WiNOVA Privacy Policy

The controller of the data of WiNOVA's users is Soft Opera, Unipessoal Lda, NIF 517794934, Rua da Escola, n.º 75, 3530-301 Mangualde ("we").

Contact: info@winova.pt. We have not appointed a data protection officer.

This policy completes point 6.2 of the terms of use and applies to the users' data: account, access and security.

Account and service — contract (Article 6(1)(b) GDPR). Name, e-mail, role, language, password (only as a bcrypt hash), dates of acceptance of the terms, of e-mail verification and of the last sign-in. By e-mail we send the account verification, password recovery and subscription notices.

Security and abuse prevention — legitimate interest (point (f)). Sessions, the count of failed sign-in attempts per account and per IP address (only cryptographic digests, never the address), the record of administrative access (who accessed which data, without free text), server logs and error reports without personal data.

Performance measurement — legitimate interest (point (f)). For each request to the server we keep the response time, the route, the user's identifier and the browser (user agent), read from the request itself. We do not read data on your device or create profiles.

Invoicing — contract and legal obligation (points (b) and (c)). Your company's invoicing data (name, NIF, address, e-mail) go to Stripe and to Moloni.

You may object to the processing based on legitimate interest (point 7.2).

WiNOVA uses only strictly necessary cookies: the session cookie winova_token (HttpOnly, 24 hours) and, at factory stations, the cookie winova_factory_station, which identifies the station your company authorised (up to 1 year, revocable). Cloudflare may set security cookies (__cf_bm, cf_clearance), strictly necessary for protection against abuse.

We do not use analytics or advertising cookies, nor third-party fonts, scripts or content: the service loads only from our own origin; payment takes place on Stripe's site. That is why no consent notice is needed (Article 5(2) of Law no. 41/2004; Article 5(3) of Directive 2002/58/EC).

Only our team accesses the data, by role and with a record. Sub-processors, those of point 6.3 of the terms:

• Hetzner: servers, in Germany and Finland;

• Backblaze: encrypted backups, in the EU (the Netherlands);

• Cloudflare: network and protection;

• Stripe: payments;

• Moloni: invoicing;

• Resend: sending e-mails.

Error tracking (Bugsink) runs on our own server, at Hetzner. It is not a third party.

We disclose data to authorities only when the law requires it.

The data are hosted in the EU. Backblaze, Cloudflare, Resend and Stripe are US companies and may access data from there, only with the European Commission's standard contractual clauses or under the EU-U.S. Data Privacy Framework. You may ask us for a copy of the safeguards.

Account data: while the account exists and, afterwards, within the periods of point 10.3 of the terms (at most 80 days, with no pending export).

Sessions and verification or recovery codes: deleted 7 days after they expire.

Count of sign-in attempts: a 15-minute window; records deleted after 1 day.

Performance samples: 30 days.

System logs: 30 days. Web server access logs (with the IP address): 14 days.

Record of administrative access: 3 years after the end of the account, the limitation period for civil liability (Article 498 of the Portuguese Civil Code). It contains only identifiers.

Invoices and invoicing data: 10 years (Article 123 of the CIRC and Article 52 of the CIVA).

Backups: up to 35 days after deletion from the active databases (point 10.3 of the terms).

You may request access to, rectification, erasure, restriction and portability of your data, and object to the processing. The name, e-mail and language can be changed in the account itself.

Right to object. You may object, on grounds relating to your situation, to the processing based on legitimate interest (points 2.2 and 2.3). We stop, unless there are compelling grounds, such as the security of the service, or the defence of legal claims.

We reply within 1 month, at info@winova.pt. We may ask you to confirm your identity.

You may lodge a complaint with the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

The account needs a name and an e-mail. Without them we cannot provide the service. If you were invited, we receive them from your company's account administrator. The remaining data result from use.

We do not take decisions based solely on automated processing with legal or similarly significant effects on you. The block after failed sign-in attempts is a security measure, lifted after 15 minutes.

Encryption in transit (HTTPS), HttpOnly and Secure cookies, passwords with bcrypt, encrypted second-factor secret (AES-256-GCM), separation by company in the database, access by role, record of administrative access, encrypted backups, removal of e-mails and IP addresses from logs and error reports.

For the data of the customers, contacts and suppliers your company uploads, it is the controller and we are the processor, under Annex A of the terms of use.

It is for your company to inform its customers, in its own privacy policy. This policy does not replace it.

We publish changes here and update the date. We notify the account administrator by e-mail of important changes, under point 2 of the terms.