Officera Privacy Policy

Version 2026-01

⚠️ DRAFT — DO NOT PUBLISH WITHOUT LEGAL REVIEW. This document was written from the actual behaviour of the system and has not been reviewed by a lawyer. It must be legally validated before going to production or being presented to customers.

1. Scope of this policy

This policy explains how Officera processes personal data as a controller, that is:

data about people who visit the officera.pt website;
data about people who create an office and subscribe to Officera, and about the users who access the application;
technical data generated by use of the platform.

This policy does not cover the data a customer office enters into Officera about its own clients (names, addresses, identification documents, contracts, invoices, and so on). For that data the office is the controller and Officera is only a processor; that relationship is governed by the Data Processing Agreement (DPA). If you are a client of an office that uses Officera and want to exercise your rights, please contact that office.

2. Controller

Entity: [TO BE COMPLETED: full legal entity name]
Tax number: [TO BE COMPLETED: NIF/NIPC]
Registered office: [TO BE COMPLETED: full registered address]
Email for data protection matters: [TO BE COMPLETED: data protection officer or privacy contact email]
Data Protection Officer (DPO): [TO BE COMPLETED: name and contact, or a statement that none has been appointed because it is not legally required]

3. What data we process, why, and on what legal basis

3.1 Account and office data

Data: user name, email address, username, profile picture (if uploaded), roles and permissions, verification status, blocked status, creation date; office name and identifier and office profile data.

Purpose: create and maintain the account, authenticate users, apply permissions, provide the service and customer support.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

3.2 Authentication and security data

Data: cryptographic hash of the password (argon2id — never the plaintext password), session refresh tokens and their expiry dates, failed login attempt counters and temporary account lockouts.

Purpose: authenticate access, keep the session signed in, protect against unauthorised access and brute-force attacks.

Legal basis: performance of the contract and legitimate interest in platform security (Art. 6(1)(b) and (f)).

3.3 Billing and payment data

Data: subscribed plan, billing period, subscription status, trial and access start and end dates, Stripe customer and subscription identifiers, subscription invoice history. Card data is collected and processed directly by Stripe; Officera does not receive or store card numbers.

Purpose: process the subscription, charge for the service, issue billing documents and comply with tax and accounting obligations.

Legal basis: performance of the contract and compliance with a legal obligation (Art. 6(1)(b) and (c)).

3.4 Technical logs and monitoring

Data: server and application logs (date and time, IP address, request method and path, response code, request and trace identifiers, user agent, error messages), authentication events and application errors.

The application integrates Grafana Faro for real user monitoring (RUM), distributed tracing, JavaScript errors and browser performance metrics. When this monitoring is enabled, technical session data is sent to Grafana Cloud and, for authenticated users, the user identifier, email address, office identifier and assigned roles.

[TO BE COMPLETED: confirm whether Grafana Faro monitoring is enabled in the production environment and, if so, confirm the hosting region of the Grafana Cloud instance for international transfer purposes.]

Purpose: keep the platform working, diagnose faults, detect abuse, and improve performance and reliability.

Legal basis: legitimate interest in keeping the platform secure, stable and functional (Art. 6(1)(f)).

3.5 Communications

Data: email address and the content of messages exchanged with us.

Purpose: send operational and service messages (registration confirmation, password recovery, billing notices, changes to these documents) and answer support requests. Service emails are sent through Amazon SES, in the eu-west-1 (Ireland) region.

Legal basis: performance of the contract for service messages; consent for marketing communications, if and when they exist, withdrawable at any time.

3.6 The officera.pt website

The public website is static and does not use analytics, advertising or personalisation cookies. See the Cookie Policy.

4. How long we keep data

Data	Retention period
User account and office data	For as long as the subscription is active, plus [TO BE COMPLETED: retention period after termination, e.g. 30 days] after termination
Session refresh tokens	Until the configured expiry (30 days by default) or end of session, whichever comes first
Billing data and tax documents	For the statutory period applicable in Portugal — [TO BE COMPLETED: confirm period, typically 10 years for tax records]
Technical logs and monitoring data	[TO BE COMPLETED: log retention period on the server and in Grafana Cloud]
Backups	According to backup rotation: older backups are deleted automatically by the storage lifecycle rule — [TO BE COMPLETED: confirm the rule applied to the production environment]

Once the applicable period ends, data is deleted or anonymised.

