Privacy Policy

1.1 Controller. The controller of the personal data described in this policy is FIZ PT, Unipessoal Lda (“FIZ PT”, “we” or “us”). FIZ PT’s NIPC (company identification and tax number) is 517696835 and its registered office is at Rua do Cais do Tojo, 24, 2.º, 1200‑082 Lisboa, Portugal.

1.2 Contact. For any question about personal data, including exercising the rights described in section 12, anyone can write to [email protected] or to the address above. Anyone with access to an account in FIZ can also use the FIZ support chat.

1.3 Scope. This policy applies to the fiz.co website, the app.fiz.co web app and the FIZ mobile apps (together, “FIZ”). It also applies to the FIZ blog at blog.fiz.co, the help centre at help.fiz.co, the FIZ API documentation at api.fiz.co, and anyone who contacts us. It further applies to the FIZ AI advisor at af.fiz.co (sections 8.5 and 8.6). It does not apply to third-party websites or services that FIZ links to. Nor does it apply to third-party services that the user chooses to connect to FIZ, which have their own policies. The company directory at diretorio.fiz.co is not covered by this policy, which treats it only as a source of data (section 3.10).

1.4 Relationship with the Terms. This policy supplements the FIZ Terms and Conditions.

2.1 In this policy, the following words have these meanings:

• FIZ PT: the company FIZ PT, Unipessoal Lda, the controller (section 1); also “we” or “us”. The Terms and Conditions call it “FIZ”.
• FIZ: the service, that is, the website, the web app and the mobile apps. The Terms and Conditions call it the “Platform” and also include in it the FIZ AI advisor at af.fiz.co, which this policy covers in sections 8.5 and 8.6.
• Personal data: any information relating to an identified or identifiable natural person, for example a name, NIF, email address or IP address.
• Processing: any operation performed on personal data, such as collecting, storing, consulting, sending or deleting it.
• Controller: the person or organisation that decides why and how the data is processed.
• Processor: a person or organisation that processes data on behalf of the controller and on the controller’s instructions.
• User: a person who uses FIZ, with or without an account, including team members and accountants invited to an account.
• Account holder: the natural person or the company that owns the account. The natural person may be, for example, a self-employed person or someone who uses FIZ only for their IRS declaration. In the Terms and Conditions, the account holder is called the “user”.
• Account: the account holder’s profile in FIZ, with its data and members.
• AT: the Autoridade Tributária e Aduaneira (the Portuguese Tax and Customs Authority), including the Portal das Finanças and e‑Fatura.
• Seg. Social: Segurança Social, the Portuguese social security system, including the Instituto da Segurança Social, I.P. and the social security institutes of the Autonomous Regions of the Azores and Madeira; its online portal, Segurança Social Direta, is referred to here as Seg. Social Direta.
• NIF: the tax identification number (número de identificação fiscal).
• NISS: the social security identification number (número de identificação da segurança social).
• SAF‑T: the standard file, in the format defined by the AT, containing invoicing and accounting data.
• CAE: the code from the Portuguese Classification of Economic Activities (Classificação Portuguesa de Atividades Económicas) that identifies the activity carried on.
• IUC: the vehicle tax (imposto único de circulação) that vehicle owners pay every year.
• EORI: the number that identifies, in the European Union, anyone who imports or exports goods.
• Open banking: the connection, authorised by the user at their bank, that allows an authorised provider to read bank accounts, balances and transactions and send them to FIZ.
• Anonymise: to change data so that it can no longer identify a person, irreversibly. Anonymised data is no longer personal data.
• Credentials: the username, password, confirmation codes and access keys (tokens) that allow someone to sign in to the Portal das Finanças or Seg. Social Direta, or to access their services. The Terms and Conditions call them “access codes”.
• Tax Shield: the liability that FIZ PT accepts for errors that it makes itself in certain declarations filed or confirmed through FIZ. Its rules are set out in section 10 of the Terms and Conditions.
• Consent: a freely given, specific, informed and unambiguous authorisation, which the person giving it can withdraw at any time.
• AI: artificial intelligence, that is, programs that automatically generate answers or extract data.
• GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation.
• EEA: the European Economic Area, that is, the European Union, Iceland, Liechtenstein and Norway.
• FIZ AI assistant: the assistant within the app (“AI Tax Assistant”), which answers using the account data (section 8.1(a)). We also call it the “AI assistant”.
• FIZ AI advisor: the assistant at af.fiz.co, which answers general questions about taxes and contributions, with or without an account (sections 8.5 and 8.6).

3.1 Data the user gives us. When creating an account and using FIZ, the user gives us:

• (a) account data: name, email address and, optionally, a photo. There is no separate FIZ password: sign‑in is with a code sent by email or with an external account (section 3.5);
• (b) data about the business or company: name and trade name, NIF, date of birth (for self-employed people), address, telephone number, website, email address and IBAN. Also the CAE, the IVA regime, the monthly income bracket, the logo and whether it has employees. And, if the user provides them, the certified accountant’s NIF and the email addresses to which FIZ automatically sends the SAF‑T file;
• (c) invoices, receipts, expenses and other documents that the user issues in FIZ, uploads or forwards by email to a FIZ address;
• (d) data for the IRS (personal income tax) declaration: income and expenses, properties and leases, and the NIF of paying entities, landlords and tenants. Also accounts and securities held abroad, and the NISS and IBAN for refunds;
• (e) AT and Seg. Social credentials, if the user wants FIZ to import their data or file declarations (section 6);
• (f) data for paying the subscription: name, email address, postal address and, for MB WAY, mobile phone number. Full card details are entered in the payment provider’s form and FIZ does not store them;
• (g) if the user turns on payment collection from their clients: the company and representative data that the provider of those payments requires and the IBAN for receiving payments. The representative data that this provider requires is the name, date of birth, address and telephone number. We collect this data in a FIZ form and send it to that provider, which may also ask for an identity document for identity verification;
• (h) messages and attachments sent to support, ratings of the replies, and conversations with the AI assistant;
• (i) if the user links the account to a FIZ bot in a messaging app: the chat identifier and the username.

3.2 Data from the AT and e-Fatura. If the user connects FIZ to the Portal das Finanças, we import, on the user’s behalf:

• (a) identification and tax status: name, NIF, date of birth, sex, nationality, tax residence, local tax office, start of activity, CAE, and IVA and IRS regimes. Also non‑habitual resident status, the EORI number, the certified accountant, addresses, IBAN and vehicles registered with the AT;
• (b) declarations and payments: IRS and IVA declarations, declarations of commencement, change and cessation of activity and the related proofs of filing, IUC, the tax current account and AT notices. When AT notices include a fine, we also import from the Portal das Finanças the payments of that fine, to show the user whether it has already been paid. Data about fines may be considered data relating to offences, which the GDPR gives special protection (Article 10). We use it only to show the user their own position with the AT (section 4.2) and to assess requests under the Tax Shield (section 4.14). We do not use it for other purposes. We only disclose it to other parties, apart from our service providers (section 9.2), when required by law or for the defence of legal claims relating to those requests (section 9.4(c) and (d));
• (c) invoices and expenses from e‑Fatura, with the NIF, name and activity of suppliers. Health expenses are only imported with the consent provided for in section 5.3;
• (d) the household registered with the AT: name and NIF of the spouse and dependants;
• (e) pre‑filled data and simulations of the IRS declaration, including income, tax withheld at source and contributions. Trade union dues and the degree of disability are only imported with the consent provided for in section 5.3.

