Privacy Policy

1. Who we are

ArtHome CRM is proprietary software developed, owned and operated by SMILING ATMOSPHERE – LDA, a company registered in Portugal under NIPC 517944596, with registered office at Rua Capitão Salgueiro Maia, nº 3, 2925-228 Azeitão, Setúbal, Portugal ("Smiling Atmosphere", "we", "us" or "our"). You can contact us at admin@smilingatmosphere.pt.

2. Scope

This Privacy Policy explains how personal data is processed in connection with the ArtHome CRM website, user accounts, support services, Meta Lead Ads integration, lead and customer workflows, booking and branch operations, technical logs, and related server-side integrations. It does not govern unrelated websites and services.

3. Our roles under data protection law

Smiling Atmosphere is the controller for personal data used to operate user accounts, secure and administer the platform, provide support, maintain technical and audit logs, manage the Meta application, and comply with legal obligations. Where an ArtHome business customer determines why and how lead, prospect, student, parent, customer or branch data is used, that business customer is the controller and Smiling Atmosphere processes such data on its documented instructions as a processor under a data processing agreement. The relevant business customer must provide its own privacy notice at the point where it collects personal data.

4. Categories of people

We may process data relating to authorized CRM users; employees, contractors and administrators of business customers; prospective and current customers; students and, where relevant, their parents or guardians; people who submit Meta Instant Forms; people who contact sales or support teams; and persons whose data is lawfully entered into ArtHome CRM by an authorized business customer.

5. Data we process

Depending on the workflow and the information submitted, we may process: account data such as name, business email, role, branch, language and authentication records; Meta lead data such as lead ID, form responses, name, contact details and information voluntarily supplied in a lead form; attribution data such as Page, form, campaign, ad set, ad and creative identifiers; CRM activity such as lead status, assigned user, tasks, call notes, appointment, attendance, payment status and loss reason; support and communication records; technical data such as IP address, device/browser information, timestamps, security events and audit logs; and selected conversion events sent to Meta where configured and lawfully permitted. Free-text notes must not be used to store passwords, payment-card details, health information or other unnecessary sensitive data.

6. Sources of data

Data may be provided directly by an authorized user or data subject; received from Meta when a person submits an Instant Form and the relevant business assets are connected; created during calls, appointments, attendance or service delivery; generated by the platform for security and audit purposes; or provided by an authorized business customer acting as controller.

7. Why we process data and legal bases

We process data to provide and administer the service; authenticate users and manage permissions; receive and route leads; maintain service, scheduling and customer history; support sales and branch follow-up; measure lead outcomes; send selected conversion events to Meta; prevent fraud and secure the platform; provide support; maintain records; and comply with law. Depending on the context, the legal basis may be performance of a contract, compliance with a legal obligation, legitimate interests in operating and securing a business service, consent where legally required, or processing on behalf of a controller under its documented instructions. A business customer is responsible for selecting and documenting the lawful basis for its own marketing and lead-management activities.

8. Meta Platform Data

When an authorized business connects Meta assets, ArtHome CRM may receive Platform Data through Meta APIs and Webhooks. We use that data only to retrieve and display leads, associate them with the relevant form and advertising context, route them through the authorized CRM workflow, support legitimate follow-up, and report selected downstream lead outcomes through the applicable Meta Conversions API integration. We do not sell Platform Data, use it for surveillance, use it to make prohibited eligibility decisions, or share it except with the relevant controller, authorized users and contracted service providers as permitted by law and Meta terms.

9. Sharing and service providers

We may share personal data with: the relevant ArtHome business customer and its authorized users; Meta Platforms Ireland Limited where the integration requires data exchange; hosting, database, email, communications, monitoring, backup and security providers acting under contract; professional advisers and authorities where legally required; and another party in a lawful corporate transaction subject to appropriate safeguards. Smiling Atmosphere maintains a current subprocessor list identifying the actual providers, processing locations and services used. Service providers may process data only for contracted purposes and under appropriate confidentiality, security and data-protection obligations.

10. International transfers

Where personal data is transferred outside the European Economic Area, we use an applicable legal transfer mechanism, such as an adequacy decision or the European Commission Standard Contractual Clauses, together with supplementary safeguards where required. Details may be requested using the contact information below.

11. Retention

We retain personal data only for as long as necessary for the relevant purpose and controller instructions. The implementation baseline is: raw webhook payloads for no more than 30 days after successful processing; unconverted lead records for up to 24 months after the last meaningful interaction unless the controller defines a shorter period or law requires otherwise; customer and transaction records for the service relationship and any legally required accounting or claims period; account data for the account relationship and up to 90 days after closure; security and audit logs for up to 12 months; support records for up to 24 months; and encrypted backups for no more than 90 days before rotation. Data subject requests and deletion records may be retained as necessary to demonstrate compliance.

12. Security

We use measures appropriate to the risk, including encrypted transport, access controls, role-based permissions, protected server-side secrets, audit logging, rate limiting, backups, monitoring, vulnerability handling and incident procedures. No method of storage or transmission is completely secure. Users must protect their credentials and promptly report suspected unauthorized access.

13. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and you may withdraw consent where processing relies on consent. Where Smiling Atmosphere processes data only for an ArtHome controller, we may forward the request to that controller and assist it. We may verify identity before acting and will respond within the period required by law. You may also complain to the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), at https://www.cnpd.pt/.

14. How to request deletion

See our Data Deletion page at https://smilingatmosphere.pt/arthome-crm/data-deletion/ or email admin@smilingatmosphere.pt with the subject "ArtHome CRM Data Request". Do not send passwords, access tokens or payment-card details. Meta users may also use Facebook Settings & Privacy, Settings, Apps and Websites to submit a platform deletion request where available.

15. Children

ArtHome CRM is a business tool and is not offered directly to children. Business customers may use the platform in connection with services involving minors only where they have an appropriate lawful basis, provide required notices, obtain valid parental or guardian authorization where required, limit access and avoid collecting unnecessary information.

16. Automated decision-making

ArtHome CRM does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Workflow automation may route a lead, create a task or report a status, but authorized personnel remain responsible for decisions and follow-up.

17. Cookies

The login service may use strictly necessary session, authentication, security and preference cookies. If analytics, advertising or other non-essential technologies are introduced, they must not be set before any legally required consent and this Policy and the cookie controls must be updated.

18. Changes

We may update this Policy when the product, processing or legal requirements change. We will publish the updated date and provide additional notice where a change materially affects individuals. Material changes to Meta data processing may also require an updated App Review submission.

19. Contact

SMILING ATMOSPHERE – LDA
NIPC 517944596
Rua Capitão Salgueiro Maia, nº 3
2925-228 Azeitão, Setúbal, Portugal
Email: admin@smilingatmosphere.pt
Website: https://smilingatmosphere.pt