Privacy Policy

1. Who we are

WEfin provides tax-compliance services in Portugal to owners of short-term rental properties (alojamento local) and to small businesses under the simplified regime (regime simplificado). WEfin is the controller of the personal data described in this policy.

For any question about your personal data, or to exercise your rights, contact us at info@wefin.pt.

2. Which personal data we process

Depending on how you use our services, we may process the following categories of personal data:

• Identity and contact details: name, e-mail address, phone number, postal address, date of birth, nationality, tax identification number (NIF) and, where required for onboarding, copies of identity documents.
• Property details: address, registration number (RNAL) and ownership information of the property you rent out.
• Booking and revenue data: reservations, payouts and invoices received through a connected booking platform or forwarded booking e-mails.
• Tax portal credentials: the access details you provide so we can file on your behalf. These are stored encrypted and used only for the filings you have instructed us to make.
• Payment data: invoicing details and payment status. Card details are handled by our payment provider and never stored by WEfin.
• Usage data: log data, device and browser information and the pages you visit in the client portal, used for security and to improve the service.
• Messages: anything you send us through the contact form, e-mail or the client portal.
• Advertising data (only with your consent): if you accept marketing cookies, the Meta Pixel records which pages of wefin.pt you visit, whether you sent us a contact request and whether you asked to be reached by e-mail or by phone. On the pricing and sign-up pages of the client portal it records that you opened the page, that you asked for a price and that you completed your sign-up. It sends this together with your IP address, browser information and a cookie identifier. Our server reports the same two events (that you asked for a price and that you signed up) directly to Meta as well, through Meta's Conversions API, so that they are counted even when a browser blocks the pixel. Both reports carry the same event code, so Meta counts each event once. With the server report we send your IP address, your browser's user agent, Meta's own cookies (_fbp, _fbc) if you have them, the address of the page and the time of the event. Neither the pixel nor our server sends Meta anything beyond this. In particular we never send your name, e-mail address, phone number, answers, price or the content of your enquiry, not even in encrypted or hashed form. The pixel never runs once you are signed in to the client portal, and without your consent nothing is sent, from your browser or from our server.

Messages you send us in the client portal are translated automatically, so you can write in your own language and our team reads them in English. Our replies are translated back into the language you wrote in. Both the original and the translation are kept with the message. The translation is made by an AI model from Anthropic, on our instruction, when the message is sent. Anthropic processes the text only to produce the translation and does not use it to train its models.

If you book a consultation call in the client portal, the booking is handled by Cal.com, which receives your name, e-mail address, phone number and the time you chose. The call itself takes place on Google Meet.

3. The AL Check and deadline reminders

On wefin.pt you can check an Alojamento Local registration number for free. The check looks the number up in our copy of the national register (RNAL) and tells you whether the registration is active and whether the property sits in a municipality with a containment zone (zona de contenção). We store nothing personal when you run a check: not the number you typed and no identifier for you. Our copy of the register holds only the registration number, modality, capacity, municipality, parish (freguesia) and registration date. The name, tax number, phone number and e-mail address of the holder are discarded before anything is written.

If you then ask for deadline reminders, we store your e-mail address, your answers (whether you are resident in Portugal, whether you rent out yourself or through a manager and, for residents, your turnover band), the registration numbers you entered and your language, and we send you a confirmation link. The reminders start only after you confirm. We record the consent you gave, with the exact text you saw and the date, so that we can show it. Two more boxes, both optional and unticked, let us contact you about WEfin's service and send you occasional news about WEfin and Portuguese tax rules; without them we never send you anything other than the reminders you asked for. You can withdraw any of these consents through the link at the bottom of every e-mail. The legal basis for each is your consent (art. 6(1)(a) GDPR). When you unsubscribe we delete your details and keep only a hashed form of your e-mail address, so that we never write to it again. The details of anyone who becomes a client are covered by the rest of this policy.

How the check is used is measured anonymously: our server counts that a check was completed, a calendar was viewed and a subscription was started or confirmed, with a random session identifier that is not stored in a cookie and is never linked to you or to a registration number. The Meta Pixel and the server events described above apply to these pages too, and only with your consent.

4. Why we process your data and on which legal basis

We only process personal data when we have a legal basis to do so:

• Performance of a contract (art. 6(1)(b) GDPR): to onboard you, prepare and submit your tax filings, invoice you and provide support, including the automatic translation of the messages we exchange.
• Legal obligations (art. 6(1)(c) GDPR): to comply with Portuguese tax, accounting, anti-money-laundering and record-keeping laws.
• Legitimate interests (art. 6(1)(f) GDPR): to keep our systems secure, prevent fraud, improve our services and answer your enquiries.
• Consent (art. 6(1)(a) GDPR): for optional communications such as newsletters, and for marketing cookies on our website and on the pricing and sign-up pages of the client portal, including the two events our server reports to Meta. You can withdraw consent at any time.