3.3 Data from Seg. Social. If the user connects FIZ to Seg. Social Direta, we import their identification details: NISS, name, date of birth, NIF, contact details, address and IBAN. We also import their contribution status and scheme, contribution rate, exemptions and quarterly declarations, with the related proofs of filing. If the user is an employer, we also import the data of employees registered with Seg. Social: NISS, name, contract type, contract dates and terms, remuneration and contribution rate.

3.4 Bank data. If the user connects a bank account (open banking, through a bank connection provider) or uploads statements, we receive the accounts, balances and transactions. For each transaction, we receive the amount, date, description, category, merchant and the names of the payer or payee. The bank connection depends on an authorisation that the user gives to that provider and confirms at their bank, valid for up to 180 days and renewable. That provider is governed by its own terms and privacy policy, which the user accepts when connecting the bank account.

3.5 Data from services the user connects. If the user signs in with an external account, the provider of that account sends us their name, email address, an indication that the email address is verified, and their profile photo. If the user imports files from a file storage service, we only receive the files they choose. If the user connects an online shop, we receive the orders, including buyers’ data. These services are governed by their own terms and privacy policies, which the user accepts with them.

3.6 Data about the user’s clients, suppliers and employees. The user enters or imports into FIZ data about other people they work with. This data and the user’s documents may include health data where a document reveals it, for example in the invoices that a health professional issues to their clients. We process all this data on behalf of the account holder (section 7). It is data about:

• (a) clients: name, NIF, contact details, address, company, job title and any other fields the user creates;
• (b) suppliers and counterparties to bank transactions: NIF, name, contact details, IBAN and notes;
• (c) buyers from the online shops that the user connects to FIZ (section 3.5);
• (d) employees: name, NISS, date of birth, occupation, contract type, contract dates and terms, remuneration and contribution rate, entered by the user or imported from Seg. Social (section 3.3). If the account holder is an employer, FIZ reports to Seg. Social, after confirmation in FIZ, employees’ remuneration and the start, change and termination of their contracts;
• (e) people who open a document that the user shares by link: their verified email address and browser type, which we record to protect access to the document.

3.7 Data about team members and accountants. When an account holder invites someone, we process that person’s email address, role, permissions, and invitation and joining dates. We also record the actions they take in the account (who, what, when and with what result). To confirm that an accountant is certified, we ask for their professional licence (cédula profissional) number from the Ordem dos Contabilistas Certificados and for answers to a short questionnaire.

3.8 Data about the spouse and dependants. When preparing the IRS declaration, the user may choose to provide information about their spouse and dependants, health expenses and trade union dues. FIZ uses this information to prepare the declaration and calculate deductions and tax benefits.

• (a) what data: for the spouse or de facto partner, the name, NIF, residence, NISS and degree of disability; for dependants, the name, NIF, date of birth and degree of disability;
• (b) spouse’s credentials: the user may provide the spouse’s AT and Seg. Social credentials so that FIZ can handle the spouse’s declarations, such as a joint IRS declaration. The user may provide them only with the spouse’s authorisation and, by providing them, declares that they have it;
• (c) health and trade union membership data: the user decides whether to provide or import such data about the spouse or a dependant (section 5). The user may do so only with that person’s consent or, if the person is a minor or cannot consent, the consent of whoever represents them, and by doing so declares that they have it;
• (d) informing these people: the user must inform them and show them this policy before giving us their data. When we do not have their contact details, or those of the other people whom the IRS declaration must identify (section 4.3(b)), we cannot inform them directly. That is why we keep this policy published on the website, so that they can read it (Article 14(5)(b) GDPR).

3.9 Device, browsing and campaign data. When the user visits the website or uses the apps, our servers receive technical data: IP address, browser and device type, language, pages requested, date and time. If the user agrees on the website, in the web app or on af.fiz.co (section 14), we also collect data to measure campaigns. This data comprises the referring page and link, campaign parameters (for example, utm_source or gclid) and, in the web app, Meta advertising identifiers (_fbp and _fbc). With the same consent and for the same purpose, we also collect device characteristics (screen and pixel density, time zone, language and number of processors).

3.10 Data from public sources. To validate NIF and IVA numbers, confirm CAE codes and complete company data, we consult public sources. Examples are the European Commission’s VIES system, SICAE (Sistema de Informação da Classificação Portuguesa de Atividades Económicas) and the FIZ company directory. This directory gathers published information about companies (NIF, name, CAE, address and contact details). We keep a copy of the data from these sources for the period set out in section 11.1(r).

We carry out these lookups to provide the service (section 4.2). Where they concern the user’s clients or suppliers, we carry them out on behalf of the account holder (section 7). In other cases, the legal basis is our legitimate interest in ensuring that the tax data on invoices and in the account is correct (Article 6(1)(f) GDPR). Where these sources contain data about sole traders (empresários em nome individual), those people can object to its use by FIZ and exercise the other rights in section 12 with us.

3.11 Which data is mandatory. To create an account, the email address, the name and NIF of the account holder (individual or company) and, in some cases, the postal code are required. To issue certified invoices, the law requires certain details of the issuer and, in some cases, of the client (for example, the NIF). AT and Seg. Social credentials are optional, but without them FIZ cannot import data or file declarations on the user’s behalf. All other data is optional; without it, some features may not be available.

4.1 General rule. We only process personal data when we have a legal basis under Article 6 GDPR. For each purpose, we state the legal basis. Some people use FIZ without being party to the contract with FIZ PT, such as a team member or an invited accountant. In those cases, the legal basis is not performance of the contract. It is the legitimate interest of the account holder and of FIZ PT in providing the service through the people the account holder chooses (Article 6(1)(f) GDPR).

4.2 Providing the service. We use data to provide the service the user has signed up for. Legal basis: performance of the contract (Article 6(1)(b) GDPR). For the data of the user’s clients, suppliers and employees, FIZ PT acts as processor (section 7). The service includes:

• (a) creating and managing the account and access to it;
• (b) issuing certified invoices and other documents and reporting them to the AT on the user’s behalf, as required by law;
• (c) importing data from the AT, Seg. Social and the bank, and reading uploaded invoices and receipts;
• (d) organising expenses and accounting and calculating taxes and contributions;
• (e) showing deadlines, forecasts and reminders;
• (f) sending documents and payment reminders to the user’s clients;
• (g) managing the team and permissions.

4.3 Preparing and filing declarations. Preparing declarations (for example, the periodic IVA declaration, the recapitulative declaration, the IRS declaration and the quarterly Seg. Social declaration) and filing them with the AT or Seg. Social. FIZ only files a declaration after it has been confirmed in FIZ by the account holder or by an account member with permission to do so. Where the law requires it, the periodic IVA declaration and the recapitulative declaration are filed with the certified accountant’s credentials, and it is the accountant who confirms them. The law requires this, for example, for companies and for self-employed people with organised accounts (contabilidade organizada). Legal bases:

• (a) for the user’s data: performance of the contract (Article 6(1)(b) GDPR);
• (b) for the data of the spouse and dependants required for the household declaration: legitimate interest (Article 6(1)(f) GDPR). This is the interest of the user and of FIZ PT in preparing that declaration correctly. This data comprises identification details and, in a joint declaration, income, expenses and deductions. The law requires the declaration to include these people. The same legal basis applies to the data of other people whom the IRS declaration must identify, such as paying entities, landlords and tenants;
• (c) for the spouse’s credentials: the spouse’s consent (Article 6(1)(a) GDPR), which the user declares they have when providing them (section 3.8(b)). We use the credentials only to import the spouse’s data and to file the spouse’s own declarations, or joint declarations, confirmed in FIZ. The same consent is the legal basis for processing the spouse’s data in the spouse’s own declarations other than the household declaration, such as the quarterly Seg. Social declaration.

