Privacy Policy

Personal Data Protection Commitment

1. Our personal data protection commitment

BrightCity, S.A., with registered office at Lugar do Espido, Via Norte, 4470- 177 Maia, under registration number 516104659 (hereinafter, “the Company”) is the Controller of the personal data of the users of this website (hereinafter, “the Users” or “the Data Subjects”), including the respective reserved area (hereinafter, “the website”).

In that capacity, the Company shall always process the User’s personal data responsibly, fairly and transparently. We are strongly committed to protecting your privacy and your private and personal data. We collect, store and use your personal data strictly in accordance with the provisions of this Personal Data Protection Commitment and with the applicable data protection provisions, including, among others, the European General Data Protection Regulation (GDPR) and the data protection legal provisions of the Member States.

As part of its commitment to the protection of personal data, the Company will always seek to provide you with the information necessary for you to understand the manner and the conditions of processing of your personal data.

This document is intended precisely to provide Users with the necessary information regarding the processing of their personal data in the context of the use of our website.

2. Personal data

Personal data means all information about an identified or identifiable person. This includes information about your identity, such as your name, information about your email address, or about your address. Any information that cannot be directly associated with your identity (for example, statistical details such as the number of users of the website) is not, however, considered personal data.

You may use our website, in essence, without revealing your identity and without providing any personal data. In that case, we will collect only general information about your visit to our website. However, some of the services offered require you to provide certain personal data. As a rule, we will process that data only for purposes related to the use of this website, including, among others, to provide the information requested. Whenever personal data are requested, it is only necessary to provide the data that are absolutely essential. Additional information may also be requested, that is, information that is not necessary and that you will provide only voluntarily. We always state whether the fields to be filled in are mandatory or optional. More detailed information in this regard is provided in the corresponding section of this Personal Data Protection Commitment.

There is no automated decision-making, based on your personal data, in the context of the use of our website.

3. Processing of personal data

We store the information provided by you on dedicated and protected servers, located in the European Union. Technical and organisational measures are taken to protect those servers against the loss, destruction, access, modification or disclosure of your data by unauthorised persons. Access to your data will only be allowed to a limited number of persons responsible for the technical, commercial or editorial support of the servers. Notwithstanding regular checks, it is not, however, possible to ensure total protection against all risks.

Your personal data are transmitted over the Internet in encrypted form. We use SSL (Secure Socket Layer) encryption for the transmission of data.

The website is intended solely for, and should only be used by, persons over 16 years of age. We do not voluntarily and knowingly process children’s personal data. If we discover that we have collected personal data of children, we will proceed immediately to delete it. We ask you to contact us if you know that we collect or process the personal data of children.

4. Disclosure of personal data to third parties

We use your personal data exclusively for the provision of the services you requested from us. To the extent that we use external service providers in carrying out the requested services, those external service providers will also have access to the data, exclusively for the purpose of carrying out the services. By implementing the necessary technical and organisational measures, we ensure compliance with data protection policies and we require the same of our external partners.

We contractually require our service providers that act as our processors to implement appropriate security measures to protect your personal data.

The categories of recipients to whom we may disclose personal data include the following:

  1. PSERVERS Consulting, Lda.
  2. OSCON, Lda.
  3. WIDGILABS, Lda.
  4. Lifemonitor, Lda.
  5. Sixandco, Unipessoal Lda.
  6. Sierra Portugal, S.A.
  7. Code Five, S.A.
  8. NOS Comunicações, S.A.

And possibly other entities providing the following services:

  1. data storage (centro de dados // data centre);
  2. design and production of marketing materials and media;
  3. provision of the technological structure of the website, technical support and maintenance, and system applications.

We may possibly transfer your personal data in the context of a sale of the business or of a merger, demerger or change of control within the Company, or in the context of the preparation of any of those events. In any case, the processing of the data by the entity to which they were transferred will comply with the terms of this personal data protection commitment. Subject to the above, we will not disclose personal data to third parties, including, among others, for advertising purposes, without your express consent. We will only disclose your personal data to third parties if you have given your consent to the disclosure of the data or to the extent that we have the right or the obligation to do so by virtue of legal provisions and/or administrative or judicial decisions. This includes, among other examples, the provision of information for the purposes of criminal prosecution, to avoid or contain danger, or to enforce intellectual property rights.

5. Legal basis for the processing of data (basis of lawfulness)

Throughout this Personal Data Protection Commitment we inform you of the legal basis on which we process your personal data.

6. Erasure of data and duration of storage

We erase or anonymise any personal data provided by you, invariably, as soon as the purpose that justifies their retention ceases to apply. We may, however, keep your personal data if storage is required by legal provisions to which we are subject, including, among others, the legal obligation to retain records and commercial documentation. In that case, the personal data will only be deleted or anonymised after the end of the period laid down by law.

7. Communications

There are several means through which you may contact us, including, among others, the email address available on our website.

7.1 Contact by email

If you contact us by email, we will collect the personal data you provide to us, including, among others, your name and email address. We will process any data transmitted through this means of contact exclusively for the purpose of responding to your request or of addressing the concern you brought to our attention.

It is for you to decide what information you provide to us in that communication. The legal basis for the processing of the data you provide to us in this context is your consent, under point (a) of Article 6(1) of the GDPR.

The data will be erased as soon as they are no longer necessary to achieve the purpose for which they were collected. With regard to your personal data, this will happen as soon as the conversation has ended. For us, the conversation ends when it can be inferred, from the circumstances of the case, that the facts have been finally clarified.

7.2 SMS

You may provide us, if you so wish, with your mobile phone number. In that case we may use that data to send you messages related to the Company. Your consent, expressed by filling in the “telephone” field at the time of registration on our website, constitutes the legal basis for the processing of that data and, in particular, for the sending of SMS messages, in accordance with point (a) of Article 6(1) of the GDPR. If you wish to stop receiving our SMS messages, simply use the cancellation link contained in each SMS or let us know of that decision.

