Privacy Policy

Last updated: May 2026

Interim version. This policy describes how we actually handle data today; the final wording is being reviewed with our lawyer-partner before launch.

Matriculix Unipessoal Lda ("we", "us", "our"), based in Lisbon, Portugal, is committed to protecting your personal data. This policy explains how we collect, use, and safeguard your information under the EU General Data Protection Regulation (GDPR / RGPD).

1. Data Controller

Matriculix Unipessoal Lda is the data controller. Contact: [email protected]

2. Data We Collect

Account data: Name, email, phone, country (at registration)
Vehicle & case data: Make, model, registration date, CO₂, displacement, VIN, and the documents needed to legalise the vehicle (at intake)
Procuração & identity documents: The signed mandate and the identification needed to act on your behalf
Usage data: Device info, IP address, and (with consent) analytics (automatically)

3. How We Use Your Data

Estimating your ISV and managing your account
Executing the mandate — filing the DAV, ISV, matrícula, registo, inspection and plates on your behalf
Keeping you updated on your case
Aggregated, anonymised analytics to improve our service
Meeting our legal and tax obligations

4. Legal Basis (GDPR)

Contract: Processing necessary to provide the legalisation service you instruct us to perform
Legal obligation: Tax, customs and record-keeping requirements
Legitimate interest: Security and fraud prevention
Consent: Analytics, advertising, and marketing communications (withdrawable at any time)

5. Data Sharing

To carry out your instructions we share the necessary data with the licensed despachante oficial on our panel and the relevant Portuguese authorities (AT, IMT, IRN, AIMA). We also use a small number of processors — our email provider and, only with your consent, Google (Analytics and AdSense). We do not sell your data.

6. International Transfers

Your data is processed within the EU/EEA wherever possible. Where a processor operates outside the EEA, we rely on adequacy decisions or Standard Contractual Clauses.

7. Your Rights

Access, rectify, erase, restrict, port, object, and withdraw consent. Email [email protected]. We respond within 30 days.

8. Data Retention

Account data: while active, deleted within 30 days of account deletion
Case & tax records: retained for the period required by Portuguese tax and customs law
Server logs: 90 days

9. Security

HTTPS encryption, hashed credentials, rate limiting, input sanitisation, and access controls on case documents.

10. Complaints

You can lodge a complaint with the Portuguese data protection authority, the CNPD, at cnpd.pt.