5. Who we share your data with

We do not sell personal data. We share it only where necessary to provide the service:

• Autoridade Tributária e Aduaneira (the Portuguese tax authority), municipalities and other public bodies, to the extent required for the filings and registrations you have instructed us to make.
• Service providers that host our systems, send e-mail, process payments, connect booking platforms, translate messages or handle the booking of consultation calls. They act on our instructions under a data-processing agreement.
• Professional advisers, such as accountants or lawyers, where needed to deliver the service or to comply with the law.
• Authorities, where we are legally required to disclose data.
• Meta Platforms Ireland Ltd., only if you accept marketing cookies (see “Security and cookies”). For collecting this data on our website and on the portal's pricing and sign-up pages and passing it to Meta, WEfin and Meta are joint controllers; the essence of that arrangement is set out in Meta's Controller Addendum (www.facebook.com/legal/controller_addendum). Meta is solely responsible for what happens after that, and also uses the data for its own purposes, including delivering and measuring ads and improving its advertising systems.

Our systems and most of our service providers are located in the European Economic Area (EEA). Two are located in the United States: Anthropic (AI: answering questions in the portal and translating messages) and Cal.com (booking consultation calls). For both, our data-processing agreement includes the European Commission's standard contractual clauses. If data is transferred outside the EEA in any other case, we make sure appropriate safeguards are in place, such as these standard contractual clauses. Meta may transfer data to the United States, where Meta Platforms, Inc. is certified under the EU–US Data Privacy Framework.

6. How long we keep your data

We keep personal data no longer than necessary for the purposes described above.

• Tax and accounting records: 10 years after the end of the relevant tax year, as required by Portuguese law.
• Account and contract data: for the duration of our relationship and up to the applicable limitation period afterwards.
• Contact-form enquiries: up to 12 months after our last contact, unless you become a client.
• Tax portal credentials: deleted when the engagement ends.
• Marketing cookies: we remember your cookie choice for 6 months and then ask again. Meta's cookies expire after 3 months, or as soon as you withdraw consent. What the pixel and our server report to Meta is kept by Meta under its own privacy policy (www.facebook.com/privacy/policy).

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased, to the extent legal retention obligations allow;
• restrict processing;
• object to processing based on legitimate interests;
• receive your data in a structured, machine-readable format (data portability);
• withdraw consent at any time.

To exercise these rights, e-mail info@wefin.pt. We reply within one month. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).

8. Security and cookies

We protect your data with technical and organisational measures, including encryption of sensitive fields such as tax portal credentials, access controls, encrypted connections (TLS) and regular backups.

The client portal uses strictly necessary cookies to keep you signed in and to protect against misuse; these do not require your consent. Its public pricing and sign-up pages can also use the marketing cookies described below, but only if you accept them.

On wefin.pt and on the pricing and sign-up pages of the client portal we use marketing cookies only if you accept them. You choose once: your choice applies to both. If you accept, we load the Meta Pixel, a tool from Meta Platforms Ireland Ltd. that lets us measure how well our advertising on Facebook and Instagram works and show our ads to people who have visited our website. On the portal's pricing and sign-up pages our server also reports two events directly to Meta, as described under “Which personal data we process”. Until you accept, and if you decline, nothing is loaded from Meta, no marketing cookies are set and our server sends Meta nothing. These are the cookies involved:

• wefin_consent (WEfin, 6 months): remembers whether you accepted or declined marketing cookies, for wefin.pt and portal.wefin.pt alike. Strictly necessary; contains no personal data.
• _fbp (Meta, 3 months): identifies your browser so that Meta can measure visits and advertising results. Only set with your consent.
• _fbc (Meta, 3 months): records that you arrived through one of our ads on Facebook or Instagram. Only set with your consent.

You can change or withdraw your choice at any time through “Cookie settings” at the bottom of every page of wefin.pt and of the portal's pricing and sign-up pages. When you withdraw consent, we stop the pixel, our server stops reporting events to Meta, and we delete Meta's cookies from your browser. How Meta handles personal data is described in its privacy policy at www.facebook.com/privacy/policy.

9. Changes to this policy

We may update this policy from time to time. The most recent version is always available on this page, with the date of the last update at the top. For significant changes we will notify you by e-mail or through the client portal.