Privacy Policy
KEYSTONE. – Minerals Data Observatory
Version: 1.0
Effective date: September 27, 2026
Last updated: September 27, 2026
1. Who we are
KEYSTONE. (hereinafter "we", "our" or "KEYSTONE.") is the trading name under which Nelson Manuel Matilde Cristo provides market intelligence services specialising in global sectoral statistical data, with a focus on mineral resources and natural stone. We operate the website and data platform accessible at https://keystone-observatory.com (hereinafter the "Platform").
Data Controller:
Nelson Manuel Matilde Cristo – Sole Trader (Individual Entrepreneur)
Tax ID (NIF): 209358874
Registered address: Rua do Telhal 31, 7000-380 Évora, Portugal
Email: privacy@keystone-observatory.com
2. Scope of this policy
This Privacy Policy explains how we collect, use, store and protect your personal data when you:
- Visit our Platform;
- Complete contact forms or demo requests;
- Create a user account and access the members area;
- Subscribe to a paid or free (freemium) plan;
- Receive our communications (newsletter, publication alerts);
- Interact with us by any other means.
This policy applies to all personal data processed by KEYSTONE. in the course of its activities, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national legislation.
3. What personal data we collect
3.1 Data you provide directly
| Category | Examples | Context |
|---|---|---|
| Identification data | First name and surname | Account registration, forms |
| Contact data | Email address, phone number (optional) | Registration, contact form, billing |
| Professional data | Company, job title, industry | Registration, requests for premium study access |
| Account data | Username, password (hashed) | Platform authentication |
| Payment data | Last 4 digits of card, billing country | Paid subscriptions (processed by payment partner) |
| Communications | Content of messages sent | Contact form, support |
Note: KEYSTONE. does not directly store full credit card details. Payment processing is delegated to a PCI-DSS certified service provider (e.g., Stripe).
3.2 Automatically collected data
When you use the Platform, we may automatically collect:
- Navigation data: IP address (anonymised), browser type, operating system, browser language, pages visited, session duration, traffic source;
- Usage data: features accessed, dashboards viewed, publications viewed or downloaded, searches performed;
- Cookie and similar technology data: session identifiers, language preferences (see Section 8 - Cookies).
4. Purposes and legal basis for processing
| Purpose | Legal basis (GDPR, Art. 6) | Data involved |
|---|---|---|
| Creating and managing your user account | Performance of contract (Art. 6(1)(b)) | Identification, contact, account |
| Processing subscriptions and payments | Performance of contract (Art. 6(1)(b)) | Contact, payment data |
| Providing subscribed content and dashboards | Performance of contract (Art. 6(1)(b)) | Account, usage data |
| Sending service communications (confirmations, invoices, changes) | Performance of contract (Art. 6(1)(b)) | |
| Sending newsletter and new publication alerts | Consent (Art. 6(1)(a)) | Email, preferences |
| Responding to contact and support requests | Legitimate interests (Art. 6(1)(f)) | Identification, contact, communications |
| Improving the Platform and usage analytics | Legitimate interests (Art. 6(1)(f)) | Navigation and usage data (anonymised) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) | IP, account data |
| Compliance with legal and tax obligations | Legal obligation (Art. 6(1)(c)) | Identification, billing |
Marketing and communications: we will only send you promotional or editorial communications (newsletter, outlooks, new studies) if you have given us your explicit consent. You may withdraw that consent at any time, free of charge, via the unsubscribe link in each message or by contacting us directly.
5. Who we share your data with
KEYSTONE. does not sell, rent or trade personal data. We may share data with third parties in the following circumstances:
5.1 Sub-processors
We work with service providers that process data on our behalf, subject to data processing agreements in compliance with the GDPR:
- Hosting and infrastructure: cloud service provider (e.g., Vercel, AWS, Cloudflare);
- Payment processing: PCI-DSS certified provider (e.g., Stripe);
- Transactional email: email delivery platform (e.g., Resend, Postmark);
- Traffic analytics: privacy-respecting analytics tool (e.g., Plausible Analytics - no third-party tracking cookies);
- Customer support: ticketing management tool, where applicable.
5.2 Authorities and legal obligations
We may disclose personal data where required by law, court order or competent authority (e.g., tax authority, public prosecutor's office).
5.3 Business transfer
In the event of a merger, acquisition or sale of KEYSTONE. assets, personal data may be transferred to the new controller, who will be bound by this policy or an equivalent one.
