Devix
Devix Portugal, Lda. – Privacy Policy
1. Who is responsible for your data
Devix Portugal, Lda. is responsible for the personal data it collects through devixsolutions.com and in its own business relationships. This policy explains what we collect, why, and what rights you have.
Devix Portugal, Lda. ("Devix", "we", "us"), NIF 518796345, Rua Comissão da Iniciativa 2A, floor 7, office 703, 2410-098 Leiria, Portugal. Email: hello@devix.tech. Phone: +351 910 712 732.
For personal data we collect for our own purposes, such as website visitors, enquiries and marketing, Devix is the data controller under the General Data Protection Regulation (GDPR). When we process personal data on behalf of a client while building or maintaining their systems, Devix acts as a processor and the client is the controller (see section 9).
This policy applies to the website and to our marketing, sales and client communication. It does not cover Asignu or other Devix products, which have their own privacy information.
2. What data we collect, why, and on what legal basis
We collect only the data we need for the purposes below. We do not sell personal data.
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| You send a message through the contact form, email or WhatsApp | Name, email address, phone number, company, your message | To answer your question and discuss a possible project | Legitimate interest (art. 6(1)(f)); steps before a contract (art. 6(1)(b)) |
| You book a call through our booking page (TidyCal) | Name, email address, chosen time, any details you add | To schedule and hold the call | Steps before a contract (art. 6(1)(b)) |
| You are a client or contact person at a client | Contact details, role, project communication, invoicing details | To deliver the Services, invoice and manage the relationship | Contract (art. 6(1)(b)); legal obligation (art. 6(1)(c)) for accounting and tax |
| You subscribe to our newsletter or marketing emails | Name, email address, subscription choices, email open and click data | To send news, articles and offers | Consent (art. 6(1)(a)) |
| You visit the website | IP address, device and browser data, pages viewed, time on page, referring site | To keep the website secure and understand how it is used | Consent (art. 6(1)(a)) for analytics cookies; legitimate interest for security |
| You see or click our ads | Cookie and device identifiers, pages visited, actions on the website | To measure and improve advertising | Consent (art. 6(1)(a)) |
| We contact business prospects | Name, work email, company, job title | To introduce our services to relevant companies | Legitimate interest (art. 6(1)(f)), with an easy opt-out |
Where the legal basis is consent, you can withdraw it at any time. Withdrawing does not affect the lawfulness of what we did before. If you do not give us the data we need for a contract or a legal duty, we may not be able to work with you.
3. Cookies, analytics and advertising tracking
We use cookies and similar technologies only after you give consent, except for the strictly necessary ones that make the website work.
- Strictly necessary: These keep the website secure and remember your cookie choice. They do not need consent.
- Analytics: We use Google Analytics, or a similar tool, to see how visitors use the website, such as which pages are read and where visitors come from. This helps us improve the site. It only runs if you accept analytics cookies.
- Advertising and measurement: We use the Meta Pixel and the LinkedIn Insight Tag to measure the results of our ads and to show relevant ads to people who visited our website. These only run if you accept marketing cookies. Meta and LinkedIn may use this data for their own purposes under their own privacy policies.
- Newsletter tracking: Our email marketing tool records whether you open an email and click a link. We use this to see which content is useful.
You can change or withdraw your cookie choice at any time through the cookie settings on the website, and you can also block or delete cookies in your browser settings. If you opt out of advertising cookies, you will still see ads, but they will be less relevant.
4. Who we share data with
We share personal data only with service providers that help us run our business, and only as far as needed. We have agreements with them that require proper protection of the data.
- Website and hosting providers that run and secure devixsolutions.com.
- Analytics and advertising providers: Google (Analytics), Meta (Meta Pixel) and LinkedIn (Insight Tag), when you accept the matching cookies.
- Communication and scheduling tools: the contact form, email, WhatsApp (Meta) and TidyCal for booking calls.
- Email marketing provider that sends our newsletter.
- Accountants, legal and other professional advisers, where needed for our legal and tax duties or to protect our rights.
- Subcontractors and freelancers who work with us on client projects, under confidentiality and data protection obligations.
- Authorities, when the law requires us to disclose data.
If Devix is ever sold or merges with another company, personal data may be passed to the new owner, who must continue to protect it under this policy.
5. Transfers outside the EU/EEA
We prefer providers that store data in the EU/EEA. Some providers, such as Google, Meta and LinkedIn, are based in or use servers in the United States or other countries outside the EU/EEA.
When personal data leaves the EU/EEA, we make sure it is protected by a legal safeguard under the GDPR. This is either an adequacy decision of the European Commission, for example the EU-US Data Privacy Framework for certified companies, or Standard Contractual Clauses. You can ask us for details about the safeguard used.
6. How long we keep data
We keep personal data only as long as we need it for the purpose it was collected for, and as long as the law requires.
| Data | Retention |
|---|---|
| Enquiries and messages that do not lead to a contract | Up to 24 months after the last contact |
| Booking and call data | Up to 24 months after the call |
| Client contracts, project communication and invoices | For the length of the contract, and invoices and accounting records for at least 10 years, as Portuguese tax and company law requires |
| Newsletter subscriptions | Until you unsubscribe, and we then keep a minimal record to honour your opt-out |
| Analytics and advertising cookie data | According to the cookie lifetime and the provider's settings, generally up to 26 months |
| Business prospect data | Up to 24 months after the last contact, or sooner if you object |
After these periods we delete or anonymise the data.
7. Your rights
Under the GDPR you have the following rights over your personal data:
- Access: to know whether we process your data and to get a copy.
- Rectification: to have incorrect or incomplete data corrected.
- Erasure: to have your data deleted, where there is no reason for us to keep it.
- Restriction: to limit how we use your data in certain cases.
- Portability: to receive the data you gave us in a common format, or have it sent to another party, where we process it by consent or contract.
- Objection: to object to processing based on our legitimate interest, and to object at any time to direct marketing.
- Withdrawal of consent: to withdraw consent at any time, for example by unsubscribing or changing your cookie settings.
To use these rights, email hello@devix.tech. We may ask you to prove your identity and we answer within one month, which can be extended by two months for complex requests. Using your rights is free, unless a request is clearly unfounded or excessive.
You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt, or to the authority in the EU country where you live or work.
8. Security
We protect personal data with appropriate technical and organisational measures. These include encrypted connections (HTTPS), access limited to people who need the data, strong authentication on our systems, regular updates and backups, and confidentiality duties for our team and subcontractors.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the authority as the law requires.
9. Client project data and children
Client project data. When we build or maintain a system for a client, we may process personal data for that client, such as their customers' or staff details. In that case Devix acts as a processor and follows the client's instructions, as set out in our Terms and Conditions and a data processing agreement. If your data is in a client's system, please contact that client first to use your rights. We will help them respond.
Children. Our website and Services are meant for businesses and professionals. We do not knowingly collect personal data from children under 16. If you think a child has given us data, contact us and we will delete it.
10. Changes to this policy, contact and complaints
We may update this policy when our services, tools or the law change. The latest version is always on devixsolutions.com, with the date of the last update. If a change is significant, we will tell you in a suitable way, for example by email or a notice on the website.
Questions or requests about your data?
Devix Portugal, Lda. Rua Comissão da Iniciativa 2A, floor 7, office 703 2410-098 Leiria, Portugal NIF 518796345 Email: hello@devix.tech · Phone: +351 910 712 732 · Website: devixsolutions.com
Last updated: 13 October 2026