Privacy policy
What we collect, why, where it is kept and how to reach us.
Draft for legal review. This text is a working draft prepared from standard EU templates. It is not yet approved and does not apply until this banner is removed. Items in [brackets] are still to be filled in.
Who we are
Dueclear is a service of [Legal name of the company], [Registered address, Lisbon, Portugal], [NIF / VAT number]. Contact for privacy questions: privacy@[domain].
Two roles
For the website, sign-up and billing we are the controller. For the register your organisation keeps in Dueclear (buildings, renewals, certificates, contacts) your organisation is the controller and we are the processor, acting only on its instructions under our data processing agreement.
What we collect, why, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Your account: name, email, language, role | To give you access and keep the workspace secure | Contract (art. 6(1)(b)) |
| The register your team enters: buildings, clients, renewals, notes, certificates, history | To provide the service. We act as processor for this data on your behalf (see the DPA) | Contract; for customer content, your instructions under art. 28 |
| Contractor uploads through a link: the file and an optional date | To deliver the certificate to the team that asked for it | Legitimate interest of the customer (art. 6(1)(f)) |
| Billing details: company, VAT number, billing email | Invoices, tax and accounting duties | Contract; legal obligation (art. 6(1)(c)) |
| Technical data: IP address, browser, time of request | Security, abuse prevention, error fixing | Legitimate interest (art. 6(1)(f)) |
| Support conversations | To answer you and improve the service | Contract; legitimate interest |
Where it is stored
The database and uploaded files are stored in the European Union (Frankfurt). Certificates you drop into Dueclear are read in your browser first; only the file you confirm is uploaded. The service providers we use are listed on the subprocessors page. Where a provider may access data from outside the EEA, we rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep it
- Workspace data: while your subscription is active. After cancellation we keep it for 30 days so you can export it, then delete it, including files. Backups roll off within 90 days.
- Invoices and accounting records: as long as Portuguese tax law requires (currently 10 years).
- Security logs: up to 90 days.
Your rights
You can ask to access, correct, delete, restrict or port your data, and object to processing based on legitimate interest. Owners can export everything and delete the whole workspace in Settings at any time. Write to privacy@[domain]; we answer within one month. You can also complain to the Portuguese data protection authority (CNPD, cnpd.pt) or the authority where you live.
Cookies
We use no advertising or tracking cookies. See the cookie notice.
Security
Encryption in transit and at rest, strict separation between customer workspaces enforced by the database, optional two-step sign-in, private file storage with short-lived links, and nightly encrypted off-site backups. More on the security page.
Changes
If we change this policy in a way that matters, we tell workspace owners by email at least 30 days before.
Last updated 11 November 2026. Draft version.