  The spouse may withdraw consent at any time by emailing [email protected] or, if they have access to FIZ, in the FIZ support chat. In that case, we delete their credentials and stop processing the spouse’s data that is based on this consent. We delete that data in FIZ, except the data needed for the household declaration (point (b)) and the data contained in the records referred to in section 11.1(c);

• (d) for the degree of disability, health expenses and trade union dues: see section 5;
• (e) for the certified accountant’s credentials (section 6.1(e)): legitimate interest (Article 6(1)(f) GDPR). This is the interest of the account holder and of FIZ PT in filing the declarations that the accountant confirms. The accountant provides them personally, for that purpose only, and can ask us to delete them (section 6.5).

4.4 Charging for the subscription. Charging for paid plans, issuing our invoices and keeping billing records. Legal basis: performance of the contract and compliance with FIZ PT’s legal obligations, in particular tax and accounting obligations (Article 6(1)(b) and (c) GDPR).

4.5 Receiving payments from the user’s clients. If the user turns on payment collection (for example, payment links, Multibanco references or QR codes on invoices), we send the necessary data to the payment providers that offer that service. One of these providers verifies the representative’s identity to meet its own legal obligations, as controller. These providers are governed by their own terms and privacy policies, which the user accepts when turning on payment collection. Legal basis: performance of the contract. Where the account holder is a company, the legal basis for the data of its representative is legitimate interest (Article 6(1)(f) GDPR). This is the interest of the account holder and of FIZ PT in turning on the payment collection that the account holder requested.

4.6 User support. Replying to support requests by email or chat, including with a first reply drafted by AI (section 8). Also sending support messages about using FIZ, for example about a step not yet completed or a problem with the account. These messages do not promote plans or offers. Communications that do so follow the rules in section 13. Legal basis: performance of the contract; for people who do not yet have an account, legitimate interest in replying to those who contact us.

4.7 AI assistant. Answering the questions the user asks the AI assistant, using the account data needed for the answer (section 8). Legal basis: performance of the contract.

4.8 Security and fixing errors. Protecting accounts and systems, detecting unauthorised access and fraud, recording the relevant actions taken in each account (audit log), keeping technical logs, and detecting and fixing errors. Legal basis: legitimate interest in keeping FIZ secure and working and in being able to show what was done in each account (Article 6(1)(f) GDPR). Security is also a legal obligation of FIZ PT (Article 6(1)(c) and Article 32 GDPR).

4.9 Improving FIZ. Understanding which features are used, in order to improve them. On the server, we record usage events linked to the account (for example, the filing of a declaration). Usage analytics in the browser only run with consent. We also analyse the questions put to the FIZ AI advisor, to identify the most common queries and improve the answers (section 8.6). Legal basis: legitimate interest in improving the product, for events recorded on the server and for questions put to the FIZ AI advisor; consent (Article 6(1)(a) GDPR), for analytics in the browser. Where the questions include health data, the consent referred to in section 8.8(b) also applies.

4.10 Advertising and campaign measurement. Finding out which ads and campaigns bring in new users and making ads more relevant. For this, we use our own measurement and, in the web app, Google (Google Ads and Google Analytics), the Meta Pixel and the Meta Conversions API. Legal basis: consent, given in the “Marketing” category (section 14.4; Article 6(1)(a) GDPR and Article 5 of Law No 41/2004). Without consent, we do not use these technologies or send Meta the data listed below. If the user withdraws consent, from that moment we stop sending Meta and Google the data described in this section.

Through the Conversions API, we send Meta data about sign‑up and about certain steps the user takes. Examples are starting the free trial, issuing their first invoice, connecting the AT or buying a plan. We send:

• (a) the email address converted into a fixed code (SHA‑256 hash). The code does not reveal the email address. However, Meta compares it with the email addresses it knows, in order to link the event to the user’s Facebook or Instagram account, if there is one. This code therefore does not make the user anonymous;
• (b) the _fbp and _fbc identifiers;
• (c) the IP address and the browser type;
• (d) where applicable, the value and currency.

4.11 Emails about FIZ. Sending news, tips and offers about FIZ products and services similar to those the user already uses (section 13). Legal basis: legitimate interest in promoting those products and services (Article 6(1)(f) GDPR). This applies to people who created a FIZ account for themselves or for their company, and stays within the limits of Article 13‑A(3) of Law No 41/2004. For everyone else, including team members and accountants invited to an account, the legal basis is consent (Article 6(1)(a) GDPR).

4.12 Invitations and sign-up. When someone signs up through a FIZ user’s invitation link, including a partner’s personal link once the partner programme is available, we record who invited them. This lets us apply the invitation benefit to the new user and give the reward to the person who invited them, on the terms shown in FIZ. The person who invites sees in their account, for each person who signed up through their invitation, the sign‑up date and the date of each reward. When a reward comes from a payment by the invited person, they also see that person’s email address and the payment date. The person who invites sees no other details about the people they invited.

An invitation link may also accompany a document sent through FIZ. We use the link through which the person arrived and the details they sign up with. The code from the link is stored in the browser even without consent to cookies, so that the person receives the invitation benefit (section 14.2(i)). The code may be the NIF of the person who invites, if they share the link that contains it.

When the person arrives from a document they received, the sign‑up form may be pre‑filled. It contains the name, NIF and email address shown in that document, so that they do not have to type them. This data stays only in that person’s browser and stops being used after 30 minutes. It is deleted at the latest when the tab is closed and only reaches FIZ’s servers if the person completes sign‑up.

Legal basis: performance of the contract, to apply the invitation benefit to the new user (Article 6(1)(b) GDPR); legitimate interest in rewarding those who invite others to FIZ and in making sign‑up easier for people who arrive from a document (Article 6(1)(f) GDPR).

4.13 Verifying accountants. Confirming that anyone using the accountant features is a certified accountant. Legal basis: legitimate interest in protecting clients who give an accountant access to their accounts.

4.14 Legal obligations and defence of legal claims. Complying with legal obligations, responding to requests from authorities and courts, handling complaints and requests under the Tax Shield, and defending FIZ PT’s rights. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR); performance of the contract (Article 6(1)(b) GDPR); legitimate interest in defending FIZ PT’s rights in proceedings and complaints (Article 6(1)(f) GDPR).

4.15 Legitimate interest. Where the basis is legitimate interest, we have weighed that interest against the interests and rights of the people the data relates to. We concluded that their interests and rights do not override it. Those people can object to this processing (section 12) and ask us for information about this balancing test.

4.16 New purposes. If we want to use data for a new purpose, we will only do so if it is compatible with the original purpose or if we have a new legal basis. Before we start, we will inform the people the data relates to.

