Privacy policy
Version 1 · in force since Oct 15, 2026
We keep the minimum needed for Bolas Planner to work, in the European Union. We do not sell data or use it for advertising. You can download or delete your data whenever you want.
1. Who we are
The controller for your account data is [COMPANY NAME], tax number [TAX NUMBER], registered at [ADDRESS]. Privacy contact: [PRIVACY EMAIL].
What your team writes in an organization (tickets, comments, pages and attachments) belongs to the organization. For that data, your company is the controller and we process it on its behalf, under the Data processing agreement (GDPR Art. 28).
2. What data we process, why and on what legal basis
| Data | What for | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, email, password (stored protected), photo, language, time zone | Create and manage your account | Performance of the contract |
| Role and display name (optional) | Prepare your home screen and show your name the way you prefer | Performance of the contract |
| Two-step verification, sign-in history, device and network (hashed only) | Protect your account and detect abuse | Legitimate interest (security) |
| Notice and security emails | Notices you chose and security alerts | Performance of the contract; legitimate interest |
| Error logs (without the content you write) | Keep the service working | Legitimate interest |
| Which version of the terms you accepted, and when | Prove the agreement | Legal obligation; legitimate interest |
| The organization’s country, size and sector | Applicable law, future billing and workflow suggestions | Performance of the contract |
| Network address and technical browser data in the anti-bot check (Cloudflare Turnstile), when signing in and creating an account | Protect the service against automated attacks | Legitimate interest (security) |
We do not process special categories of data (for example, health data) on our own initiative. We ask organizations not to put them in tickets without their own safeguards.
There are no automated decisions with effects on you. Artificial intelligence features only make suggestions; a person always decides.
3. How long we keep it
| Data | How long |
|---|---|
| Account (name, email, photo, preferences) | While the account exists |
| Organization content (tickets, comments, pages, attachments) | While the organization exists; 30 days after the contract ends, for export, then deleted |
| Sign-in history | 12 months |
| Read notifications | 6 months |
| Unread notifications | 12 months |
| Organization activity log | 24 months |
| Error logs (no content) | 90 days |
| Export files | 7 days |
| Proof of accepting the terms | While the account exists, plus 5 years |
| GDPR requests and the answers | 3 years after they close (proof of compliance) |
| Deleted account | Only an empty record remains, with no name or email; what you wrote in organizations stays as «Former member» |
Clean-up is automatic, every day.
5. Your rights
- Access and portability (Art. 15 and 20): download a file with all your data.
- Rectification (Art. 16): correct your profile whenever you want.
- Erasure (Art. 17): delete your account; you have 7 days to change your mind.
- Restriction (Art. 18) and objection (Art. 21): make a request and we answer.
- Withdraw consent, when there is any, at any time, without affecting what was done before.
Most of this is one button in Profile → Privacy and GDPR; the rest is a request there or to [PRIVACY EMAIL]. We answer within 1 month, free of charge (Art. 12). For what you wrote in an organization, we forward the request to that organization’s owner.
6. Security
Encrypted connections, data separated per organization in the database itself, two-step verification, passwords checked against known data leaks, backups and an activity log (Art. 32).
If a data breach puts you at risk, we tell you without delay and notify the CNPD (the Portuguese data protection authority) within 72 hours (Art. 33 and 34).
8. Minimum age
Bolas Planner is a service for professionals. You must be at least 16 to create an account.
9. Contact and complaints
Write to [PRIVACY EMAIL]. You can also complain to the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
If we change this policy in an important way, we tell you and ask you to accept it again.