Officera does not sell personal data and does not use it to train artificial intelligence models. We use the following processors:

Processor	Role	Processing location
Amazon Web Services (AWS)	Hosting of the application, database, document storage and backups	European Union — eu-west-1 (Ireland)
Stripe	Payment processing, subscription management and billing portal	Stripe processes data in the EU and the US, under the safeguards in section 6
Grafana Labs (Grafana Cloud)	Application error, performance and tracing monitoring	[TO BE COMPLETED: confirm the Grafana Cloud instance region in use]
Amazon SES (AWS)	Sending service emails	European Union — eu-west-1 (Ireland)

We may also disclose data to public authorities where the law requires it, and to advisers (accountants, lawyers) bound by confidentiality, strictly to the extent necessary.

6. International transfers

Officera’s main infrastructure is hosted in the European Union (AWS, eu-west-1, Ireland). Some providers, notably Stripe, may process data outside the European Economic Area. In those cases transfers rely on the safeguards in Chapter V of the GDPR, in particular the European Commission’s Standard Contractual Clauses and, where applicable, adequacy decisions (such as the EU-US Data Privacy Framework), together with supplementary technical measures.

7. Security

We apply technical and organisational measures appropriate to the risk, described in detail in the DPA, in particular:

isolation between offices through PostgreSQL row-level security, enabled and enforced (ENABLE and FORCE ROW LEVEL SECURITY) on the tables holding client data; the application database role cannot bypass these policies and the API refuses to start if that role holds the BYPASSRLS privilege;
encryption in transit (HTTPS/TLS) for all access to the application and the API;
passwords stored only as a cryptographic hash (argon2id);
short-lived signed token authentication (JWT), with the refresh token in an HttpOnly, Secure, SameSite=Strict cookie;
temporary account lockout after a configured number of failed attempts;
daily backups of the database and documents, server-side encrypted and stored in S3 in the eu-west-1 region;
role and permission based access control inside each office.

No system is completely immune. Officera does not currently hold ISO 27001, SOC 2 or equivalent certifications, and does not claim otherwise.

8. Your rights

Under the GDPR, you have the right to:

access — find out what data of yours we process and get a copy;
rectification — correct inaccurate or incomplete data;
erasure — request deletion of your data, where there is no basis for keeping it (for example, tax obligations);
restriction — request suspension of processing in certain circumstances;
portability — receive the data you provided to us in a structured, commonly used, machine-readable format, or ask for it to be transmitted to another controller;
objection — object to processing based on legitimate interest, on grounds relating to your particular situation;
withdraw consent at any time where processing is based on it, without affecting the lawfulness of processing carried out beforehand.

How to exercise them

Send a request to [TO BE COMPLETED: email address for data subject requests], identifying yourself and stating the right you wish to exercise. We may ask for additional information to confirm your identity. We respond within the periods set out in the GDPR.

If the request concerns data that a customer office entered into Officera about you as a client of that office, we forward the request to that office, which is the controller.

Complaints

You have the right to lodge a complaint with the supervisory authority: Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, Portugal — www.cnpd.pt.

9. Automated decisions

Officera does not make solely automated decisions producing legal effects on data subjects, nor does it carry out profiling for that purpose. Automatic subscription states (trialing, active, expired, over limit) follow only from applying the contractual rules of the plan.

10. Minors

Officera is a professional tool and is not directed at people under 18. We do not knowingly collect minors’ data for account creation.

11. Changes to this policy

We may update this policy to reflect changes to the service or to the law. The version in force is always identified in the header. Material changes are communicated by email or inside the application.

12. Contact

[TO BE COMPLETED: legal entity name] — [TO BE COMPLETED: address] Email: [TO BE COMPLETED: privacy contact email]

In the event of any discrepancy between this English version and the Portuguese version, the Portuguese version prevails.

Privacy Policy