5.1 What data and why. The degree of disability of the user, the spouse and dependants is health data, which is given special protection under the GDPR (Article 9). It includes the percentage, the reassessment year, the previous degree and whether it results from service in the Armed Forces. Health expenses entered or imported from e‑Fatura for IRS deductions may also reveal information about health. The trade union dues of the user or the spouse are deductible, and the AT shows them in the pre‑filled data of Annex A of the IRS declaration. They reveal trade union membership, which is also given special protection under the GDPR. We use this data only for the following purposes:

• (a) to prepare the IRS declaration and the IRS forecast, because this data qualifies the user for tax deductions and benefits;
• (b) to show health expenses in the user’s list of expenses;
• (c) to answer the questions the user asks the FIZ AI assistant about this data (section 8.1(a));
• (d) to keep it in the records of declarations referred to in section 11.1(c), only for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR).

5.2 Scope of this section. The rules in this section apply to data used to prepare the IRS declaration and IRS forecast. The rules for health data in documents, bank transactions and messages to support or the assistants are in section 8.8.

5.3 Legal requirements. Legal basis: explicit consent (Article 9(2)(a) GDPR). The user decides whether to provide this data or to ask FIZ to import it from the AT or e‑Fatura. Without it, FIZ does not use it in the IRS declaration or the IRS forecast, which may reduce the deductions and tax benefits the user is entitled to. Consent is given:

• (a) by the user, for their own data;
• (b) by the spouse and adult dependants, for their own data;
• (c) by the parents or guardian, for minor dependants;
• (d) by the supporter to whom a court has given powers of representation, for maiores acompanhados (adults for whom a court has appointed a supporter) who cannot consent.

5.4 Withdrawing consent. Consent can be withdrawn at any time, as easily as it was given: in FIZ or by email to [email protected].

When consent is withdrawn, we stop importing and using that data and delete it in FIZ. We keep only the data contained in the records of declarations referred to in section 11.1(c). FIZ stops taking it into account in the calculations and in the declaration it prepares, which may reduce the deductions and tax benefits the user is entitled to. To claim them, the user can file the declaration directly on the Portal das Finanças. Withdrawing consent does not affect what was done before.

6.1 Which credentials we process. To import data, report documents to the AT and file declarations on the user’s behalf, FIZ processes these credentials:

• (a) Portal das Finanças: when the user connects the AT, FIZ may use the main password to create, on the user’s behalf, a sub‑user on the Portal das Finanças. That sub‑user is used for e‑Fatura, for importing data and for reporting to the AT the document series, invoices and other documents issued in FIZ. We store that sub‑user’s username and password. If the user chooses an email address allocated to them by FIZ, that address may be used as the sub‑user’s contact on the Portal das Finanças. The user may give us the main password, for example so that FIZ can create the sub‑user. In that case, we also store that password, because it is needed for IRS and IVA and for viewing the user’s business data on the Portal das Finanças;
• (b) Seg. Social Direta: the NISS, the password and the confirmation codes that Seg. Social sends at each sign‑in. If the user chooses an email address allocated to them by FIZ and the codes reach that address, FIZ reads them automatically, only to complete the sign‑in;
• (c) employers: the employer’s access key (token) for Seg. Social, with its expiry date;
• (d) spouse: the spouse’s AT and Seg. Social credentials, if the user provides them with the spouse’s consent (section 4.3);
• (e) certified accountant: where the law requires it (section 4.3), the periodic IVA declaration and the recapitulative declaration are filed with the accountant’s NIF and password. The accountant provides them for that purpose, and we handle them under the rules in this section.

6.2 How we protect them. We store passwords and access keys encrypted (AES‑256 standard), in the hosting infrastructure described in section 9.2(a). Once stored, passwords are not shown in the app, either to the user or to other account members. They are only decrypted at the moment of signing in to the portal.

6.3 What we use them for. We use credentials only to do what the user has asked and do not disclose them to anyone other than the AT or Seg. Social portal itself. Messages, including confirmation codes, received at a FIZ email address that the user chooses to use are kept in the mailboxes referred to in section 9.2(c) for the period set out in section 11.1(n).

Credentials are used to:

• (a) import the user’s data from the AT and Seg. Social;
• (b) create, where needed, the sub‑user referred to in section 6.1(a);
• (c) report to the AT the document series, invoices and other documents issued in FIZ (section 4.2(b));
• (d) file the declarations and submissions confirmed in FIZ, including, for employers, those relating to their employees (section 3.6(d)).

6.4 Accountants. An accountant with management permission on an account can add the credentials that the client has given them and file declarations. Accountants cannot connect, manage or disconnect the bank accounts linked to the account.

6.5 Disconnecting. The user can disconnect the AT or Seg. Social at any time in the settings. On disconnection, FIZ deletes the credentials stored in FIZ and stops signing in to the portal. For Seg. Social, it also deletes the imported profile data and notices and the history of declarations of commencement, change and cessation of activity. An employer can also disconnect its Seg. Social access key (section 6.1(c)). In that case, FIZ deletes that key and the employee and contract data it stores.

Other documents and data already imported, such as invoices, expenses and the history of declarations filed through FIZ, remain in the account for as long as it exists (section 11). Declarations already filed with the AT or Seg. Social stay there, unchanged. The user can manage or remove the sub‑user created on the Portal das Finanças on the portal itself.

The spouse and the accountant can also ask us at any time to delete their credentials. They can do so by emailing [email protected] or, if they have access to FIZ, in the FIZ support chat. We then stop using them and delete them in FIZ. We do the same with the accountant’s credentials when the accountant no longer has access to the account.

7.1 Who decides. When the user stores data about clients, suppliers, employees, buyers or other people in FIZ, they do so in order to issue documents, meet tax and Seg. Social obligations or run their business. In those cases, the account holder is the controller of that data and FIZ PT is the processor (Article 28 GDPR). The data of the spouse, dependants and other people identified in the user’s IRS declaration is not covered here: we process it as controller (section 4.3).

7.2 Conditions. The conditions under which we process this data are set out in section 8.6 of the Terms and Conditions and form part of the contract with the account holder. They cover instructions, confidentiality, security, other processors, help with exercising rights, data breaches, return and deletion, and audits. The other processors we use are the providers in the categories listed in section 9.2. Before adding or replacing a processor that processes this data, we notify the account holder by email at least 30 days in advance. The account holder may object on reasonable grounds, as provided for in the Terms and Conditions.

7.3 The account holder’s duties. The account holder is responsible for having a legal basis to process this data and for informing the people it relates to. If one of those people contacts us to exercise their rights, we forward the request to the account holder and help them respond.

7.4 FIZ PT’s own purposes. FIZ PT does not use this data for its own purposes, except in the following cases, in which it acts as controller:

• (a) where required by law;
• (b) to protect the security of FIZ and its users (section 4.8);
• (c) to keep records of declarations filed or confirmed through FIZ, which may include data about clients, suppliers or employees, under section 11.1(c);
• (d) when a client of the user creates a FIZ account from a document they received. In that case, we process the link through which they arrived and, to pre‑fill their sign‑up form, the name, NIF and email address shown in that document (section 4.12);
• (e) to assess requests under the Tax Shield and to establish, exercise or defend FIZ PT’s rights in complaints, disputes or proceedings, to the extent necessary (sections 4.14 and 11.2).

8.1 Where we use AI. We use AI from external providers in these functions:

• (a) AI assistant: receives the user’s question, the conversation history and attachments, the information the assistant has stored from earlier conversations and the account data the user asks it to analyse, for example an invoice or the expenses of a period. The data referred to in section 5.1 are sent only with the consent provided for in section 5.3, given by the person concerned or by their representative.

