This Policy explains how CloudWorks, Lda, hereinafter "Teleperitagens", processes personal data on the teleperitagens.pt website and on the Teleperitagens platform. It complies with Regulation (EU) 2016/679 ("GDPR"), Law No. 58/2019 of 8 August and Law No. 41/2004 of 18 August. If anything is unclear, write to us: ola@teleperitagens.pt.

1. Controller.

CloudWorks, Lda
NIPC: PT513268367
Registered office: Rua Florbela Espanca, 139 · 4470-296 Maia
Contact: ola@teleperitagens.pt

Data Protection Officer (DPO): José Matos · ola@teleperitagens.pt.

2. What data we process.

As controller

• Account: name, email, password (stored only as a hash), optional telephone number, optional profile photo and signature, two-factor authentication data, sign-in through Google, Microsoft or Apple, and acceptance of these Terms and this Policy (date and version).
• Workspace and team: company name, branding, members and roles, billing details provided by the customer.
• Payments: credit purchases and invoices. Card details are processed by Stripe and do not pass through our servers.
• Security and use: IP address, device and browser, active sessions, sign-in history, audit logs and technical logs.
• Support: messages, attachments and, if the user authorises it, the page and screenshots of the request.
• Waiting list and contact: name, email, company, job title, estimated volume of inspections and optional telephone number.
• Website: aggregated, cookie-free statistics through Umami (stats.cloudworks.pt, hosted by CloudWorks in the EU), without storing the IP address or identifying visitors.

As processor (on behalf of the customer)

• Identification and contact details of the claimant (name, telephone, email), claim and policy number, and details of the vehicle or property.
• Image, voice and video of the video call, photographs, measurements, location if shared by the claimant, uploaded documents, notes, damage assessment and report.
• Proof of the claimant's consent (name, date, text accepted).

We do not ask for special categories of data. If a customer includes them in notes or files, the customer is responsible for having a legal basis to do so.

3. Purposes and legal basis.

• Providing the Platform, managing the account and processing payments. Performance of a contract (Art. 6(1)(b)).
• Sending service communications (verification, invitations, security alerts, receipts). Performance of a contract and legitimate interest.
• Security, prevention of abuse and fraud (including Cloudflare Turnstile, request limits and audit logs). Legitimate interest (Art. 6(1)(f)).
• Customer support. Performance of a contract and, for technical context data, consent.
• Invoicing and tax obligations. Legal obligation (Art. 6(1)(c)).
• Waiting list and news. Consent, which you may withdraw at any time.
• Inspections. The legal basis is determined by the customer as controller (for example, performance of an insurance contract, legitimate interest or legal obligation). Teleperitagens processes the data only on the customer's instructions.

4. How long we keep it.

• Completed inspection sessions (data, photographs, videos, recordings and report): permanently deleted 90 days after they end, by default. The customer must first export what it needs to keep.
• Account: for as long as it is active. When the account is deleted, personal data is deleted or anonymised, except what the law requires us to keep.
• Invoicing: the period required by tax law.
• Technical and audit logs: up to 90 days, except security audit logs, which may be kept for longer.
• Support requests: deleted 24 months after the request is closed.
• Waiting list: up to 12 months if you do not create an account, and until the end of the relationship if you do.
• Proof of consent: for as long as we process the data and up to 5 years after withdrawal, for the defence of legal claims.

5. Who we share with.

We do not sell data. We use technically necessary processors, bound by contract under Art. 28 of the GDPR:

• Cloudflare, Inc. — network, abuse protection, captcha (Turnstile) and real-time video transmission (Cloudflare Calls).
• Hetzner Online GmbH (Germany) — storage of files and recordings, in data centres in the EU.
• Stripe Payments Europe, Ltd. — payment processing.
• BulkGate — sending SMS messages to claimants.
• Transactional email provider — sending service emails.
• CloudWorks, Lda — internal systems for managing support requests and business contacts.

Customers may also connect, with their own keys, artificial intelligence services (OpenAI, Anthropic, OpenRouter) for optional features. That connection is the customer's decision, for which the customer becomes responsible, and it is used only when enabled.

We may also share data where required by law or by order of a competent authority.

6. International transfers.

Some processors may process data outside the European Economic Area. In those cases, we ensure adequate protection through the European Commission's standard contractual clauses (Decision 2021/914) or valid adequacy decisions.

7. Your rights.

You have the right of access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time. To exercise them, write to ola@teleperitagens.pt; we reply within a maximum of 30 days. If your request concerns data from an inspection, we forward it to the responsible entity. Details at Your GDPR rights.

8. Cookies and local storage.

We do not use advertising, analytics or third-party cookies. The Platform uses only what is strictly necessary for it to work, which does not require consent: browser local storage to keep you signed in and for preferences such as language and theme, and, on this website, one cookie (cw_consent, 180 days) that records that you have seen the cookie notice. Cloudflare Turnstile may set its own technical elements to tell people from robots. Typefaces are served by us, with no requests to third parties.

9. Data security.

We apply measures proportionate to the risk: encrypted communication (TLS), passwords with secure hashing (Argon2id), encryption at rest of sensitive credentials, two-factor authentication, access control by role and by workspace, signed and temporary links for files, audit logs and separation between environments. No system is invulnerable: in the event of a breach, we comply with the notification duty in Art. 33 of the GDPR and, where we are processor, we notify the customer without undue delay.

10. Minors.

The Platform is intended for professionals. We do not knowingly collect data from persons under 18 for account purposes. Inspections involving minors are the customer's responsibility.

11. Changes to this policy.

We may amend it for legal, technical or operational reasons. The version in force is always at teleperitagens.pt/en/privacy, with the version and date at the top. Material changes are communicated by email or on the Platform.

12. Governing law and jurisdiction.

This Policy is governed by Portuguese law. For any dispute, the parties choose the courts of the Comarca do Porto (Porto judicial district), waiving any other, without prejudice to the mandatory rights of the data subject.