Privacy policy

1. Data controller

The data controller is ONOMBONGO - COMÉRCIO E PRESTAÇÃO DE SERVIÇOS, (SU), LDA, tax ID (NIF) 5003652734, registration no. 47116-26/260929 (Commercial Registry, Guiché Único da Empresa), with registered office at Bairro Sede, Rua Principal, Casa n.º 4, Chibia, Huíla, Angola.

For any question about personal data, write to geral@onombongo.com or use the Contact us page.

2. What data we process

• "Contact us" form: name, email, phone (optional), subject, message, language and the page the message was sent from, plus the date and time it was sent.
• Audience measurement (Google Analytics 4), only if you accept measurement cookies: pages visited, source of the visit, device and browser type, and approximate location. Google Analytics 4 does not store IP addresses.
• Hosting technical logs (Cloudflare): IP address, date and time and requested page, used only for the security and operation of the site.
• Preferences stored in your browser: light or dark theme and your cookie choice. They stay on your device and are not sent to us.

The website does not ask for or store payment details, passwords or sensitive data.

3. Purposes and legal grounds

• Replying to messages sent through the form, based on your consent, given by ticking the authorisation box before sending.
• Understanding how the site is used in order to improve it, based on your consent to measurement cookies. You can withdraw it at any time.
• Ensuring the security and proper operation of the site, based on the company’s legitimate interest.

4. Who receives the data

We do not sell or share your data. We use these service providers, who process the data on our behalf:

• Google (Google Workspace: Google Sheets, Gmail and Apps Script), to receive and store form messages and email the team.
• Google (Google Analytics 4), for audience measurement, only with your consent. Learn more in Google’s privacy policy.
• Cloudflare, for hosting and delivering the site.

5. International transfers

These providers may process data outside Angola, namely in the United States and the European Union. We choose providers that offer adequate data protection safeguards.

6. How long we keep the data

• Form messages: 24 months from submission, after which they are deleted.
• Google Analytics 4 measurement data: for the period configured in the property, at most 14 months.
• Hosting technical logs: for the short period set by Cloudflare for security.

7. Your rights

Under Law no. 22/11 of 17 June (Angolan Personal Data Protection Law), you have the right to:

• know what data of yours we process and access it;
• ask for inaccurate or incomplete data to be corrected;
• ask for your data to be deleted;
• object to processing and withdraw consent at any time, without affecting processing already carried out.

To exercise these rights, write to geral@onombongo.com. We reply within the legal deadline. You may also lodge a complaint with Angola’s Data Protection Agency (Agência de Protecção de Dados, APD).

8. Security

The site is served only over HTTPS, with security headers that limit the resources each page can load. The form validates data in the browser and again on the server, and access to messages is restricted to the company’s team.

9. Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page. If a change affects how we use measurement cookies, we will ask for your choice again.