6. International data transfers
Your data is generally processed within the European Economic Area (EEA). Where we engage sub-processors established outside the EEA, we ensure the transfer is based on one of the following safeguards:
- European Commission adequacy decision;
- Standard Contractual Clauses adopted by the European Commission;
- Another appropriate safeguard under Chapter V of the GDPR.
7. How long we retain your data
| Data category | Retention period |
|---|---|
| Account data (active user) | For the duration of the active account |
| Account data (after cancellation) | 30 days post-cancellation (recovery window), then deleted |
| Billing and payment data | 10 years (legal obligation - Portuguese Commercial Code) |
| Contact/support communications | 2 years after case closure |
| Navigation data (logs) | Maximum 13 months (anonymised after 30 days) |
| Marketing consents | Until withdrawal + 3 years archive (proof of consent) |
At the end of the retention period, data is securely deleted or irreversibly anonymised.
8. Cookies and similar technologies
The Platform uses cookies and equivalent technologies to ensure the service functions correctly, remember your preferences, and, with your consent, analyse usage.
8.1 Types of cookies used
| Type | Purpose | Consent required? |
|---|---|---|
| Functional (essential) | Authentication session, language preferences, subscription basket | No |
| Analytical | Visit counting and navigation behaviour analysis (aggregated, anonymised data) | Yes |
| Marketing / tracking | Personalised advertising, cross-site tracking | Not currently used |
8.2 Managing cookies
When you first access the Platform, a cookie consent banner will be displayed. You can manage your preferences at any time via the cookie settings icon in the Platform footer.
You can also configure your browser to block or delete cookies, although this may affect the functionality of some features.
9. Your rights as a data subject
Under the GDPR, you have the following rights regarding your personal data:
| Right | What it means |
|---|---|
| Access | Obtain confirmation that we process your data and receive a copy |
| Rectification | Correct inaccurate or incomplete data |
| Erasure ("right to be forgotten") | Request deletion of your data, where applicable |
| Restriction | Restrict processing in certain circumstances |
| Data portability | Receive your data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interests or for direct marketing |
| Withdrawal of consent | Withdraw consent given, without affecting the lawfulness of prior processing |
| Complaint | Lodge a complaint with the competent supervisory authority |
How to exercise your rights
Send your request by email to privacy@keystone-observatory.com, identifying yourself and specifying the right you wish to exercise. We will respond within a maximum of 30 days (which may be extended by a further 60 days in complex cases, with prior notification).
Supervisory authority
If you consider that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority. As KEYSTONE. is established in Portugal, the lead supervisory authority is:
Comissão Nacional de Proteção de Dados (CNPD)
www.cnpd.pt · geral@cnpd.pt · +351 213 928 400
You may also lodge a complaint with the supervisory authority in your country of residence.
10. Data security
KEYSTONE. implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, accidental destruction or disclosure, including:
- Encryption of communications via HTTPS/TLS;
- Password storage using hashing (bcrypt or equivalent);
- Access control based on the principle of least privilege;
- Access monitoring and activity logging (security logs);
- Periodic review of security measures.
In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the CNPD within a maximum of 72 hours and, where applicable, communicate directly with the affected data subjects.
11. Minors
The Platform is intended exclusively for users aged 18 or over, or for minors duly authorised by their legal representative. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a minor without verifiable parental consent, we will promptly delete that data.
12. Links to third-party websites
The Platform may contain links to external websites (e.g., data sources such as UN Comtrade, Eurostat, USGS). This policy does not apply to those websites. We recommend that you consult the privacy policy of each website you visit.
13. Changes to this policy
We may update this Privacy Policy periodically to reflect legal, technical or service changes. When we do:
- We will publish the updated version on this page with a new revision date;
- We will notify registered users by email if the changes are material;
- If changes require new consent, we will request it explicitly.
Your continued use of the Platform after non-material changes take effect constitutes acceptance of those changes.
14. Contact us
For any questions related to privacy or data protection:
KEYSTONE. – Minerals Data Observatory
Email: privacy@keystone-observatory.com
Address: Rua do Telhal 31, 7000-380 Évora, Portugal
© 2026 KEYSTONE. – Minerals Data Observatory. All rights reserved.
This policy was drafted in compliance with Regulation (EU) 2016/679 (GDPR).