Privacy policy

1. Who we are

The controller responsible for your personal data is Rubinx Unipessoal Lda, trading as Rubinx Software Solutions, a single-member private limited company registered in Portugal and based in Azeitão, Setúbal, Portugal.

You can reach us by email at info@rubinx.com or by phone on +351 969 782 963.

We have not appointed a Data Protection Officer, as the law does not require one given the nature and scale of our processing. For any privacy question or request, write to info@rubinx.com, ideally with 'Privacy' in the subject line.

2. What this policy covers

This policy covers the website rubinx.com, in English and Portuguese, and any enquiry you send us through the contact form, by email, by phone or on WhatsApp. It also covers the contact details we keep if you or your organisation becomes a client.

It does not cover personal data we handle on behalf of our clients inside the software, websites or systems we build, host or support for them. In that work we act as the client's processor, and our contract with the client sets out how that data is protected.

Our product SnapReceipts has its own website, snap-receipts.com, with its own privacy policy. If you ask us about SnapReceipts through this website, this policy applies to that enquiry.

3. What we collect and when

We collect only the following personal data.

• When you use our contact form: your name, email address, company (optional), the topic you pick (optional), your message, and whether you used the English or Portuguese site. Because your browser sends the form directly to our form-delivery provider, EmailJS, that provider also receives the technical data any internet connection reveals, namely your IP address and browser type.
• When you email, call or message us on WhatsApp: your email address or phone number, your name or WhatsApp profile name, and whatever you choose to tell us.
• When you visit the website: our hosting provider automatically processes the technical data your browser sends with every request, namely your IP address, browser and device type, the page requested, the referring page, and the date and time.
• If a colleague of yours or one of our clients introduces you to us: your name, business contact details and the context of the introduction, which we receive from them.
• If you or your organisation becomes a client: the contact details, correspondence, quotations, contracts and billing details needed to agree the work, deliver it and invoice it.

The contact form has a hidden field and a timing check that block automated spam; they store nothing about you. We do not ask for special categories of data, such as health data, and we ask you not to include any in your message. If you do, we use it only to answer you and delete it together with your enquiry.

4. Why we use your data and on what legal basis

We use your data only for the purposes below. Each purpose has its own legal basis under Article 6(1) of the GDPR.

• To answer your enquiry, prepare a proposal or fixed-price quotation and follow it up, and to contact you if a colleague or client has introduced you to us. If you contact us for yourself, for example as a sole trader, the legal basis is taking steps at your request before a possible contract (Art. 6(1)(b)). If you contact us on behalf of a company or other organisation, or someone has introduced you to us, the legal basis is our legitimate interest in answering business enquiries and following up introductions (Art. 6(1)(f)).
• To deliver and manage our services, including under any monthly support or hosting agreement, if you or your organisation becomes a client. The legal basis is the contract with you (Art. 6(1)(b)) or, for contact people at a client organisation, our legitimate interest in managing that relationship (Art. 6(1)(f)).
• To keep invoices, accounting and commercial records. The legal basis is compliance with our legal obligations under Portuguese accounting, tax and commercial law (Art. 6(1)(c)).
• To deliver the website and keep it and the contact form secure and free of spam and abuse. The legal basis is our legitimate interest in running a secure website (Art. 6(1)(f)).
• To establish, exercise or defend legal claims. The legal basis is our legitimate interest in protecting our rights (Art. 6(1)(f)).

Where we rely on legitimate interests, those interests are: answering enquiries from people and organisations interested in our services and following them up; following up when someone introduces a person to us; managing our relationships with clients and their staff; keeping our website and systems available and secure; and keeping records so we can show what was agreed. We have weighed these interests against your rights. We use only the details you give us and your professional contact details, in the way you would expect after contacting a business. You can ask us for more detail at info@rubinx.com.

We do not use your data for advertising, we do not create profiles, and we do not sell or rent it. We do not send newsletters or marketing, and we will not add you to a mailing list unless you have agreed to it. You can tell us to stop contacting you at any time.

We do not rely on your consent for any of the processing described here. If we ever ask for your consent for something new, you can withdraw it at any time; withdrawing it does not affect the lawfulness of what we did on the basis of your consent before you withdrew it. If we want to use your data for a purpose not described here, we will tell you first.

5. Who receives your data

Within Rubinx, only our team can see your enquiries. We use the service providers below, which process personal data on our behalf as our processors, under data processing agreements and on our instructions. EmailJS and Google may also use technical connection data, such as IP addresses, for their own security and abuse prevention, under their own privacy policies.

