Privacy policy for individuals

1. Who is the controller

When you request documents for yourself, without going through a professional, the controller of your personal data is [ENTIDADE OPERADORA — NIPC, morada], which operates the Titus Docs service (docs.titusone.pt) of the TitusOne product. Data protection contact: dpo@titusone.pt. General contact: geral@titusone.pt.

If you received a link from a professional, this policy does not apply: in that case the controller is the professional, and the Privacy policy for professionals and data subjects who receive a link applies.

2. Data we process

Contact details, such as your e-mail address or telephone number, so that we can send you the result and the receipt. NIF and NISS, when needed for the collection. The record of your consent. The official documents obtained, which may contain your tax address, income, contribution status, social security data, real estate or credit liabilities, depending on what you choose. Payment data processed by Stripe (we receive only the confirmation and the minimum billing details). Technical data, such as your IP address and access logs.

Your credentials (passwords and SMS codes) are processed on an exceptional basis, only during the collection, as explained in section 4.

3. Purposes and legal bases

Obtaining and delivering the documents you requested: performance of the contract and steps taken at your request (Article 6(1)(b) of the RGPD) and your express consent to the collection (point (a)). Receiving payment, issuing the invoice and complying with tax and accounting obligations: performance of the contract and legal obligation (points (b) and (c)).

Keeping the consent and audit records, to prove that the collection was authorised and carried out as requested: legitimate interest and legal obligation (points (f) and (c)). Security and the prevention of fraud and abuse: legitimate interest (point (f)). Responding to requests, complaints and refund requests, and defending legal claims: performance of the contract and legitimate interest.

4. Your credentials

To obtain the documents, you enter on the collection page your NIF and your Tax and Customs Authority (Finanças) password, your NISS and your Social Security Direct (Segurança Social Direta) password and, when the portal asks for it, the code received by SMS. The Bank of Portugal (Banco de Portugal) is accessed through the Finanças authentication.

Credentials are encrypted with AES-256-GCM, used only by the robot in an isolated browser and deleted at the end of the collection, within a maximum of 24 hours. We do not share them with anyone, we do not use them for any other purpose and we do not record them in log files. You may interrupt the collection at any time, and we recommend that you change your passwords afterwards.

5. Retention

Credentials: deleted at the end of the collection and, at the latest, within 24 hours. PDF documents: kept for 30 days and then deleted; you may delete them sooner. Consent and audit records: 5 years. Payment and billing data: for the statutory tax and accounting periods. Once these periods have ended, the data are deleted or anonymised.

6. Recipients and processors

We do not sell your data or use it for advertising. We use processors: hosting on a dedicated server in the European Union (Germany); Stripe, to process payment; Cloudflare, for DNS services. We may disclose data to authorities when required by law and to advisers bound by a duty of confidentiality.

7. International transfers

Documents and credentials are processed on a server in the European Union. Stripe and Cloudflare may process limited data, such as payment data or IP addresses, outside the European Economic Area; in such cases the transfer is based on mechanisms provided for in the RGPD, such as adequacy decisions or standard contractual clauses.

8. Security

We use encryption of credentials and communications, an isolated browser for each collection, access control, access logging and automatic deletion within the defined periods. In the event of a data breach that poses a high risk to you, we will inform you without undue delay and notify the supervisory authority, in accordance with the law.

9. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and you may withdraw your consent at any time, without affecting what was done before. To exercise these rights, write to dpo@titusone.pt; we will respond within one month, which may be extended under the law, and we may ask for information to confirm your identity.

You may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, CNPD), at www.cnpd.pt.

10. Cookies and changes

We use only technical cookies: a session cookie and a theme preference cookie. We do not use advertising or tracking cookies. We may update this policy; the date of the last update is shown at the top of the page.