Skip to content
Talk to us
Talk to us

Privacy and cookies

What this website collects about you, why, and what you can do about it. Written to be read; the legal detail is in each section.

Last updated: 2 November 2026

1. Who is responsible

CRITICAL CATALYST – Health Consulting, Lda., NIF (tax identification number) 514 870 532, is responsible for the personal data collected through this website (the controller under the General Data Protection Regulation, Regulation (EU) 2016/679). Registered office: Av. da República n.º 679, 7.º, sala 74, 4450-242 Matosinhos, Portugal. Operating HQ: Av. Menéres 640 – Sala 247, 4450-189 Matosinhos, Portugal.

Questions about your data, or to use any of your rights: info@criticalcatalyst.com.

2. What we collect, and why

When you send a contact form or request a proposal
We collect: name, email, and what you tell us about your product, market, date, role, service or programme; optionally your company or organisation and a procurement procedure; the page you came from
We use it to: answer you and, if you ask, prepare a proposal
Legal basis: steps you ask us to take before a contract (Article 6(1)(b)); for other questions, our legitimate interest in answering you (Article 6(1)(f))
When you follow an area
We collect: email, the areas and the language you chose, and the date you confirmed
We use it to: send one email when an area publishes
Legal basis: your consent, given when you confirm by email (Article 6(1)(a))
When you ask a question about a briefing
We collect: email and your question
We use it to: answer the question
Legal basis: our legitimate interest in answering you (Article 6(1)(f))
When you save a route from the Route Finder
We collect: email and the route you drew
We use it to: send you the route as an email; record that you asked for it
Legal basis: your consent, given when you ask for the route (Article 6(1)(a))
When you accept analytics cookies
We collect: how you use the site (see §4)
We use it to: understand which pages help visitors and which do not
Legal basis: your consent (Article 6(1)(a); Article 5 of Lei n.º 41/2004)

We do not sell your data. We do not use it for advertising.

3. How long we keep it

Enquiries and proposal requests that do not lead to work
24 months, then deleted
Follow subscriptions
until you unsubscribe; we then keep the record of your consent (what you agreed to, and when) for 2 years, to show that you agreed, then delete it
Questions about briefings
24 months, then deleted
Saved routes
not kept: the route is sent to you by email and not stored on the site
Analytics data
Google Analytics 4: 14 months. Microsoft Clarity: session recordings 30 days; heatmaps and saved recordings 13 months
Your cookie choice
24 months, then deleted

4. Cookies and analytics

Necessary cookies keep the site working and remember your cookie choice. Analytics cookies are set only if you accept them.

Consent tool: The site asks for your choice itself, with no outside service. We keep a record of it: a random reference, the date, your choice and the page language. We do not keep your IP address. You can change your choice at any time: .

Analytics tools in use:

  • Google Analytics 4 (Google Ireland Limited), loaded only after you accept analytics cookies.
  • Microsoft Clarity (Microsoft Corporation), loaded only after you accept analytics cookies. It records how pages are used (for example clicks and scrolling), to help us see where the site is unclear.

Cookie list: these are all the cookies the site sets for visitors.

cc_cookie
Set by: this site
What it is for: remembers your cookie choice
Kept for: 6 months
Category: necessary
_ga
Set by: Google Analytics 4
What it is for: analytics: counts visits and how pages are used
Kept for: 2 years (some browsers shorten this to 400 days)
Category: analytics, only if you accept
_ga_3ND4G03MVV
Set by: Google Analytics 4
What it is for: analytics: the same, for this site’s Analytics account
Kept for: 2 years (some browsers shorten this to 400 days)
Category: analytics, only if you accept

Microsoft Clarity, as we use it, sets no cookies; it keeps one temporary entry in your browser while the tab is open. If you refuse analytics, or withdraw your consent later, the Google cookies are deleted and the page reloads without them.

The accessibility widget (Ally, by Elementor) sets no cookies. It keeps one entry in your browser, ea11y-global-state, that remembers which accessibility tools you have turned on, until you clear your browser data.

5. Who else handles your data

Service providers who process data for us, only to run the site and its emails:

  • Namecheap (EasyWP), which hosts the website
  • Mailchimp (Intuit), which sends the Follow confirmation and briefing emails
  • the analytics tools in §4
  • Elementor (Elementor Ltd., Israel), which provides the accessibility widget; your browser loads it from Elementor’s servers, so Elementor receives your IP address

Some of these providers are based in the United States or Israel, or may process data there. When data leaves the European Economic Area, the transfer relies on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, for providers certified under it) or on the European Commission’s standard contractual clauses.

If your enquiry is about work in the United Kingdom or the United States, we may pass it to CRITICAL CATALYST LTD (United Kingdom) or CRITICAL CATALYST LLC (United States), which then answers you and is responsible for the data it receives. Transfers to the United Kingdom rely on the European Commission’s adequacy decision; transfers to the United States rely on standard contractual clauses.

6. Your rights

You can ask to see, correct or delete your data, to restrict or object to its use, to take it with you, and to withdraw consent at any time without affecting what was done before (Articles 15 to 22). Write to info@criticalcatalyst.com. We answer within one month.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

7. Changes to this notice

When we change this notice, we update the date at the top. If a change affects how we use the email of people who follow an area, we tell them by email before it applies.