• Google Ireland Limited and Google LLC, through Firebase Hosting, which hosts and delivers this website.
• EmailJS Pte. Ltd. (Singapore), which passes the contact form from your browser to our mailbox. EmailJS uses its own service providers, such as Cloudflare and Amazon Web Services, to run its service.
• Our business email provider, which hosts our mailbox, including the enquiries you send us by form or by email, and whose mail server EmailJS uses to deliver form messages to that mailbox.

If you choose to contact us on WhatsApp, your messages are carried by WhatsApp, a service of WhatsApp Ireland Limited (Meta group), which also processes your account and usage data under its own terms and privacy policy.

If you or your organisation becomes a client, your billing details and invoices are also shared with our certified accountant and with the provider of our certified invoicing software, which process them for our bookkeeping, and invoice data is reported to the Portuguese Tax and Customs Authority (Autoridade Tributária e Aduaneira), as Portuguese tax law requires. Payments pass through our bank. Apart from that, we disclose personal data to public authorities, courts or our lawyer only when the law requires it or when it is needed to establish, exercise or defend legal claims.

If you ask, we will tell you exactly who has received your data.

6. Transfers outside the European Economic Area

Some of our providers process data outside the European Economic Area (EEA). When that happens, the transfer is protected as the GDPR requires.

• EmailJS is based in Singapore and processes form messages on servers in the United States, using providers such as Cloudflare and Amazon Web Services. Singapore has no EU adequacy decision, so this transfer relies on the European Commission's Standard Contractual Clauses included in EmailJS's data processing agreement.
• Google may process hosting data in the United States and at content-delivery locations around the world. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as adequate (Commission Implementing Decision (EU) 2023/1795). Where that framework does not apply, Google's data processing terms include Standard Contractual Clauses.
• Our business email provider may process our email outside the EEA. Where it does, the transfer relies on an adequacy decision, such as the one covering the EU-U.S. Data Privacy Framework, or on the Standard Contractual Clauses in its data processing terms.
• If you contact us on WhatsApp, Meta may transfer WhatsApp data to the United States, relying on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses, as described in WhatsApp's privacy policy.

You can ask us at info@rubinx.com for a copy of these safeguards.

7. How long we keep your data

We keep personal data only as long as we need it for the purposes above or as the law requires, and then we delete or anonymise it.

• Enquiries and introductions that do not lead to us working together, including form messages, emails, WhatsApp messages and our notes: kept for 24 months after our last contact with you. We review our records every six months and at each review delete those that have passed this period, including copies on our phones and in their backups, so none is kept for more than 30 months after our last contact with you.
• If you or your organisation becomes a client: correspondence, quotations and contract records for as long as we work together, including any support or hosting agreement, and then for 10 years after the end of the year in which our relationship ends, because Portuguese commercial law requires businesses to keep commercial correspondence and records for 10 years (Commercial Code, art. 40) and we may need them to deal with any legal claims. Material we no longer need for this, such as drafts and working files, is deleted sooner.
• Invoices, receipts and other accounting records: 10 years after the end of the year they relate to, as Portuguese tax law requires (Decree-Law no. 28/2019 of 15 February, art. 19, and the VAT Code, art. 52), or longer only where tax law requires it.
• The copy held by EmailJS: EmailJS keeps the technical records it needs to deliver messages and protect its service against abuse, and may keep a copy of the message in its delivery history for up to 30 days, after which it is deleted.
• Technical data processed by Google for hosting: kept by Google for a limited period under its own rules, for security and abuse prevention; Google states that Firebase Hosting keeps IP address data for a few months. We do not keep our own visitor logs.

If there is a complaint, dispute or legal claim, we may keep the relevant information until it is resolved and any legal time limits have passed.

You can ask us at any time to delete your message and the data you sent us sooner. Where the law requires us to keep a record, such as an invoice, we delete it once the legal retention period ends.

8. Cookies and similar technologies

This website does not use cookies. We do not use analytics, advertising, tracking pixels, social media plugins or any other tracking technology, and our fonts are served from our own website rather than by a third party.

Apart from the copies of the site's own files (pages, scripts, fonts and images) that your browser keeps in its normal cache so the site loads faster, the only thing the website stores on your device is your language choice. When you pick English or Portuguese with the EN/PT switch, your browser saves that choice in its local storage, under the name rubinx.lang with the value en or pt, so that the next time you open rubinx.com it shows your chosen language. It holds nothing else, is never sent to us or anyone else, and is used for nothing else.

