Privacy Policy

1. Who is responsible for your data

The controller is Companhia Portuguesa de Impressoras, Tecnologias de Impressão, Unipessoal, Lda, NIPC 504263315, R. dos Eucaliptos, Lote 63, Loja 3B, 2610-069 Amadora. Email info@cpiti.pt, telephone +351 214 727 000.

For any question about this policy or to exercise your rights, write to that address or email.

2. What data we process

Depending on how you interact with CPITI:

• Support and proposal requests: name, company, email, telephone, and what you tell us about the equipment (brand, model, serial number, reported fault) or about your print fleet (number of devices, monthly volume).
• Client area: name, email, role, and the organisation you belong to; session records (date, browser/device); one-time access codes and registered passkeys — codes and session tokens are stored only as cryptographic hashes, never in readable form.
• Contract delivery: equipment and its location, contracts, meter readings, technician visits (reported fault, work carried out, parts used) and quotes.
• Analytics data about your visit, only if you consent.

3. Why we process it, and on what legal basis

• To answer support and proposal requests — pre-contractual steps taken at your request (GDPR art. 6(1)(b)).
• To deliver contracts, schedule visits, bill printed pages and manage equipment — performance of a contract (art. 6(1)(b)).
• To authenticate you in the client area and keep it secure — performance of a contract and our legitimate interest in preventing unauthorised access (art. 6(1)(b) and (f)).
• To meet accounting, tax and other statutory duties — legal obligation (art. 6(1)(c)).
• To measure how the site is used — your consent (art. 6(1)(a)), which you may withdraw at any time.

4. Cookies and local storage

Strictly necessary storage does not require consent (Lei 41/2004 art. 5.º(2)(b)): the client-area session, your light/dark theme preference, and the record of your own cookie choice.

Analytics is only enabled if you accept it. You can change your mind at any time through “Cookie settings” in the footer. Refusing has no effect on how the site works.

5. Who else has access

We do not sell your data and do not share it for third-party marketing. We do use providers who process data on our behalf, under contract and on our instructions:

• Website hosting: Vercel Inc.
• Application and database hosting: Hetzner Online GmbH (Germany).
• Email delivery for access codes and notifications: Google (Google Workspace relay).
• Analytics provider, where you have consented.

Where a provider processes data outside the European Economic Area, that transfer is covered by an adequacy decision or by standard contractual clauses. We may also disclose data where the law requires it.

6. How long we keep it

Requests that do not lead to a contract are kept only for as long as they are useful to answer and follow up. Contract data is kept for the life of the relationship and, afterwards, for the periods required by law — in particular accounting and tax rules. Meter readings are append-only because they are the basis for billing: a correction is recorded as a new reading rather than by overwriting an old one.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting processing already carried out.

To exercise them, contact info@cpiti.pt. You also have the right to complain to the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

8. Security

The site is served over HTTPS. The client area uses one-time email codes and passkeys instead of passwords; access codes and session tokens are stored only as cryptographic hashes, so they cannot be read back from the database. Access to customer data is restricted to those who need it to do their job.

9. Changes

If this policy changes materially we will say so on this page. Please check the date below.