8. Other information about the use of our website

8.1. Information relating to your computer

Whenever you access our website, we will collect the following information relating to your computer, whether or not you have registered (created an account): your computer’s IP address, the request made by your browser as well as the date/time of that request; the status and the amount of data transmitted in the course of the request will also be collected. We will also collect information about the type and version of the browser used and the computer’s operating system. Your computer’s IP address is stored only for the period during which you are using our website; afterwards, it is deleted or anonymised by truncation. The remaining data are stored for a limited period of time.

We use this data to manage the website, more specifically for troubleshooting, or to assess the level of use of the website, or to make adjustments or improvements to it. Those purposes also constitute our legitimate interest in the processing of data, in accordance with point (f) of Article 6(1) of the GDPR.

8.2. Use of cookies

Like many other websites, ours uses cookies. Cookies are small text files that are stored on your computer and that store certain settings and data from your browser for exchange with our website. Cookies allow us to recognise your computer and to make any default settings immediately available. You will find detailed information about our website’s use of cookies on our Cookie Policy page.

8.3. Google Analytics

We use Google Analytics for statistical evaluation.

Google Analytics is a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyse how you use the website. The information generated by the cookie about your use of this website will, as a rule, be transmitted to. and stored by, Google. Google will use this information, for the benefit of the Company, for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and Internet use to the website owner. Google will not associate the IP address transmitted by your browser in connection with Google Analytics with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings in your browser software. Please note, however, that if you do so you may not be able to use all the features of this website. You can prevent the data generated by the cookie and relating to your use of this website (including your IP address) from being sent to and processed by Google by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout?hl=en. For further information, visit https://tools.google.com/dlpage/gaoptout?hl=en or http://www.google.com/intl/de/analytics/privacyoverview.html (general information on Google Analytics and data protection). We inform you that on our web pages Google Analytics has been extended with the code “anonymizeIp();” so as to anonymise IP addresses by deleting the last octet. Our legal basis for the use of Google Analytics is your consent, in accordance with point (a) of Article 6(1) of the GDPR.

8.4. Links to other websites

Our online service may contain links to other websites (examples: Google, Google Maps, Google Play Store, App Store). These links are normally identified as such. We cannot control the extent to which the linked websites comply with the applicable data protection provisions. We therefore recommend that, as regards the data protection statements of other providers, you consult the information provided on the respective websites before opening the link.

8.5. Browser notifications (web push notifications)

We may send you Web Push Notifications using the OneSignal service. The Web Push Notifications we may send you will concern our exclusive discounts and promotions, prize draws, news, events and information about other activities promoted by the Company or by its partners. Web Push Notifications are notifications that can be sent to a user through the browser (Chrome, Opera, Safari, etc). They are alert-type messages that slide into the top or bottom right-hand corner of the screen when the browser is viewed on a computer, or that are shown at the top or in the middle of the screen when the browser is viewed on mobile devices. OneSignal is a push notification service provided by OneSignal, an American company located at 2850 S Delaware St Suite 201, San Mateo, CA 94403. OneSignal uses a specific cookie, which is a text file placed on your computer, in order to be able to send you the notifications through the browser. For further information, visit: https://onesignal.com/blog/product-policy-updates-for-gdpr/; https://documentation.onesignal.com/docs/handling-personal-data. We inform you that OneSignal automatically rejects the collection of IP addresses of EU users. We will ask for your consent in order to send you Web Push Notifications. We will not send you Web Push Notifications unless you give us your consent, and you may give and withdraw your consent at any time. Your consent constitutes, under point (a) of Article 6(1) of the GDPR, the legal basis for the said processing of your personal data.

9. How can you exercise your data protection rights?

9.1 Rights of data subjects

You have extensive rights relating to the processing of your personal data. The Data Subject may exercise their rights by contacting the Company at the following address: [email protected]

The Data Subject may exercise, under the law, the following rights:

  • right of access;
  • right of rectification;
  • right to restriction of processing;
  • right to withdraw your consent;
  • right to data portability;
  • right to object;
  • right to erasure (or the right to be forgotten).

You also have the right, under the law, to lodge a complaint with the supervisory authority, which in Portugal is the following:

Comissão Nacional de Proteção de Dados (CNPD)
Address: Av. D. Carlos I, 134 – 1.º 1200-651 Lisboa
Telephone: +351213928400
Fax: +351213976832
Electronic address: [email protected]

9.2 Additional information on the withdrawal of consent and on objection to processing

You may, at any time, withdraw the consent given for the processing of your personal data, with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out until the moment at which the withdrawal of consent, based on the consent previously given, takes place. To the extent that the processing of your personal data is not based on your consent but on another legal basis, you may object to the processing of the data. Your objection will lead to an assessment and, if the legal conditions are met, to the cessation of the processing of the data. You will be informed of the result of the assessment and, if the processing of data is to continue, you will receive from us further information on the reasons why the processing of data is permissible.

10. Updates to this data protection commitment

The terms of this personal data protection commitment may be changed or updated, and will always be published on our website. Any revision of this personal data protection commitment is identified by the date on which it occurs (see below). We reserve the right to change this personal data protection commitment at any time, with effect for the future. Changes will be made, among other reasons, in the event of technical changes to the website or of a change in data protection legislation. The personal data protection commitment, in the wording resulting from any changes it undergoes, will always remain available on our website. We recommend that you read the personal data protection commitment regularly.

11. Changes to the document

Version 1.0 · 10-2021 · PT · Initial version

Version 1.1 · 11-2026 · PT · Republished on the new site, with no content changes