Privacy Policy

• [POR PREENCHER — nome legal completo] (Quem fecha?)
• Address: [POR PREENCHER — morada completa, incluindo código postal]
• Tax number: [POR PREENCHER — NIF]
• Data protection contact: privacidade@quemfecha.com

We have not appointed a data protection officer, as the conditions in article 37 GDPR are not met. The address above reaches whoever handles these matters.

When somebody creates and uses a manager account, we process:

• name and email address, to identify the account and to contact you;
• the password, stored only as a cryptographic hash from which it cannot be recovered;
• the venue name and the billing details needed to issue an invoice;
• technical usage and error logs, needed to keep the service secure and working;
• a record of who did what inside the account, on plans that include it.

Lawful bases:

• performance of the contract, article 6(1)(b), for everything needed to provide the service subscribed to;
• legal obligation, 6(1)(c), for invoicing and tax retention;
• legitimate interests, 6(1)(f), for security, abuse prevention and support — weighed against your rights and limited to what is necessary.

We do not do behavioural advertising, do not sell data, and do not use it to train models.

Somebody who asks for help getting started ("Book 15 minutes") gives us their name, a mobile number and, if they like, the venue’s name, an email and a note, along with how and when they would rather be contacted. We use these only to arrange and give that help, at that person’s own request (article 6(1)(b)), and delete them six months after the request.

The venue enters its staff’s details into the service: name, phone number where they choose to record one, role, contracted hours, shifts, unavailability, any requests the worker themselves submits through their link and, if the venue wants to estimate costs, their rate of pay (hourly or monthly). Pay is visible only to the account’s administrators and never appears on the worker’s link.

That data is processed on the customer’s behalf and on their instructions. We do not use it for any purpose of our own. The obligations we take on in that capacity are in Annex A to the Terms of Service, which is the processing agreement required by article 28 GDPR.

If you work for a venue that uses Quem fecha? and want to exercise your rights or know the basis for processing, your employer is the person to ask. If you write to us we will pass the request on and help where it is ours to help — but we cannot make decisions about data that is not ours.

Each worker gets an address of their own containing a random code, showing only that person’s published shifts. There is no account, no password, and nothing additional is collected from whoever opens it.

Anyone holding the address sees that content, so it should be treated as confidential. The employer can invalidate it at any time by deactivating and reactivating the worker, which issues a new code.

We use the providers below, all bound by a processing agreement and none authorised to use the data for their own purposes:

• Supabase — Database, authentication and storage of account and staff data. European Union — [CONFIRM the project region in the Supabase dashboard]
• Cloudflare — Application hosting and execution, content delivery and attack protection. Global network. Code runs at the point of presence nearest the request, so data may be processed momentarily outside the EU. Nothing is stored there.
• Stripe — Payment processing and subscription invoicing. Ireland (Stripe Payments Europe, Ltd.), with transfers to the United States under the standard contractual clauses
• Resend — Sending service email — account confirmation and password recovery. United States, under the standard contractual clauses

Beyond these, we disclose data only where the law requires it or a competent authority demands it.

Data is stored in the European Union. There are still two points at which it may leave, and it is only honest to say so precisely.

The first is running the application itself: it executes on Cloudflare’s network, at the point of presence nearest whoever makes the request. For someone in Portugal that means a European server in practice, but we do not guarantee it — a request made from outside Europe is served outside Europe. Nothing is stored in that transit.

The second is the payment and email providers, which process data in the United States. Those transfers rely on the standard contractual clauses approved by the European Commission and, where applicable, certification under the EU–US Data Privacy Framework.

• Account and staff data: for as long as the account exists. If the account is deleted, it is erased.
• Invoices and accounting records: 10 years, as tax law requires.
• Technical and security logs: up to 12 months.
• Requests for help getting started: 6 months from the request.
• Accounts created and never used: deleted after 12 months of inactivity, with email notice first.

Account deletion can be requested at any time at the address above and is carried out free of charge.

Traffic is encrypted in transit. Passwords are stored only as a cryptographic hash. Each business’s data is isolated at database level by rules that stop one account reaching another’s data even if a request is tampered with. Internal access is limited to what is necessary and is logged.

No measure is infallible. If a personal data breach occurs that presents a high risk, we will inform the people affected and the authority within the legal deadlines; where it concerns a customer’s staff data we will inform the customer without undue delay, as they are the controller.

We use no advertising or analytics cookies, and there are no third-party tools tracking visitors to the site. The cookies we do use are strictly necessary to make it work and therefore need no consent:

• authentication session — keeps you signed in;
• locale — the language you chose;
• theme — light or dark;
• active_location — the venue you are working in;
• plan_notice_seen and cost_prompt_hidden — notices you have dismissed;
• acesso_antecipado — marks early access before public launch.

We count how many times the public pages of the site are opened, by day, by page and by the kind of place the visit came from (a search, a social network). We do the counting ourselves, with no cookies and nothing stored on your device: no IP address and no identifier of any kind is kept, so there is no telling who visited. When you create an account, that kind of origin is kept with it.

You have the rights of access, rectification, erasure, restriction, objection and portability under articles 15 to 22 GDPR. Exercise them by writing to the address above; we respond within one month, extendable as the law allows.

If you believe the processing breaches the law you may complain to the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisbon, www.cnpd.pt.

The service is for businesses, not for minors. A venue that employs minors under employment law and records their shifts here does so as controller and on its own responsibility.

This policy may be updated. The date at the top marks the version in force, and material changes are notified by email or in the service before they take effect.