Privacy Policy
Last updated: 11 October 2026
Effective from [effective date]. This Policy explains how Superteams processes personal data under the General Data Protection Regulation (GDPR).
1. Controller
[Company legal name], company registration number [NIPC], [registered office]. Privacy contact: [email protected].
2. Two different roles
- Controller: when we process account, billing, website and support data, we decide what it is used for.
- Processor: when we process personal data that the Customer puts in its documents, we act on behalf of the Customer, who is the controller. The DPA applies.
3. What data we process, why and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, company, hashed password | Create and manage the account, authenticate | Performance of the contract |
| Billing data, tax number, payment status | Charging, invoicing, accounting | Performance of the contract and legal obligation |
| Technical logs (IP, device, date and time of access) | Security, abuse prevention, diagnostics | Legitimate interest |
| Support messages | Answer requests | Performance of the contract and legitimate interest |
| Service emails (invitations, notices, account recovery) | Operate the service | Performance of the contract |
| Aggregated usage data | Improve the product | Legitimate interest |
| Product news | Email marketing | Consent, which you can withdraw at any time |
Stripe processes payment data. We do not receive or store the full card number.
4. Who we share data with
We only share data with subprocessors needed to run the service, listed in the list of subprocessors, such as hosting, database, file storage, email delivery, AI features and payments. We may also share data with authorities when the law requires it. We do not sell personal data.
5. Transfers outside the EEA
Some subprocessors are in the United States. In those cases, transfers rely on an adequacy decision (the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's standard contractual clauses, with the necessary supplementary measures. Database data is stored in AWS Europe Central 1 (Frankfurt, Germany).
6. Retention
- Account data: while the account exists and up to 30 days after it ends.
- Billing data: for the legal tax and accounting retention period (as a rule, 10 years).
- Technical logs: up to [90] days.
- Marketing: until you withdraw consent.
7. Your rights
You can request access, rectification, erasure, restriction, portability and object to processing, and withdraw consent where that is the legal basis. Write to [email protected]; we reply within 1 month. If you have a complaint, you can contact the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD) at cnpd.pt.
If your data appears in a Customer's documents, please address your request to that Customer first, as it is the controller.
8. Security
We use encryption in transit (HTTPS), encryption at rest with a key per workspace, access control, separation between workspaces and backups. If there is a personal data breach, we notify the CNPD and the people affected as required by the GDPR.
9. Cookies
See the Cookie Policy.
10. Children
The service is intended for business use and not for anyone under 16.
11. Changes
When we change this Policy in a meaningful way, we will notify you by email or in the application. The current version is always available at superteams.eu/legal/privacy.