  Some questions may be answered by the FIZ AI advisor (af.fiz.co), which receives only the question and the conversation identifier (sections 8.5 and 8.6). The FIZ AI assistant may store information taken from conversations in order to give better answers in later conversations (section 11.1(a));

• (b) support: messages sent to support may receive a first reply drafted by AI. Some support messages that we send on our own initiative are drafted in the same way;
• (c) invoice and receipt classification: for uploaded invoices and receipts, the AI receives only the names of the products and services, to classify them. If the user asks the AI assistant to analyse their expenses or income, the data needed for that analysis are also sent (point (a)).

8.2 AI results. AI can make mistakes, so its results are only suggestions and the decision is always the user’s.

8.3 Automated decisions. FIZ does not make decisions based solely on automated processing that produce legal effects concerning the user or other people. Nor does it make such decisions that similarly significantly affect them (Article 22 GDPR). Tax and contribution calculations and FIZ’s suggestions are confirmed in FIZ before anything is filed.

8.4 Third-party AI assistants. The user can connect FIZ to a third-party AI assistant or a partner app. That service only accesses the data the user authorises and is governed by its own terms and privacy policy, which the user accepts when connecting it. The user can revoke access at any time in the settings.

8.5 FIZ AI advisor (af.fiz.co). The FIZ AI advisor answers questions about taxes and contributions in Portugal. It can be used within FIZ (section 8.1(a)) and directly at af.fiz.co, even by people without an account. It can also be used through an assistant access key issued by FIZ PT, for example to connect it to another AI assistant. When it is used at af.fiz.co or with an assistant access key, we process:

• (a) the questions, the answers, the conversation titles, and any ratings and comments the person leaves on the answers;
• (b) a random identifier, stored in a cookie and in the browser’s local storage, so that the person can return to their conversations (section 14.2(h));
• (c) a code derived from the IP address, to limit the number of questions per hour, per day and per month and protect the service against abuse;
• (d) the technical logs of requests, which may include the IP address, the browser type and the beginning of the question;
• (e) the email address, if the person signed in with it in an earlier version of the assistant;
• (f) the campaign parameters of the referring link, if the person accepts the “Marketing” category (section 14.4(c));
• (g) if the person uses an assistant access key: the identifier associated with the key and the number of questions asked each month. The identifier may be, for example, an email address or a telephone number. If the connected app sends an identifier for its own user, we also store it with the conversation.

8.6 How the FIZ AI advisor works. Questions and comments are sent to AI providers, to prepare the answer and to classify the comments. One of these providers also receives the questions to check them for abuse of the assistant. On af.fiz.co, answers about IVA or Seg. Social may end with a paragraph about FIZ services. We choose it only by the topic of the question, without creating profiles.

The providers that host the assistant and its PDF answers are listed in section 9.2(a). We ask people who use the assistant not to include in their questions any data that identifies them, such as their name, NIF, IBAN or telephone number. Before the first question, the assistant asks the person for explicit consent to process any data about their own health that they choose to include, such as their degree of disability (section 8.8(b)).

We keep conversations in order to continue answering and to analyse the most common questions and the quality of the answers (section 4.9). We do not use them to train AI models. The person can delete in the assistant itself each conversation that still appears in their list, that is, up to 30 days after the last message. The retention periods are set out in section 11.1(p). Legal bases (Article 6(1) GDPR):

• (a) answering questions at af.fiz.co or with an assistant access key: legitimate interest in providing the service the person requests (point (f));
• (b) answering questions within FIZ: performance of the contract (point (b) and section 4.7);
• (c) limiting requests, detecting abuse and analysing questions: legitimate interest in protecting and improving the service (point (f));
• (d) storing campaign parameters: consent (point (a));

8.7 Model training. FIZ does not use users’ data, including documents, bank transactions and conversations, to train AI models.

8.8 Health data outside IRS preparation. The documents the user uploads and bank transactions may mention health data. The same applies to messages written to support, to the AI assistant or to the FIZ AI advisor (section 8.5). For example, they may refer to a health expense, a degree of disability or the name of a pharmacy or clinic. In those cases, the following rules apply:

• (a) limited use: we process them only to read, store, organise and reply to them at the request of whoever sent them. We do not use them to draw conclusions about anyone’s health, not even when we analyse the questions put to the FIZ AI advisor (section 4.9). The internal alerts referred to in section 9.2(g) may include an excerpt of those messages. We keep those alerts for up to 12 months (section 11.1(i));
• (b) messages to the assistants: a person may include data about their own health in a message to the AI assistant or the FIZ AI advisor. The legal basis is then that person’s explicit consent (Article 9(2)(a) GDPR). This consent covers replying to the messages and storing the conversation and the information the AI assistant takes from it (section 8.1(a)). It also covers analysing the questions put to the FIZ AI advisor (section 4.9). Each assistant asks for it before the first message, in a separate statement with no pre‑ticked box. Anyone who does not give consent can still use the assistants, without including health data in their messages;
• (c) assistant access keys: the rules for processing data when an access key is used are in sections 8.5 and 8.6;
• (d) withdrawing consent: the person can withdraw it at any time, as easily as they gave it: in the assistant itself or by email to [email protected]. In that case, we stop processing that data and delete the conversations that contain it and any information the AI assistant has stored from them (section 8.1(a));
• (e) health expenses in the IRS declaration: we only classify a document or a transaction as a health expense with the explicit consent provided for in section 5.3. The same applies to using it in the IRS declaration or the IRS forecast. With that consent, the rules in sections 5.1 and 5.4 also apply;
• (f) other people’s health data: the consent in point (b) covers only the health data of the person writing. We ask that other people’s health data not be included in messages to the assistants. In the FIZ AI assistant, the data of the spouse or a dependant referred to in section 5.1 may be included if the consent provided for in section 5.3 has been given.

9.1 General rule. We do not sell personal data. We share data only with the entities and categories of entities listed in this section, and only to the extent necessary.

9.2 Service providers working for FIZ PT. Service providers in the following categories process data on behalf of FIZ PT, on our instructions and under contracts that require them to protect the data (Article 28 GDPR). The categories are:

• (a) hosting and database: hosting and database providers; the main database and the application servers are in the European Union. These providers also host the FIZ AI advisor (af.fiz.co), its database and the answers it prepares as PDFs;
• (b) network and protection: a content delivery and network security provider, which delivers the website and the app and protects them against attacks;
• (c) email and notifications: an email sending provider, which sends emails, including sign‑in codes, documents and reminders to the user’s clients, and marketing emails. A mailbox provider, for the support mailbox and the mailboxes that receive forwarded documents. It is also used for the FIZ email addresses that users choose to use to receive messages and codes from the AT and Seg. Social (section 6.1(a) and (b)). A notification provider, for push notifications;
• (d) subscription payments: payment providers, for payments by card, SEPA Direct Debit and MB WAY. They also process some data as controllers, to meet their own legal obligations (for example, fraud prevention);
• (e) artificial intelligence: AI providers;
• (f) usage and error analytics: a usage analytics tool receives the usage events recorded on the server (section 4.9). It also receives usage analytics in the web app, but only if the user accepts the “Analytics” category (section 14.3). An error detection tool receives the technical data about errors (section 14.3). Google Analytics is used only in the web app and only if the user accepts the “Marketing” category (section 14.4);
• (g) internal tools: an internal notification tool, for team alerts. Alerts may include the account name, part of the email address, the subject and an excerpt of a support message. For the FIZ AI advisor, they may include the person’s identifier (or the beginning of the email address referred to in section 8.5(e)) and the technical description of the error.

