Privacy Policy

1. Definitions

1.1. For the purposes of this Policy, the definitions in Article 5 of the LGPD and Article 4 of the GDPR apply, as well as the definitions in the Terms of Use, in particular the following:

1.2. “Personal data”: any information relating to an identified or identifiable natural person, directly or indirectly, including by reference to an identifier such as a name, an email address, an online identifier or an internet protocol (IP) address.

1.3. “Sensitive personal data” or “special categories of data”: personal data revealing racial or ethnic origin, religious belief, political opinion, trade union membership or membership of a religious, philosophical or political organisation, data concerning health or sex life, and genetic or biometric data, when linked to a natural person.

1.4. “Data subject”: the natural person to whom the personal data being processed relate, notably the User of the Platform.

1.5. “Controller”: the natural or legal person responsible for decisions regarding the processing of personal data, identified in clause 2.

1.6. “Processor”: the natural or legal person that processes personal data on behalf of the Controller, in accordance with its documented instructions.

1.7. “Data Protection Officer” (“DPO”) or “Encarregado”: the person appointed by the Controller to act as the communication channel between the Controller, data subjects and the data protection authority.

1.8. “Processing”: any operation performed on personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, erasure, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

1.9. “Anonymisation”: the use of reasonable technical means available at the time of processing whereby data loses the possibility of being associated, directly or indirectly, with an individual.

1.10. “Security incident” or “personal data breach”: any confirmed adverse event relating to a breach of the confidentiality, integrity, availability or authenticity of personal data.

1.11. “Supervisory authority”: the National Data Protection Authority (ANPD) in Brazil and the independent supervisory authorities established by the Member States of the European Union pursuant to Article 51 of the GDPR.

2. Identification of the Controller and the Data Protection Officer

2.1. The Controller of the personal data processed within the Platform is [A PREENCHER], registered under number [A PREENCHER], domiciled or with registered office at [A PREENCHER].

2.2. The Data Protection Officer can be contacted at suporte@beedoit.app, pursuant to Article 41 of the LGPD and Articles 37 to 39 of the GDPR. The DPO’s duties include receiving complaints and communications from data subjects, providing clarifications and taking action, receiving communications from the supervisory authority, advising employees and contractors on data protection practices and performing other duties determined by the Controller or established by supplementary rules.

2.3. Should the Controller not be established in the European Union and process data of data subjects located there, a representative in the Union will be designated pursuant to Article 27 of the GDPR, where required, and identified in this Policy.

2.4. The Infrastructure Providers and the Payment Processor are not joint controllers with the Controller with respect to the purposes described in this Policy and act as processors, except for the activities in which, pursuant to clause 8, they act as independent controllers.

3. Scope

3.1. This Policy applies to all personal data processing operations carried out through the web application, the desktop applications for the Microsoft Windows and Apple macOS operating systems, the cloud functions and the support channels relating to the Platform.

3.2. This Policy does not apply to the processing of personal data carried out by third parties whose services are accessed from the Platform, such as the Payment Processor, with regard to the activities it performs as an independent controller, and the identity provider used for Google account authentication, which are subject to their own privacy policies.

3.3. The demonstration version of the Platform, where made available, stores the data entered exclusively on the User’s device and does not transmit it to the Controller’s servers.

4. Principles applicable to processing

4.1. Personal data processing activities observe good faith and the principles set out in Article 6 of the LGPD and Article 5 of the GDPR, in particular: (i) purpose limitation, with processing for legitimate, specific, explicit purposes communicated to the data subject; (ii) adequacy, with processing compatible with the stated purposes; (iii) necessity and data minimisation, with processing limited to the minimum necessary to achieve the purposes; (iv) free access and transparency, guaranteeing easy, free consultation and clear, accurate and easily accessible information; (v) data quality and accuracy; (vi) storage limitation; (vii) security, integrity and confidentiality; (viii) prevention; (ix) non-discrimination; and (x) accountability.

4.2. In accordance with the principle of data protection by design and by default, the Platform was designed to collect only the data strictly necessary for its operation and does not incorporate advertising trackers, advertising network software development kits or behavioural profiling technologies for marketing purposes.

4.3. The Controller keeps a record of the processing operations it carries out, pursuant to Article 37 of the LGPD and Article 30 of the GDPR, and will prepare a data protection impact report or data protection impact assessment whenever processing is likely to result in a high risk to the rights and freedoms of data subjects or when required by the supervisory authority.

5. Categories of personal data processed

5.1. Registration and authentication data: name or first name; email address; password, stored exclusively as a cryptographic hash generated by a salted key derivation algorithm, which the Controller cannot recover in plain text; date and time of Account creation, email confirmation and last access; and the universally unique identifier (UUID) assigned to the Account.

5.2. Data from federated authentication: when the User chooses to authenticate with a Google account, the Controller receives from the identity provider the name, email address, account identifier with the provider and other basic profile data that the provider makes available within the scope authorised by the User.

5.3. User Content: task titles and descriptions, due dates, duration estimates, task status, start, pause and completion records, time actually worked, list ordering, recurring tasks and their frequency rules, and the dates of deleted occurrences.

5.4. Preferences and settings: interface language, visual theme, time display format, activation of sounds and notifications, Pomodoro mode settings (focus and break duration and break mode), automatic opening of the floating window, activation of recurring tasks and an indicator of completion of the first-run questions.

5.5. Subscription and billing data: end date of the Trial Period; Subscription status; plan purchased; start, renewal and end dates of the Billing Period; customer and subscription identifiers in the Payment Processor’s system. The Controller does not receive or store the full card number, security code or expiry date.

