Privacy policy (professionals and holders who receive a link)

1. Who this policy applies to

This policy applies to (a) Professionals who have a Titus Docs account, and (b) people who receive a collection link from a Professional and, by that means, authorise the retrieval of their documents (the "Holders"). If you use Titus Docs directly as a private individual, without going through a professional, the Privacy policy for private individuals applies.

Titus Docs is a private service of the TitusOne product, operated by [ENTIDADE OPERADORA — NIPC, morada].

2. Controller and processor

When documents are collected, the Professional who requested the documents is the controller of the Holder's personal data: the Professional decides the purposes for which the data are collected and must have a legal basis for doing so. Titus Docs acts as a processor, processing the data on behalf of the Professional and in accordance with the Professional's instructions, under a data processing agreement pursuant to Article 28 of the RGPD.

With regard to the Professional's own account and billing data, as well as the service's security and audit logs, Titus Docs acts as controller.

If you are a Holder and wish to know who requested your documents and for what purpose, this information is shown in the link you received and may be requested from the Professional concerned.

3. Personal data processed

Professional's data: name, e-mail, telephone, company and billing details, account usage data, record of requests and credits.

Holder's data: name, e-mail or telephone used to send the link, NIF and NISS, the record of consent and the official documents obtained from the portals. Depending on what the Holder has authorised, these documents may contain data such as tax address, income, contribution status, social security data, real estate or credit liabilities.

Access credentials: the passwords and SMS codes entered by the Holder are processed on an exceptional basis, as set out in section 5, and only during the collection.

Technical data: IP address, browser type and access logs, for security and abuse detection. We do not intentionally collect special categories of data; however, official documents may contain sensitive information, which is processed with the same level of protection and solely for the purpose of the collection.

4. Purposes and legal bases

Carrying out the collection requested by the Professional and delivering the documents to them. As regards the processing of the Holder's data, the legal basis is determined by the Professional as controller, and is normally the Holder's consent (Article 6(1)(a) of the RGPD) or steps taken at the Holder's request prior to entering into a contract (point (b)). Titus Docs only carries out the processing under the conditions defined.

Managing the Professional's account, credits and billing: performance of the contract (Article 6(1)(b)) and compliance with legal obligations, in particular tax and accounting obligations (point (c)).

Keeping consent and audit records, to prove that consent was given and that the service was provided as authorised: legitimate interest (point (f)) and compliance with legal obligations, where applicable.

Security of the service, prevention of fraud and abuse, and technical improvement: legitimate interest (Article 6(1)(f)), after weighing the rights and expectations of data subjects.

Responding to requests and complaints and, where necessary, defending rights in legal proceedings: legitimate interest and compliance with legal obligations.

5. Portal credentials

To obtain the documents, the Holder enters their credentials on the collection page: NIF and password for the Tax and Customs Authority (Finanças), NISS and password for Social Security Direct (Segurança Social Direta) and, when the portal requires it, the code received by SMS. Access to the Bank of Portugal (Banco de Portugal) is made through the Finanças authentication.

These credentials are encrypted with AES-256-GCM as soon as they are received, used only by the robot that carries out the collection, in an isolated browser, and deleted at the end of the collection. They are kept for a maximum of 24 hours, after which they are deleted even if the collection has not been completed. The Professional never sees them and we do not use them for any other purpose, nor do we record them in log files.

The Holder may interrupt the collection at any time. We recommend that you change your passwords once the collection has been completed.

6. Data retention

Credentials: deleted at the end of the collection and, in any case, within a maximum of 24 hours.

PDF documents obtained: kept for 30 days so that the Professional can download them, and then deleted automatically. The Professional may delete them before that period ends. Documents that the Professional has downloaded to their own systems become their sole responsibility.

Consent and audit records: kept for 5 years, as evidence and for compliance with legal obligations and the defence of rights.

Professional's account and billing data: for the duration of the contract and, thereafter, for the legal tax and accounting retention periods.

Once these periods have ended, the data are irreversibly deleted or anonymised.

7. Recipients and processors

The Holder's data are made available to the Professional who requested the documents. We do not sell personal data or use it for advertising.

We use processors under contracts that comply with Article 28 of the RGPD: hosting on a dedicated server in the European Union (Germany); Stripe, for payments (only the Professional's billing and payment data); Cloudflare, for DNS services.

We may also disclose data to public authorities, where required or permitted by law, and to our professional advisers, who are bound by a duty of confidentiality.

8. International transfers

Document and credential data are processed and stored on a server in the European Union (Germany). Some of our providers, such as Stripe and Cloudflare, may process limited data (such as payment data or IP addresses) outside the European Economic Area. In such cases, the transfer is based on mechanisms provided for in the RGPD, such as adequacy decisions or standard contractual clauses, and on supplementary measures where necessary.

9. Security

We apply appropriate technical and organisational measures: encryption of credentials (AES-256-GCM), encryption of communications, an isolated browser for each collection, role-based access control, access logging, backups and automatic deletion within the defined periods.

In the event of a personal data breach that poses a risk to the rights of data subjects, we will notify the Professional without undue delay so that they can fulfil their obligations as controller, and we will cooperate with them and with the supervisory authority.

10. Data subjects' rights, how to exercise them and complaints to the CNPD

Under the RGPD, you have the right of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw your consent at any time, without affecting the lawfulness of processing already carried out, and the right not to be subject to decisions based solely on automated processing that produce significant effects.

If you are a Holder, you should address your request to the Professional who requested your documents, as they are the controller. You may also write to us at dpo@titusone.pt: we will forward your request to the Professional and, where possible, help to respond to it, for example by immediately deleting the documents. If you are a Professional, or with regard to the data for which we are the controller, the request may be sent directly to dpo@titusone.pt.

We will respond within one month, which may be extended as provided for by law. We may ask for additional information to confirm the identity of the person making the request.

If you consider that the processing of your data infringes the law, you have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD), at www.cnpd.pt, without prejudice to any other administrative or judicial remedy.

11. Cookies

We only use technical cookies that are strictly necessary for the website to function: a session cookie, which keeps you logged in, and a theme preference cookie (light or dark). We do not use advertising, behavioural analytics or tracking cookies, so there is no need to ask for consent to use them. You may delete or block these cookies in your browser settings, but some features may stop working.

12. Changes and contacts

We may update this policy. The date of the last update is shown at the top of this page and, in the event of a significant change, we will inform Professionals by e-mail or in the Virtual Office (Escritório Virtual).

Data protection contact: dpo@titusone.pt. General contact: geral@titusone.pt. Operating entity: [ENTIDADE OPERADORA — NIPC, morada].