9.3 Organisations that decide how to use the data they receive. These organisations process data as controllers, under their own policies:

• (a) payment providers, when the user receives payments from their clients, including for identity verification;
• (b) the bank connection provider and the banks, for the bank connection authorised by the user. So that this provider can create the user’s account and carry out its identity checks, we send it the full name and email address from the user’s FIZ profile;
• (c) Meta Platforms Ireland, for advertising and campaign measurement in the web app, with consent. For the collection and transmission of data through the Meta Pixel and the Conversions API, FIZ PT and Meta are joint controllers (Article 26 GDPR). This means that they decide together on that processing. FIZ PT is responsible for obtaining consent and informing the user, and Meta is responsible for the processing it carries out after receiving the data. The essence of the arrangement between FIZ PT and Meta is published by Meta at facebook.com/legal/controller_addendum, and the user can exercise their rights with FIZ PT or with Meta;
• (d) Google, for Google Ads in the web app, with consent. For the collection and transmission of data to Google Ads through the Google tag, FIZ PT is responsible for obtaining consent and informing the user. Google is responsible for the processing it carries out after receiving the data, under its own terms. In Google Analytics, Google processes the data on behalf of FIZ PT (section 9.2(f));
• (e) the NIF, IVA and CAE lookup services (for example, VIES and SICAE);
• (f) the services the user chooses to connect to FIZ: the external account the user signs in with, file storage services, the online shop, messaging apps, third-party AI assistants and partner apps. These services are governed by their own terms and privacy policies, which the user accepts with them.

9.4 Other recipients. We also share data with:

• (a) the AT and Seg. Social, when FIZ reports invoices or files declarations on the user’s behalf;
• (b) the people the user chooses: the accountant and team members the user invites, and the clients the user sends documents to;
• (c) courts, the Public Prosecutor’s Office (Ministério Público), criminal police bodies, the CNPD and other authorities, where required by law;
• (d) FIZ PT’s legal advisers, auditors and accountants, who are bound by a duty of confidentiality;
• (e) in the event of a sale, merger or reorganisation of FIZ PT: potential buyers, under a duty of confidentiality, and the buyer or new entity. The buyer or new entity becomes the controller. We notify the user before that change.

9.5 The FIZ team. Within FIZ PT, only the people who need it, for support, security or running the service, have access to an account’s data. They are bound by a duty of confidentiality and process the data only on FIZ PT’s instructions (Articles 29 and 32(4) GDPR).

10.1 Where the data is kept. The main database and the application servers are in the European Union.

10.2 Safeguards. We process data in accordance with the GDPR. If a service provider processes personal data outside the EEA, we require one of the GDPR safeguards listed below. Anyone can ask us for a copy of those safeguards by emailing [email protected].

The services that the user chooses to connect to FIZ (section 9.3(f)) receive data on the user’s instructions. Their own terms govern how they process the data after receiving it, including any onward transfers outside the EEA. When these services receive data about the user’s clients, suppliers or employees (section 7), we follow the account holder’s instructions (Article 28(3)(a) GDPR).

For transfers of personal data outside the EEA that FIZ carries out on its own initiative, we comply with the requirements of Chapter V GDPR. These transfers are covered by one of the following safeguards (Articles 45 and 46 GDPR):

• (a) an adequacy decision of the European Commission: the Commission has decided that the country, or the certification scheme the company has joined, protects data as the EU does;
• (b) standard contractual clauses approved by the Commission: model contracts that require the recipient to protect the data as it would be protected in the EU, with supplementary measures where necessary.

11.1 Retention periods. We keep data only for as long as necessary for each purpose or for as long as the law requires:

• (a) account data: for as long as the account exists, except for the conversations in point (p). This means the profile, documents, declarations, imported data, audit log, and support and AI conversations. It also includes the information the AI assistant stores from those conversations. An account with no sign‑in and no active paid subscription for 24 consecutive months may be deleted after two warnings (section 4.7 of the Terms and Conditions);
• (b) after the account is deleted or the contract ends: if the account holder deletes the account, we delete or anonymise the data within 30 days. The contract may end for another reason, for example if we delete the account for inactivity (section 4.7 of the Terms and Conditions), by decision of FIZ PT, because the service is discontinued or because the user moves to another provider. In that case, the data remains available for export for 30 days (section 4.5 of the Terms and Conditions). The account holder may ask us in writing, before that period ends, for more time to export the data. If they do, we extend the period to the date the account holder specifies and confirm that date in writing. When the period, or the extended period, ends, we delete or anonymise the data within the following 30 days. In both cases, the exceptions in the following points apply. We also ask the service providers that process data on our behalf to delete it, within the periods set in their contracts.

  Important: the law requires anyone who issues invoices to keep them, together with their other tax records, as a rule for 10 years. This is required, for example, by Article 52 of the Código do IVA (IVA Code) and Article 123 of the Código do IRC (Corporate Income Tax Code). That is why, before the account is deleted, FIZ offers to export the SAF‑T file, and the account holder can also export any invoices and documents they need;

• (c) records of declarations filed or confirmed through FIZ: up to 2 years after filing, even if the account is deleted. If a Tax Shield request is made within that period, we keep them until the request is settled. They include the account holder’s identification details and email address, the confirmed data, who confirmed it and when and, where it exists, the proof of filing. They do not include the credentials. If FIZ has not filed a confirmed declaration, the period runs from the confirmation.

  If we have notified the account holder of an error in a declaration, under section 10.10 of the Terms and Conditions, we also keep that notice. We then keep the records of that declaration and the notice for as long as the AT or Seg. Social can impose a fine for that error. We keep them to honour the Tax Shield and to defend legal claims. We use the email address stored in these records only for the communications provided for in section 10 of the Terms and Conditions, even after the account is deleted. Where these records include health or trade union data (section 5), we keep them only for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR);

• (d) FIZ subscription invoices and payment records: 10 years, under FIZ PT’s tax and accounting obligations;
• (e) credentials: until the user disconnects the AT or Seg. Social or deletes the account; the spouse’s and the accountant’s credentials, also until they ask us to delete them (section 6.5). The accountant’s credentials are also deleted when the accountant no longer has access to the account. Declarations already filed with the AT or Seg. Social stay there, unchanged;
• (f) bank transactions: for as long as the account exists. When a bank connection is disconnected, we delete the transactions imported through it. A connection with transactions from an accounting period that has already been closed cannot be disconnected in FIZ; in that case, the user can request this in the FIZ support chat or by email to [email protected]. Transactions uploaded from statements remain in the account for as long as it exists, even if the statement file is deleted;
• (g) sign‑in codes sent by email: 10 minutes. The session ends after 30 days without use;
• (h) campaign measurement data and data on email delivery and clicks on links in emails: up to 12 months after collection. Campaign parameters stored with a FIZ AI advisor conversation are deleted together with that conversation (point (p));
• (i) technical and error logs, including the internal alerts referred to in section 9.2(g): up to 12 months;
• (j) usage analytics data: up to 12 months after collection;
• (k) support requests from people without an account: up to 2 years after the last contact;
• (l) opt‑outs from marketing emails: we keep the email address of anyone who has opted out for as long as necessary to respect that choice;
• (m) backups: deleted data disappears from backups in the normal rotation cycle, which does not exceed 12 months. Until then, backups remain protected and are used only to restore the system;
• (n) messages and codes received at a FIZ email address that the user chooses to use with the AT or Seg. Social (section 6.1(a) and (b)): up to 12 months after receipt. They are used to complete sign‑in to the portal or to manage the connection. Confirmation codes are valid only until their first use;
• (o) cookies and similar technologies: see section 14;
• (p) conversations with the FIZ AI advisor (sections 8.5 and 8.6): up to 12 months after the last message. This applies to conversations at af.fiz.co, from FIZ or with an assistant access key. Conversations held from FIZ are linked to the account only by a conversation identifier, which we delete with the account. From then on, they are no longer linked to the account. Because the text of a question may still identify someone, we continue to treat them as personal data until they are deleted within the period in this point. The period also covers comments and the copies of answers stored by service providers.

