gonçalves — dgoncalves@shiftworks.pt · geral@shiftworks.pt
What we hold
Your name, your role, your work email address, and your employer's name, domain and sector. No personal phone numbers, no special categories of data.
We also record what happens to the email: whether it was opened and which links you clicked.
If you click a link to our site and accept marketing cookies there, we associate the pages you visit with you, including earlier visits from that browser in the last 12 months. Without that consent, the visit is not linked to you. If you ask us to stop, we undo this link.
Where it came from
From one of three sources, and the email itself tells you which one is yours:
- your company's public website, where the address was published to be contacted;
- public sources, collected by us;
- Apollo.io, a business contact database.
Why we are writing
Shiftworks is a Portuguese agency working with small and medium businesses. Before writing, we analyse the company's website and how it appears — or fails to appear — in the answers given by AI engines. The email you received points to one concrete problem that analysis found, with the evidence available through a link, and proposes a conversation. There is no commercial proposal without that conversation first.
The legal basis
Legitimate interest, GDPR Article 6(1)(f): presenting a professional service to the businesses it was built for. We weighed that interest against your rights before writing to anyone, and you may ask us for that assessment.
Two limits we imposed on ourselves, enforced by the system rather than by policy:
- We only write to addresses whose subscriber is a legal person. Personal mailboxes are refused by the system.
- Every month we consult the list of legal persons who have objected, kept by the Portuguese Directorate-General for Consumer Affairs. The system will not send a single email if that consultation is more than 31 days old.
Who else has access
Our hosting and database provider, our email sending provider, the automation service and the contact database named above. All act under our instructions. The current list is available on request.
International transfers: Apollo.io is based in the United States. The transfer is covered by Apollo.io's certification under the EU-U.S. Data Privacy Framework, supplemented by the European Commission's standard contractual clauses.
For how long
- If you never reply: 12 months from the last message, after which we delete your data. Where a record of the message must remain, it is the personal data that is removed from it.
- Messages sent and the evidence behind them: 24 months, so that what we claimed can be verified later.
- If you ask us to stop: we keep your address or your domain on a suppression list with no time limit. That record is the only way to guarantee we do not write to you again.
Your rights
Access, rectification, erasure, restriction, portability and objection. In direct marketing, the right to object is unconditional and immediate — no justification, and no message asking you to reconsider.
Three ways, all final:
- the removal link at the end of every email — it does not expire;
- replying to the email with the word «remover» (remove);
- writing to geral@shiftworks.pt.
You may also lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).
No automated decisions
Every message we send is read and approved by a person before it goes out. Nothing about you is decided automatically.
Last updated: 5 November 2026.