Because this storage is strictly necessary to provide what you expressly ask for when you use the switch (the website in the language you chose), it does not need your consent under article 5(2)(b) of Portuguese Law no. 41/2004 of 18 August, in its current wording. It stays on your device until you clear this site's data in your browser settings, which you can do at any time. If your browser blocks storage, the site still works; it just will not remember your choice.

Until you choose a language with the switch, whenever you open an English page of the site it opens in Portuguese instead if your browser's main language is Portuguese. This check happens in your browser; nothing is stored and nothing is sent to us.

9. Your rights

You can exercise any of the following rights free of charge:

• Access: see the personal data we hold about you and get a copy.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted.
• Restriction: have us limit how we use your data, for example while we check a question you have raised.
• Portability: where we process your data to take steps towards a contract with you or to perform one, receive the data you gave us in a structured, commonly used and machine-readable format, or have it sent directly to another organisation where technically feasible.
• Objection: object to processing based on our legitimate interests, as explained in the next section.

To exercise any of these rights, write to info@rubinx.com. We reply within one month. If a request is complex or you send several, we may need up to two more months, and we will tell you why within the first month. If we have reasonable doubts about who you are, we may ask for information to confirm your identity.

Some rights have limits. For example, we cannot delete invoices before the end of the period for which the law requires us to keep them. If we do not do what you ask, we will tell you why within one month and remind you that you can complain to the CNPD (see 'Complaints') or go to court. If we correct, delete or restrict your data, we also tell everyone to whom we have disclosed it, unless that is impossible or involves disproportionate effort, and we will tell you who they are if you ask.

We may charge a reasonable fee or refuse a request only if it is manifestly unfounded or excessive, for example because it is repeated.

10. Your right to object

Where we process your data on the basis of our legitimate interests, you can object at any time, on grounds relating to your particular situation, by writing to info@rubinx.com.

We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

If you ask us to stop contacting you, we will stop straight away, except for messages we must still send you to perform a contract with you or your organisation or to meet a legal obligation, such as an invoice. We do not send marketing; if we ever do, you can object to it at any time and we will stop.

11. Complaints

If you think we have not handled your data lawfully, we would appreciate the chance to put it right first, so please contact us at info@rubinx.com.

You also have the right to lodge a complaint with the Portuguese data protection authority.

• Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
• Phone: +351 213 928 400
• Email: geral@cnpd.pt
• Online complaint form: www.cnpd.pt/cidadaos/participacoes

If you live or work in another country of the European Economic Area, or the alleged infringement took place there, you can also complain to the data protection authority in that country.

12. Do you have to give us your data?

You are not obliged to give us any personal data. On the contact form, your name, email address and message are needed so we can reply; your company and the topic are optional. If you prefer not to use the form, you can email or call us instead.

If you become a client, we need your contact details to agree and deliver the work, which is a contractual requirement, and your billing details to invoice it, which Portuguese tax law requires. Without them we cannot enter into a contract with you.

13. Automated decisions and profiling

We do not make decisions about you based solely on automated processing, and we do not profile visitors. The contact form's automatic spam check looks only at the hidden field and at how soon after the page opened the form is sent, to stop automated bot submissions; it makes no decision about you. If a message is blocked by mistake, you can always email or call us.

14. Security

The website is served only over an encrypted connection (HTTPS), and the contact form travels from your browser to EmailJS over an encrypted connection. Within Rubinx, only our team can access enquiries, and our service providers are bound by data processing agreements.

If a personal data breach occurs, we notify the CNPD without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms. If the breach is likely to put your rights and freedoms at high risk, we tell you without undue delay, as the law requires.

15. Children

Our website and services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact info@rubinx.com and we will delete it.

16. Other websites

This website links to other websites and apps, such as snap-receipts.com and WhatsApp. Once you follow such a link, that provider's own privacy policy applies, and we do not control what it collects. SnapReceipts has its own privacy policy at snap-receipts.com.

Email and phone links on this site open your own email or phone app; nothing is sent to us until you send the message or make the call.

17. Changes to this policy

If we change this policy, we will publish the new version on this page with a new date. If a change is significant, for example a new purpose or a new service provider outside the EEA, we will also tell our clients and their contact people, and people whose enquiries are still open, by email or through the channel they used to contact us.

This policy is available in English and Portuguese; both versions have the same content.

18. Contact us

For any question about this policy or your personal data, write to info@rubinx.com, ideally with 'Privacy' in the subject line, or call +351 969 782 963.

Rubinx Unipessoal Lda, Azeitão, Setúbal, Portugal.