  Anyone using af.fiz.co can delete each conversation sooner: in the assistant itself, up to 30 days after the last message, and after that on request (section 12.3(c)). Request logs are deleted 12 months after each request. The code derived from the IP address and the email address referred to in section 8.5(e) are deleted after 12 months without use. The identifier associated with an assistant access key is deleted 12 months after the key stops being active;

• (q) accountant verification data and access data of invited members: for as long as the person has access to any account. For accountants, this is the professional licence (cédula profissional) number and the questionnaire answers; for invited members, it is the name, email address and photo. We delete this data within 30 days after their last access ends, unless the person also has their own account. The identification of whoever confirmed a declaration remains in the records referred to in point (c), for the period stated there;
• (r) company data obtained from public sources (section 3.10): the data the user saves in client and supplier records follows point (a). The copy we keep to validate and complete that data is updated with each new lookup and deleted 12 months after the last lookup;
• (s) consent records: who gave or withdrew each consent, for what and when. We keep them while the consent is in force and for up to 5 years after it is withdrawn or the account is deleted. They are used only to demonstrate that the processing was lawful (Article 7(1) GDPR). The cookie choice stored in the browser follows section 14.2(e).

11.2 Exceptions. If there is a dispute, a request under the Tax Shield, an investigation or a request from an authority, we may keep the necessary data until it has been concluded.

12.1 Rights. The following rights belong to the user and to any other person whose data FIZ PT processes as controller. Examples are the spouse, dependants, team members or website visitors. Under Articles 15 to 22 GDPR, these people have the right to:

• (a) access: find out whether we process their data and receive a copy;
• (b) rectification: have inaccurate or incomplete data corrected. If the error is FIZ’s, we correct it. If the error is in the AT or Seg. Social data, the person can ask us to correct or flag it in FIZ; for the correction to remain in later imports, it must also be made with the AT or Seg. Social;
• (c) erasure: ask us to delete their data, except where the law requires us to keep it or it is needed for the defence of legal claims;
• (d) restriction: in certain cases, ask us to store the data without using it for anything else. For example, while its accuracy is being checked or while it is being determined whether their objection is justified, or where the processing is unlawful but the person prefers that we do not delete the data. Also where we no longer need the data but the person needs it for legal proceedings;
• (e) portability: receive the data they have given us in a structured, commonly used and machine-readable format, or ask us to send it to another organisation, where technically feasible. Wherever possible, we use an open format (Article 18(2) of Law No 58/2019). This right covers the data we process by automated means on the basis of consent or the contract. The export provided for in section 4.5 of the Terms and Conditions covers even more data;
• (f) objection: see section 12.2;
• (g) withdraw consent at any time, without affecting processing carried out before;
• (h) not be subject to decisions based solely on automated processing with legal or similarly significant effects (section 8).

12.2 Right to object. Any of the people referred to in section 12.1 may object at any time, on grounds relating to their particular situation, to processing based on legitimate interest. In that case, we stop that processing unless there are compelling legitimate grounds for it that override their interests, rights and freedoms, or the processing is necessary for the defence of legal claims. They may also object at any time, without giving reasons, to the use of their data for direct marketing, including profiling related to such marketing.

12.3 How to exercise them. These rights can be exercised as follows:

• (a) in FIZ itself: the user can correct profile, client and counterparty data. They can export invoices (SAF‑T and CSV) and documents, and disconnect the AT, Seg. Social and the bank. They can also revoke access for apps and third-party AI assistants (section 8.4) and opt out of marketing emails, in the account settings or through the link in each email. If they are the account holder, they can delete the account in the settings;
• (b) by chat or email: for anything else, anyone with access to an account in FIZ can write in the FIZ support chat. Anyone can write to [email protected], preferably from the email address linked to the account, if there is one. This includes asking for a full copy of the data or for the account of an invited member to be deleted;
• (c) at af.fiz.co, without an account: anyone who uses the assistant without an account can delete their conversations in the assistant itself, up to 30 days after the last message in each one. For other requests about those conversations, they should give us details that allow us to find them, such as the date and the beginning of the question. We need these details because we do not know who the conversations belong to (Article 11 GDPR). Before showing or handing over a conversation, we may ask for other details that confirm it is theirs (section 12.4).

12.4 Time limits and costs. We reply without undue delay and in any event within one month of receiving the request. That period may be extended by two further months if the request is complex or there are many requests; in that case, we inform the person who made the request within the first month and explain why.

Exercising these rights is free of charge. If a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee, taking into account the administrative costs, or refuse the request. If we do not act on a request, we explain why within one month and tell the person that they can lodge a complaint with the CNPD or seek a judicial remedy (section 17). If we have reasonable doubts about the identity of the person making the request, we may ask for additional information to confirm it.

12.5 The user’s clients and suppliers. People whose data the user stores in FIZ (clients, suppliers, employees) should address requests about that data to the account holder, who is the controller. If they contact us, we forward the request (section 7). In the cases in section 7.4, where FIZ PT is the controller, they can exercise their rights directly with us.

13.1 Service emails. We always send the emails needed for the service, for example sign‑in codes, documents, subscription invoices and important changes. The user cannot opt out of them while the account exists. Deadline reminders, tips and news can be turned off in the account settings or through the link at the end of each of those emails.

13.2 Marketing emails. To people who created a FIZ account for themselves or for their company, we send news and offers about FIZ products and services similar to those they use. We only send marketing communications to other people, including team members and accountants invited to an account, with their prior consent. The user can opt out of these emails, easily and free of charge:

• (a) in the account settings;
• (b) in each email, through the unsubscribe link.

13.3 Email status. The email sending provider (section 9.2(c)) tells us whether emails sent through FIZ were delivered and which links were clicked. We use this information to show the status of those emails, including the documents and reminders the user sends to their clients, and to know whether our notices arrive. Legal basis: for the emails the user sends to their clients, FIZ PT acts as a processor on the account holder’s instructions (section 7); for FIZ PT’s own emails, legitimate interest in knowing whether communications arrive (Article 6(1)(f) GDPR). Retention periods are in section 11.1(h).

14.1 What they are. Cookies are small files that a website stores in the browser. Similar technologies include browser storage (localStorage and sessionStorage), pixels and device identifiers in mobile apps. Under Article 5 of Law No 41/2004, the only technologies we use without consent are those strictly necessary to provide the service the user requests.

