Personal Data Deletion Instructions

1. Background

This document describes how you can request the deletion of your personal data processed by Loominary (Jorge Ferreira, sole trader, Porto district, Portugal), in accordance with Article 17 of the General Data Protection Regulation (GDPR) and other applicable Portuguese legislation.

Before submitting a request, identify which of the situations below applies to you, since the entity responsible for processing your data varies with the context.

2. Identify Your Situation

Loominary processes personal data in two distinct capacities:

Situation A: Website visitor or commercial contact

Applies to you if: you visited the website loominary.pt, filled in a contact form, scheduled a demo, subscribed to a newsletter, or exchanged direct correspondence with Loominary as a potential client or partner.

Data controller: Loominary.

How to request deletion: see section 3 below.

Situation B: Patient, service user or end customer of an entity that uses Loominary's services

Applies to you if: you received messages (WhatsApp, voice) or interacted with the virtual assistant of a clinic, practice or professional that uses Loominary technology.

Data controller: the clinic, practice or professional you deal with. Loominary acts only as that entity's data processor.

How to request deletion: you must address your request directly to the responsible entity (the clinic). You may also send us the request through the channel indicated in section 3, and we will forward it, but the final decision always rests with the data controller.

Situation C: Institutional client of Loominary

Applies to you if: you are a clinic, practice or professional that has contracted Loominary's services.

How to request data deletion: the terms are set out in the Data Processing Agreement (DPA) and/or the service agreement. To terminate the contractual relationship and have the corresponding data deleted or returned, contact us at info@loominary.pt.

3. How to Submit the Request

3.1 By email

Send an email to privacidade@loominary.pt) with the subject "Personal Data Deletion Request (GDPR)".

Include in the message:

• Full name (as you provided it, if known)
• The email address you used to contact Loominary
• Telephone number, if applicable (especially relevant for requests concerning WhatsApp communications)
• A description of the context in which your data was collected (e.g. "I filled in the contact form in January 2026", "I received messages from clinic X")
• A clear statement that you wish to exercise the right to erasure (Art. 17 GDPR)

3.2 Identity verification

To protect your data against fraudulent requests, we may ask for additional elements to confirm your identity. These elements will be used exclusively for that purpose and deleted after the request has been answered.

4. Response Times

We will reply to your request within a maximum of 30 days from receipt, under Article 12(3) of the GDPR.

In particularly complex cases, this period may be extended by a further two months, and the data subject will be informed of the extension and its reasons within the initial 30-day period.

5. Scope of Deletion

When granted, the request results in the deletion of your personal data from Loominary's systems, namely:

• Lead, contact and CRM databases
• Conversation histories (web chat, WhatsApp, voice)
• Appointment and scheduling records
• Marketing communication mailing lists
• Cookies and identifiers associated with your device (insofar as they can be attributed to you)
• Backup copies, in the next regular rotation cycle

Where the data is hosted on third-party systems used by Loominary (processors, see the Privacy Policy), the deletion request will be propagated to those systems within the reasonable time required by their respective APIs and procedures.

6. Limitations to the Right to Erasure

Under Article 17(3) of the GDPR, Loominary may legitimately refuse, in whole or in part, the deletion request where processing is necessary for:

• a) Compliance with a legal obligation to which Loominary is subject (namely tax, invoicing or accounting obligations: retention periods set by the Portuguese Corporate Income Tax Code, the VAT Code and Portuguese tax legislation, typically 10 years);
• b) The establishment, exercise or defence of a right in judicial, arbitral or administrative proceedings;
• c) Exercising the right of freedom of expression and information;
• d) Archiving in the public interest, scientific or historical research, under the legally provided conditions.

In such cases, we will inform the data subject of the reasons for the refusal and the legal basis invoked, and the data subject may lodge a complaint with the supervisory authority (see section 8).

Where full deletion is not possible but restriction of processing is legally admissible (Art. 18 GDPR), we will proceed accordingly.

7. Specific Requests for WhatsApp Data

Where the request specifically concerns communications through the WhatsApp Business Platform, please indicate:

• The telephone number on which you received the messages
• The name of the clinic or entity that sent the messages (if known)

Please note that, in most cases, Loominary acts as data processor for the sending clinic or entity (Meta Tech Provider), so the request will be forwarded to the responsible entity, as described in Situation B (section 2).

To stop receiving WhatsApp messages from a specific entity immediately, simply reply "PARAR" or "STOP" to the conversation in question. The block is processed automatically and prevents that entity from sending further communications.

8. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority in Portugal:

• Comissão Nacional de Proteção de Dados (CNPD, the Portuguese Data Protection Authority)
• Address: Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
• Telephone: (+351) 213 928 400
• Email: geral@cnpd.pt
• Website: www.cnpd.pt

9. Other Rights of the Data Subject

In addition to the right to erasure, please note that you may exercise the following rights under Articles 15 to 22 of the GDPR:

• Access to your data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Restriction of processing (Art. 18)
• Portability (Art. 20)
• Objection to processing (Art. 21)
• Withdrawal of consent at any time (Art. 7(3))

All of these rights can be exercised through privacidade@loominary.pt.

10. Applicable Law

These instructions are governed by Portuguese and European data protection law, namely:

• Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR)
• Law no. 58/2019 of 8 August, implementing the GDPR in Portugal
• Law no. 41/2004 of 18 August, on privacy in electronic communications

For more information on how Loominary processes your data, see the Privacy Policy.