Privacy policy

We clearly state the purposes for processing personal data through this privacy statement.

We limit the collection of personal data to what is necessary for legitimate purposes.

We seek your explicit consent to process your data when required.

We implement appropriate security measures to protect your data and require the same from third parties processing data on our behalf.

You can request access to, correction of or erasure of your personal data under applicable law. Erasure is subject to exceptions, including legal retention obligations.

We do not sell personal data.

Contact through phone, mail, email, WhatsApp, and webforms data: name, address, email, phone number, IP address, geolocation, professional or employment-related information, employment history, commercial information including records of products or services purchased, obtained, or considered, message content, attachments, form responses, meeting requests, and signature. Basis: steps taken at your request before entering a contract for service enquiries; our legitimate interest in answering and recording other correspondence. Retention for enquiries without an engagement: 12 months after our last exchange, unless a legal obligation or an active dispute requires longer. Tax simulator: if you ask us to email your calculation, we keep your name, email, the figures you entered, the result and your IP address with that request for 12 months.

Payments data: name, billing address, email, phone number, tax identification or VAT details, payment amount, currency, payment status, Stripe checkout identifiers, receipt references, invoice (fatura) details, and client country. Card details are handled by Stripe and do not pass through Taxbordr. Basis: Legal obligation. Retention: 12 months after service termination unless legal, tax, accounting, or chargeback obligations require longer.

Client portal, paid intake, and account access data: account status, paid access status, service selected, post-sale intake answers, uploaded file references, operational portal records, security logs, and access audit records. Basis: Contract performance, legitimate interest, or legal obligation. Retention: 12 months after service termination unless legal, tax, security, or professional obligations require longer.

Gmail, Google Drive, and meetings data: email correspondence, meeting recordings or transcripts when enabled, meeting summaries, Drive document metadata, and files shared with Taxbordr for service delivery. Basis: Contract performance or legitimate interest. Retention: 12 months after service termination unless legal, tax, or professional obligations require longer.

Newsletters data: email. Basis: Consent. Retention: 12 months after service termination or until you unsubscribe.

Supporting services or products data: name, address, email, phone number, professional or employment-related information, employment history, commercial information, education information, passport number, driving licence, signature, social security number, marital status, tax records, bank account information when needed for tax filings or refunds, and other information you provide for advisory or filing work. Basis: Legal obligation or contract performance. Retention: 12 months after service termination unless legal, tax, or professional obligations require longer.

Compiling and analysing statistics for website improvement data: internet activity information including page views, referral source, browser/device signals, and consented interaction signals used to improve the website. Basis: Consent. Retention: 12 months after service termination.

Offering personalised products and services data: geolocation, IP address, name, address, email, phone number, website interaction data, commercial information, professional or employment-related information, marital status, date of birth, signature, and service preferences. Basis: Consent or legitimate interest. Retention: 12 months after service termination.

Registering an account data: name, address, email, phone number, portal access status, and authentication metadata. Basis: Consent or contract performance. Retention: Until service termination unless security or legal obligations require longer.

Google Workspace (Ireland/USA): Gmail correspondence, Google Drive document storage, Google Meet, meeting transcripts or summaries when enabled, and operational collaboration

Google (Ireland/USA): Consented analytics and marketing services

Stripe (EU/USA): Hosted checkout, payment processing, payment status, receipts, and chargeback support. Card details are handled by Stripe and not by Taxbordr.

Cloudflare (USA/EU): Website hosting, Workers, D1 operational records, client portal delivery, security, and content delivery

Anthropic (USA): AI models (Claude) used to read the documents you send us, research the rules that apply and prepare drafts of our advice, which your adviser checks and signs. Anthropic's commercial terms do not allow it to train its models on this content.

OpenAI (USA): AI models (Codex) used to prepare drafts and check our work, which your adviser checks and signs. Under OpenAI's business terms, it does not train its models on this content.

Microsoft Clarity (USA/EU): Consented website analytics and session recording

Meta (USA): Marketing, WhatsApp messaging transition support, and conversion measurement

TOConline (Portugal): Invoicing, accounting, and fatura support

Autoridade Tributária e Aduaneira (Portugal): Legal obligation

We disclose personal information if required by law, court order, or in response to a law enforcement agency, to the extent permitted under other law provisions, to provide information or for an investigation on a matter related to public safety.

If our website or organisation is taken over, sold, or involved in a merger or acquisition, your details may be disclosed to our advisers and any prospective purchasers and will be passed on to the new owners.

We have concluded a Data Processing Agreement (DPA) with Google. Google may not use the data for any other Google services, and we block the inclusion of full IP addresses.

We have concluded a Data Processing Agreement with Anthropic and with OpenAI. Both include the European Commission's standard contractual clauses for transfers outside the European Economic Area. Neither provider may use your data for any other purpose.

Login security

DKIM, SPF, DMARC, and other specific DNS settings

(START)TLS/SSL/DANE encryption

HTTP Strict Transport Security and related security headers and browser policies

Website hardening/security features

Vulnerability detection

Right to know: You have the right to know why your data is needed, what will happen to it, and how long it will be retained.

Right of access: You can access the data we know.

Right to rectification and erasure: You may ask us to supplement or correct inaccurate personal data, or to erase it where the GDPR right to erasure applies, subject to legal retention obligations and other statutory exceptions.

Right to withdraw consent: When processing is based on consent, you can withdraw that consent.

Right to object: You can object to the processing of your data, and we will comply unless there are justified grounds for processing.

Av. Eng. Arantes e Oliveira 3 R/C, 1900-221 Lisboa, Portugal

Website: https://taxbordr.com

Email: info@taxbordr.com