Internal Audit Profile is committed to protecting your privacy and follows a policy of personal data minimisation, collecting and retaining only the personal information necessary to provide its services, comply with legal obligations and ensure their security.
As a general rule, personal data used to deliver purchased reports is processed during the report delivery and access period, which is limited to three days. Certain information may be retained for longer where necessary for payments and invoicing, customer support, security or compliance with legal obligations, as detailed in this Policy.
This Privacy Policy explains how personal data is processed and the rights available to you under Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and applicable Portuguese legislation. For questions about the processing of your personal data or to exercise your rights, please email contact@internalauditprofile.com.
1. Personal Data, Purposes and Legal Bases
| Personal data | Purpose | Legal basis |
|---|---|---|
| Email address and, where provided, name | Deliver purchased reports and related transactional communications | Performance of a contract — Article 6(1)(b) GDPR |
| Billing and transaction information, including name, billing address, country, tax identification number, amount, currency and transaction references, as applicable | Process and verify payments and fulfil purchases | Performance of a contract — Article 6(1)(b) GDPR |
| Identification, billing and tax information | Issue invoices and comply with accounting and tax obligations | Legal obligation — Article 6(1)(c) GDPR |
| Name, email address and message content | Respond to enquiries and customer-support requests | Legitimate interests in responding to enquiries — Article 6(1)(f), or pre-contractual steps — Article 6(1)(b), as applicable |
| IP addresses, network or device information, technical logs and pseudonymous identifiers | Protect the website, prevent misuse and investigate security incidents | Legitimate interests in maintaining service security and integrity — Article 6(1)(f) GDPR |
| Relevant transaction and communication information | Prevent fraud, manage payment disputes and establish, exercise or defend legal claims, where necessary | Legitimate interests — Article 6(1)(f), or legal obligation — Article 6(1)(c), as applicable |
The legitimate interests pursued include protecting our website and services, preventing fraud and misuse, responding to enquiries and resolving payment-related disputes.
Payment-card credentials are handled by specialised payment service providers and are not stored in the Internal Audit Profile application.
2. Recipients of Personal Data
Where necessary for the purposes described above, personal data may be disclosed to the following categories of recipients:
Payment processing and invoicing service providers.
Hosting and technical infrastructure providers.
Transactional email and customer-support service providers.
Website security and fraud-prevention service providers.
Public authorities, courts or professional advisers, where legally required or otherwise justified.
Depending on their functions and legal obligations, service providers may act as processors on our behalf or as independent data controllers for certain activities.
3. International Data Transfers
Personal data is processed within the European Economic Area (EEA) and the United Kingdom.
Transfers to the United Kingdom are covered by a European Commission adequacy decision under Article 45 of the GDPR.
4. Data Retention
Personal data is retained only for as long as necessary for the purposes described in this Policy, subject to applicable legal obligations.
Report delivery and access: Personal data required for delivering purchased reports is processed during the delivery and access lifecycle. Purchased reports remain accessible for three days. Temporary operational records are retained only for their applicable processing periods. Minimal completion records may be retained for up to seven days without customer email addresses or billing information.
Payments and invoicing: Transaction and invoicing information is retained as necessary for payment verification, fulfilment and compliance with applicable accounting and tax obligations, including statutory retention periods.
Security and technical logs: Pseudonymous identifiers used for abuse prevention are retained for 30 days. Technical web-server logs are rotated daily and retained for approximately 14 days for security, troubleshooting and service-operation purposes.
Customer support: Routine correspondence is deleted 30 days after the matter is closed. Information necessary for specific legal, accounting, payment-dispute, fraud-prevention or claims purposes may be retained for the applicable period.
Backups: Application and database backups containing personal data are retained for a maximum of 30 days. Specifically designated release or incident-response rollback archives may be retained separately after review to ensure that unnecessary personal data is not retained.
Personal data processed by independent service providers may be subject to their own applicable legal retention obligations.
5. Cookies and Similar Technologies
The Internal Audit Profile website does not use advertising or behavioural analytics cookies.
The website uses anti-bot and security technology to protect its forms and services against automated misuse. This technology may process technical information relating to the browser, device or network and may use security-related cookies or similar mechanisms where applicable.
Payment is completed on checkout pages hosted by a specialised payment service provider, which may use cookies or similar technologies in accordance with its own privacy and cookie information.
Administrative authentication cookies may be used to manage authorised website access. These are not used for ordinary public visitors.
Where consent is legally required for any non-essential cookies or similar technologies, these technologies will only be used after the required consent has been obtained.
6. Your Data Protection Rights
Under the GDPR, subject to the applicable legal conditions, you have the right to:
Access your personal data.
Request correction of inaccurate or incomplete data.
Request erasure of your personal data.
Request restriction of processing.
Object to processing based on legitimate interests.
Request data portability, where applicable.
Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of earlier processing.
You may exercise your rights by emailing contact@internalauditprofile.com. Requests will be handled within the deadlines established by applicable law.
You also have the right to lodge a complaint with a competent data protection supervisory authority, including the Portuguese Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
7. Information Required to Use the Service
An email address and the information necessary to complete payment are required to purchase and receive a report. Certain invoicing information is also required to comply with applicable legal obligations.
Without the necessary information, it may not be possible to complete a purchase or deliver the report.
Information submitted through the contact form is voluntary, although a valid email address is necessary to receive a response.
8. Data Controller and Contact
Internal Audit Profile is operated by Supreme Global Financial Designers, Unipessoal, Lda., the controller responsible for processing personal data.
For questions about the processing of your personal data or to exercise your rights, please contact contact@internalauditprofile.com.
Effective date: 23 October 2026