Privacy Policy
Last updated: 26/09/2026
This Privacy Policy explains how personal data is handled on whatastep.com (the “Site”): what is collected, why, how long it is kept, who has access to it, and what your rights are.
1. Who is responsible for your data
The Site is a free, non-commercial website run by André Lopes, a private individual based in Portugal. I am the data controller for the personal data processed through the Site.
Contact: through the Contact Form
2. What data I collect and why
| What | Data collected | Why | Legal basis (GDPR) |
|---|---|---|---|
|
Creating an account |
Username, email address, password (stored encrypted), date of registration, and a record of your acceptance of the Terms |
To create and run your account and give you 24-hour access to the Full Quiz |
Performance of a contract, Art. 6(1)(b) |
|
Taking the Full Quiz |
Your quiz answers and the report generated from them |
To generate your personal report and show it to you on screen |
Performance of a contract, Art. 6(1)(b) |
|
Contact Form |
Email address, message, and optionally your name and a subject |
To reply to your message, including account deletion and other requests |
Legitimate interest in answering your enquiry, Art. 6(1)(f) |
|
Technical data |
IP address, browser type, device information, pages requested, date and time |
To deliver the Site, keep it secure, and prevent abuse and spam |
Legitimate interest in running a secure website, Art. 6(1)(f) |
|
Cookie choices |
Your cookie preferences and when you gave them |
To respect and record your choices |
Legitimate interest in remembering your choices, Art. 6(1)(f) |
I do not sell your personal data. I do not use it for advertising or marketing, and I do not send newsletters or promotional emails.
About the quiz report. The report is generated automatically from your answers and describes your preferences, interests, and personality to help you explore possible professions. This is a form of profiling under GDPR. The report is shown only to you and is not used to make any decision about you that has legal or similarly significant effects.
3. Who has access to your data
Only I have access to the data collected through the Site. I use the following service providers, which process data on my behalf and only on my instructions:
- Namecheap, Inc.: website hosting, where all Site data is stored, and server logs. Data is stored in the United States.
- Google (Gmail): receiving Contact Form messages and sending replies.
- CookieYes: the cookie consent banner and records of your cookie choices.
I will only disclose personal data to others if I am legally required to, for example by a court order.
4. Transfers outside the European Economic Area
Some of the providers above are based in, or may store data in, countries outside the EEA, such as the United States. Where this happens, the transfer is protected by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, for certified companies) or by the European Commission’s Standard Contractual Clauses.
5. How long I keep your data
- Account data: until you ask me to delete your account.
- Quiz answers and report: not stored; the report is generated and shown once on screen, and is not kept afterwards.
- Contact Form messages: up to 12 months after the conversation ends, then deleted.
- Records of acceptance of the Terms: for as long as your account exists.
- Server logs: for the period set by the hosting provider.
- Cookie choices: up to 12 months, after which the banner will ask you again.
6. Cookies
The Site only uses strictly necessary cookies. They keep you logged in, keep the Site secure, run the membership system, and remember your cookie banner choices. Because they are required for the Site to work, they don’t need your consent, and they are not used to track you or for advertising.
7. Children
You must be at least 14 years old to create an account, in line with Portuguese law. If you are under 18, please make sure a parent or guardian knows about and agrees to your use of the Site. If I learn that an account belongs to someone under 14, I will delete it along with its data.
8. Your rights
Under the GDPR, you have the right to:
- access the personal data I hold about you
- correct inaccurate data
- delete your data and account
- restrict how your data is processed
- object to processing based on legitimate interest
- data portability: receive your data in a common format
- withdraw consent at any time, where processing is based on consent
To exercise any of these rights, use the Contact Form. Please enter the email address registered to your account, so I can confirm the request is yours. I will reply within one month.
You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or with the data protection authority in the country where you live.
9. Security
I take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), encrypted password storage, spam protection that runs on the Site itself without sending data to third parties, and keeping the software up to date. No website can be completely secure, but if a data breach affects you, I will notify you and the authorities as required by law.
10. Changes to this Policy
I may update this Privacy Policy from time to time. The updated version will be published on this page, with a new “Last updated” date. If I ever want to use your data for a new purpose, I will inform you before doing so and, where required, ask for your consent.