Privacy Policy - RaiaWeb
Version 2.0 - Last updated: 11 June 2026
Courtesy translation. This English version is provided for convenience only. In the event of any discrepancy, the Portuguese version prevails.
RaiaWeb values the privacy of its users and complies with Regulation (EU) 2016/679 ("GDPR"), Law no. 58/2019 and Law no. 41/2004. This policy explains how we collect, use, share and protect your personal data.
1. Controller
- Controller: Alex Nabais Gomes, sole trader, operating under the commercial name "RaiaWeb"
- Tax number (NIF): 268386625
- Professional address: Rua da Fonte Mestre, N.º 22, 6320-637 Soito, Portugal
- Privacy contact: privacy@raiaweb.pt
- General contact: support@raiaweb.pt
No Data Protection Officer has been appointed, as this is not legally required; for any privacy matter, please use privacy@raiaweb.pt.
2. Scope of this Policy
This policy applies to personal data processed by RaiaWeb as controller: data of website visitors, clients and contacts.
It does not apply to the content and personal data that our clients host or process through the services they purchase (for example, data of visitors and users of hosted websites) - in those cases, RaiaWeb acts as processor, as explained in section 12.
3. Data We Collect
We collect only the data necessary for the purposes described in this policy:
- Identification and contact: name, email, telephone, tax number and billing address.
- Contractual and transactional: services purchased, order history, invoices and payment status. We do not store full payment card numbers - these are processed directly by the payment providers.
- Technical and usage: IP address, user agent, access and security logs, preferences (e.g. language) and cookies (see the Cookie Policy).
- Support: content and attachments of tickets and other assistance contacts.
- Domain registration: domain registrant data, transmitted to the competent registration entities (see section 5). If you provide third-party data for a domain registration, you warrant that you are authorised to do so and that you have informed those persons of this processing.
Data are collected directly from you. Identification data and the tax number are necessary for the conclusion of the contract and for compliance with tax obligations - without them, the service cannot be provided. The remaining data are optional.
4. Purposes, Legal Bases and Retention Periods
| Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|
| Account creation and management, provision of the services | Performance of a contract - (b) | Duration of the contractual relationship + 5 years (limitation periods) |
| Invoicing, accounting and tax obligations, including reporting of invoices to the Tax Authority | Legal obligation - (c) | 10 years |
| Client support (tickets) | Performance of a contract - (b) | Up to 3 years after closure |
| Security, fraud and abuse prevention, technical logs | Legitimate interest - (f) | 6 to 12 months, unless needed for incident investigation |
| Marketing communications to clients about services similar to those purchased | Legitimate interest - (f), under Article 13-A(2) of Law no. 41/2004 | Until objection or 2 years without interaction |
| Newsletter and marketing to non-clients | Consent - (a) | Until consent is withdrawn or 2 years without interaction |
| Usage statistics | Legitimate interest - (f) | Aggregated, non-identifiable data |
You may object at any time to processing based on legitimate interest, including - freely and at no cost - to direct marketing. You may withdraw consent at any time, without affecting the lawfulness of prior processing. Every marketing communication includes a simple and free way to opt out.
5. With Whom We Share Data
We do not sell your data. We share it only with recipients strictly necessary for the provision of the services, bound by contract and by RaiaWeb's instructions (Article 28 GDPR), or where required by law:
- Infrastructure and hosting: Innov4web (Portugal) - shared cPanel hosting; OVH (EU) - virtual private servers (VPS)
- Domain registration: Innov4web (registrar) and DNS.pt (.pt domains); other registries and ICANN, depending on the extension
- SSL certificates: SSLs.com (Namecheap, Inc., USA) and the respective certificate authorities (notably Sectigo) - see section 6
- Payment providers: ifthenpay
- Certified invoicing: Moloni, with legally required reporting of invoices to the Portuguese Tax and Customs Authority (e-fatura / SAF-T)
- Public authorities: only where legally required.
The list of sub-processors is set out in Annex III of the Data Processing Agreement (DPA), published on the Website.
6. International Transfers
We favour providers located in the European Economic Area - the hosting infrastructure is located in Portugal and France. Transfers outside the EEA occur in the context of SSL certificate issuance (SSLs.com/Namecheap, in the USA, and the respective certificate authorities), carried out with adequate legal safeguards - a European Commission adequacy decision (EU-US Data Privacy Framework, where the entity is certified) or Standard Contractual Clauses. You may request information about, or a copy of, the safeguards via privacy@raiaweb.pt.
7. Your Rights
You have the rights of access, rectification, erasure, restriction of processing, portability and objection - including the right to object, at any time and free of charge, to the use of your data for direct marketing - as well as the right to withdraw consents given.
To exercise your rights, contact privacy@raiaweb.pt. We respond within one month, extendable by two further months in particularly complex cases, in which case you will be informed of the extension and its reasons. We may request identity verification where there are reasonable doubts about the requester.
You also have the right to lodge a complaint with the supervisory authority: CNPD - Comissão Nacional de Proteção de Dados, Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal - www.cnpd.pt.
8. Automated Decision-Making
RaiaWeb does not take solely automated decisions producing legal effects or similarly significantly affecting data subjects. Automated security systems (anti-fraud, anti-spam, abuse detection) may flag situations, but decisions with an impact on your account are subject to human review.
9. Information Security
- Encryption in transit and, where applicable, at rest;
- Access control, hardening, network segmentation and monitoring;
- Least-privilege principle, internal policies and periodic reviews;
- Incident response procedures, with notification to the CNPD and, where applicable, to data subjects, under Articles 33 and 34 GDPR.
10. Cookies and Similar Technologies
We use exclusively cookies strictly necessary for the operation of the website and the Client Area - we do not use analytics, marketing or third-party cookies, and therefore no consent banner is displayed. See the Cookie Policy for details.
11. Minors
RaiaWeb's services are intended for persons aged 18 or over - contracting requires full legal capacity. We do not knowingly collect personal data from minors; if you become aware that a minor has provided us with data, contact privacy@raiaweb.pt for its deletion.
12. When RaiaWeb Acts as Processor
Where clients use our services to host websites, applications or data containing third parties' personal data (for example, visitors, users or customers of hosted sites), the client is the controller and RaiaWeb acts as processor, processing such data exclusively in accordance with the client's instructions.
In these cases, the Data Processing Agreement (DPA) applies; it forms an integral part of the service contract and includes the list of authorised sub-processors.
If you are a data subject whose data are processed on a website or application hosted with RaiaWeb, you should address the exercise of your rights to the controller of that website (its owner). If you contact us directly, we will forward your request to the controller, where possible.
Upon termination of the contract with the client, hosted data are deleted under the contractual terms, after a 15-day courtesy period for export.
13. Changes to this Policy
We may update this policy to reflect legal, technical or operational changes. The version in force, with its date, is permanently published on this page; relevant changes are communicated by email or in the Client Area
