Privacy policy

1. Who is the controller

The controller for the processing described here is [Company name], NIPC [NIPC], registered office at [registered address]. Contact: info@turmalina.pt.

This policy covers the data we process for ourselves: website visits, enquiries, customers and invoicing. The data about students, families and staff that schools put in the app is processed on behalf of each school, which is responsible for it. For that data the school's own privacy notice applies, and requests about it should go to the school; if they reach us, we pass them on.

2. What we process and why

Website visits: we use no analytics, advertising or social media tools. The hosting provider keeps short-lived technical logs (IP address, page requested, browser) for security and to run the service, based on our legitimate interest.

Contact form and emails: name, email, school or organisation and the message, to answer and, where relevant, prepare a proposal. Basis: steps taken at your request before a contract, and our legitimate interest in answering.

Customers: name and email of whoever creates the account and of the administrators, the group's billing details (name, tax number, address) and payment history, to perform the contract and meet legal obligations, notably tax ones.

Demo: no sign-up and fictional data. We use the IP address only briefly, to limit abuse.

3. Cookies and browser storage

We use only what is strictly necessary, which needs no consent:

• sm_session: session cookie, only after signing in to the app, to keep you signed in securely;
• sm_locale: your language choice, stored in the browser.

We use no analytics, advertising or third-party cookies.

4. How long

• Enquiries that don't lead to a contract: up to 2 years after the last contact.
• Customer data: for the contract and, after it, as long as needed for possible disputes.
• Invoices and tax records: 10 years, as Portuguese law requires.
• Website technical logs: a few days.

5. Who we share it with

With our processors, only to provide the service: Salesforce (Heroku, hosting in the EU), Brevo (email delivery, France) and Google Workspace (email). Also with our accountant, for invoicing, and with the authorities when the law requires. We don't sell personal data.

Some of these companies belong to groups based outside the European Union; any transfer is made with the GDPR's safeguards (an adequacy decision or standard contractual clauses).

6. Your rights

You may ask for access to your data, its rectification or erasure, restriction of processing and portability, and object to processing based on our legitimate interest. Write to info@turmalina.pt; we answer within one month.

You may also complain to the Portuguese data protection authority (CNPD), at www.cnpd.pt.

7. Children

The website and sign-up are for schools and the people who run them. Student accounts are created by the school, which is responsible for them.

8. Changes

We may update this policy. The date and version at the top show the latest; if a change matters, we tell customers.