14.2 Necessary. These always run, without consent:

• (a) on the website, fiz‑lang (local storage): stores the chosen language until the user changes it or clears the browser data;
• (b) in the web app, __Host‑fz‑session: keeps the user securely signed in, for up to 400 days; the session ends earlier if it is not used for 30 days;
• (c) in the web app, __Host‑fz‑signed‑in: indicates that a session is active, for up to 400 days;
• (d) in the app, browser storage (localStorage and sessionStorage) holding the active account, language, country and display preferences. In the mobile apps and integrations, it also holds the session identifier. It further holds temporary sign‑up data, for example the chosen plan or the data that pre‑fills the sign‑up form for people arriving from a document they received (section 4.12);
• (e) the record of the user’s cookie choice (on the website, fiz‑consent, in local storage), which is valid for 12 months;
• (f) in the mobile apps, the identifier for push notifications, if the user allows them on the device;
• (g) when the app shows the card payment form, the cookies the payment provider uses to prevent fraud (for example, one lasting up to 1 year and another lasting 30 minutes). This also includes the security cookies the network and protection provider (section 9.2(b)) may use to protect the website and the app against automated attacks;
• (h) on af.fiz.co: anon_id (cookie, up to 1 year) and fiz_user_id (local storage), holding the random identifier that lets the person return to their conversations. Also fiz‑ai‑ui‑language (local storage), holding the chosen language (section 8.5);
• (i) the invitation code (?ref=) in the link the user followed. It lets the user receive the invitation benefit (section 4.12). The website only keeps codes in the format of a FIZ invitation. It adds the code to the sign‑up and sign‑in links to app.fiz.co and keeps it for the duration of the visit in fiz:ref:v1 (sessionStorage), which is deleted when the tab is closed. The pages of the previous website stored the same code in fiz_ref (local storage, valid for 90 days and deleted on the next visit after that), which the website uses when the current visit has no code. In the app, the code is stored in the browser until sign‑up is complete.

14.3 Analytics. These only run if the user accepts the “Analytics” category: usage analytics in the web app, so that we can understand how features are used. The usage analytics tool stores an identifier in the browser (in a cookie and in local storage, for up to 12 months) and links events to the account.

Error detection is not part of this category and always runs. It stores nothing in the browser. It sends only the technical data about the error, with the account identifier and email address, so that we can fix faults (section 4.8). Google Analytics belongs to the “Marketing” category (section 14.4). Rejecting the “Analytics” category does not stop the server-side recording of account-linked usage events described in section 4.9, to which the user can object (section 12.2).

14.4 Marketing. On the FIZ blog (blog.fiz.co), the measurement technologies are those set out in the blog’s own cookie notice. On the other websites and apps to which this policy applies (section 1.3), these run only if the user accepts the “Marketing” category:

• (a) in the web app, the Google tag (Google Ads and Google Analytics), with cookies such as _ga (up to 12 months) and _gcl_au (90 days), to measure visits and ad conversions;
• (b) in the web app, the Meta Pixel, with the _fbp and _fbc cookies (90 days), to measure ads on Facebook and Instagram. With the same consent, we send Meta, through the Conversions API, the data listed in section 4.10;
• (c) our own campaign measurement: on the website, fiz:attribution:v1 (sessionStorage) stores the campaign parameters of the referring link for the duration of the visit, for example utm_source or gclid. It is deleted when the tab is closed. These parameters are passed on in the link when the user opens the web app or the FIZ AI advisor at af.fiz.co. On af.fiz.co, fiz‑ai‑attribution (sessionStorage) does the same, and the parameters are stored with the first message of the conversation (section 8.5). In the web app, we also store the source of the visit and device characteristics (section 3.9).

14.5 How to manage them. On the first visit, we ask the user to choose: accept, reject or choose by category. Rejecting is as easy as accepting. The user can change their choice at any time with the “Cookie settings” button in the footer of the website, the app and af.fiz.co. They can also delete cookies in the browser settings. The choice is valid for 12 months. After that period, or if we change the categories, we ask again. The website, the web app and af.fiz.co each store their own choice. A choice made on one of them does not apply to the others. The categories are:

• (a) in the web app: “Necessary”, “Analytics” and “Marketing”; in the mobile apps there is no choice to make, because they use no third-party analytics or marketing technologies (section 14.6);
• (b) on the website: only “Necessary” and “Marketing”. The website does not use analytics tools, and there the “Marketing” category covers only our own campaign measurement (section 14.4(c));
• (c) on af.fiz.co: the same two categories as the website, in a separate notice;
• (d) on help.fiz.co and api.fiz.co: only “Necessary”. These sites do not use analytics or marketing tools, so they do not ask for a choice;
• (e) on blog.fiz.co: the categories set out in the blog’s own cookie notice (section 14.4).

14.6 Mobile apps. In the mobile apps, we use no third-party analytics or marketing tools. The necessary technologies in section 14.2 always work.

15.1 Measures. We protect data with technical and organisational measures appropriate to the risk (Article 32 GDPR), including:

• (a) encrypted connections (HTTPS);
• (b) AT and Seg. Social credentials stored encrypted (section 6);
• (c) data stored encrypted by the hosting providers;
• (d) permission-based access to accounts and logging of relevant actions;
• (e) restricted access for the FIZ team, subject to a duty of confidentiality.

15.2 Data breaches. If a personal data breach occurs, we notify the CNPD where the law requires it (Article 33 GDPR). We do so without undue delay and, where feasible, within 72 hours of becoming aware of it. If there is a high risk to the rights of the people affected, we inform them without undue delay (Article 34 GDPR).

15.3 The user’s role. Account security also depends on the email account or external account that the user signs in to FIZ with. In the settings, whoever manages the account chooses each team member’s permissions and can remove access at any time.

16.1 A person must be 18 or over to create a FIZ account. We may process data about minors when the user enters it in FIZ, mainly data about dependants for the IRS declaration, provided by their parents or legal representative. If we learn that a minor has created an account, we close it and delete the data, in accordance with section 11. Before that, we give the legal representative the opportunity to export the documents that the law requires to be kept. The FIZ AI advisor at af.fiz.co can be used without an account, but it is also intended only for people aged 18 or over. If we learn that a conversation was held by a minor, we delete it.

17.1 Anyone who believes that we process their data in breach of the law can lodge a complaint at any time with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, Av. D. Carlos I, 134, 1.º, 1200‑651 Lisboa, www.cnpd.pt, or with the supervisory authority of the EEA State where they live or work or where the alleged infringement took place. They can also go to court.

17.2 We would be grateful if you contacted us first, through the FIZ support chat or by email to [email protected], so that we can try to resolve the matter.

18.1 We may change this policy, for example when FIZ, our service providers or the law change. The date of the current version is shown at the top of the page. This version applies from 5 October 2026 and replaces the policy of 18 September 2024. Everyone who already had an account receives a summary of the main changes by email. For those who already had an account, the new purposes in this version for the data the account holder keeps in FIZ apply only from the date stated in that email. That date is the one provided for in section 1.3(b) of the Terms and Conditions, at least 30 days after that email is sent.

18.2 If a future change is significant, we notify the user by email or in the app before it takes effect. A change may extend the purposes for which we process the data that the account holder keeps in FIZ. In that case, it applies to the account holder only with 30 days’ prior notice and the rights in sections 1.4 and 8.1 of the Terms and Conditions. Where the law requires, we ask for consent again. Previous versions can be requested through the FIZ support chat or from [email protected].

18.3 Any change in the service providers that process data about the user’s clients, suppliers or employees is also subject to the 30‑day prior notice provided for in section 7.2.

18.4 This policy is available in several languages. In the event of any discrepancy, the Portuguese version prevails, unless the version in the language in which the person read it is more favourable to them.