5.6. Technical and log data: IP address, date and time of access, browser or operating system type and version, application version and other technical records automatically generated by the Infrastructure Providers in the course of providing the service, including for the purposes of keeping application access logs under Article 15 of the Brazilian Civil Rights Framework for the Internet, where applicable.

5.7. Communications: the content of messages exchanged with the support channel and the corresponding metadata.

5.8. The Controller does not request or intentionally process sensitive personal data. The User must refrain from entering such data in the User Content, in accordance with the Terms of Use.

5.9. Data relating to the Pomodoro cycle in progress, including the phase of the cycle, the end time of the block and the associated task, are stored exclusively on the User’s device and are not transmitted to the Controller’s servers, so changing device during a focus block does not transfer the cycle in progress.

5.10. The Platform does not collect precise geolocation data, contacts, photographs, device files, audio or video recordings, or data from other installed applications, and does not monitor the User’s activity outside the Platform itself, including while the floating window remains visible above other applications.

6. Sources of data

6.1. Personal data are obtained: (i) directly from the data subject, upon registration, when using the features and in communications with support; (ii) from the identity provider, when the data subject chooses federated authentication; (iii) from the Payment Processor, through cryptographically signed electronic notifications (webhooks) relating to Subscription events; and (iv) automatically, through the technical records generated while the Platform is used.

7. Purposes and legal bases of processing

7.1. Creating, authenticating and managing the Account; verifying the email address; password recovery; storing, synchronising and displaying the User Content on the devices on which the Account is accessed; operating the timer, Pomodoro, recurring task and floating window features; applying the User’s preferences. Legal basis: performance of a contract, or steps prior to entering into a contract, to which the data subject is party (Article 6(1)(b) GDPR; Article 7(V) LGPD).

7.2. Managing the Trial Period and the Subscription, controlling access to features according to contractual status, processing payments, issuing receipts and handling cancellation, withdrawal and refund requests. Legal basis: performance of a contract (Article 6(1)(b) GDPR; Article 7(V) LGPD).

7.3. Compliance with legal and regulatory obligations, including tax, accounting and record-keeping obligations, and responding to requests from administrative and judicial authorities. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR; Article 7(II) LGPD).

7.4. Ensuring the security of the Platform and of data subjects, preventing and detecting fraud, abuse, unauthorised access and breaches of the Terms of Use, diagnosing and fixing technical failures and maintaining system integrity. Legal basis: legitimate interests of the Controller and of data subjects (Article 6(1)(f) GDPR; Articles 7(IX) and 10 LGPD), having regard to the fundamental rights and freedoms of data subjects, as assessed by the Controller in a balancing test.

7.5. Sending service communications, such as notices about the end of the Trial Period, changes to the Terms of Use, to this Policy or to prices, and security incident notifications. Legal basis: performance of a contract and compliance with a legal obligation.

7.6. Establishment, exercise or defence of legal claims in judicial, administrative or arbitral proceedings. Legal basis: Article 6(1)(f) and Article 17(3)(e) GDPR; Article 7(VI) LGPD.

7.7. Processing of children’s data, where applicable. Legal basis: specific and prominent consent of at least one parent or legal guardian (Article 8 GDPR; Article 14(1) LGPD).

7.8. The Controller does not use personal data for advertising purposes, direct marketing without consent, sale to third parties, behavioural profiling or training artificial intelligence models. Any new purpose will be preceded by notice to the data subject and, where required, by obtaining consent.

7.9. The legitimate interest assessment referred to in item 7.4 considered: (i) the legitimate purpose of protecting the Platform and data subjects themselves against fraud and unauthorised access; (ii) the necessity and minimisation of the data used, limited to technical and authentication records; (iii) data subjects’ reasonable expectation that digital service providers will adopt security measures; and (iv) the adoption of safeguards, such as short retention periods and restricted access, concluding that the legitimate interest prevails without prejudice to the fundamental rights and freedoms of data subjects.

7.10. Providing registration and authentication data is a requirement for entering into the contract and using the Platform. Refusal to provide such data makes it impossible to create an Account but has no other consequence for the data subject.

8. Data sharing and processors

8.1. The Controller does not sell, rent or transfer personal data to third parties for commercial purposes. Personal data are shared exclusively with the processors listed below, to the extent strictly necessary to provide the service, under contractual instruments imposing obligations of confidentiality, security and processing in accordance with the Controller’s instructions, pursuant to Article 28 of the GDPR and Article 39 of the LGPD:

8.2. Supabase, Inc. — hosting of the PostgreSQL database, authentication service, session storage and execution of cloud functions (Edge Functions). Data categories: registration and authentication data, User Content, preferences, subscription data and technical records.

8.3. Stripe, Inc. and its group companies — payment processing, subscription management, issuing receipts, fraud prevention and the Customer Portal. Data categories: name, email address, Account identifiers, payment data and technical records. For certain activities, such as fraud prevention and compliance with financial regulatory obligations, Stripe acts as an independent controller under its own privacy policy.

8.4. Google LLC — federated authentication with a Google account, only when chosen by the User, and delivery of the interface typefaces through the Google Fonts service, in which case the device’s IP address and user agent are transmitted to Google’s servers when the fonts are loaded.

8.5. Microsoft Corporation — federated authentication with a Microsoft account (personal, work or school), only when chosen by the User. Data categories: name, email address and Microsoft account identifiers, received by the Platform after the User’s authorisation.

8.6. Resend, Inc. — sending of transactional emails, such as sign-up confirmation and password recovery. Data categories: name, email address, message content and technical delivery records.

8.7. Cloudflare, Inc. — hosting and delivery of the Platform’s institutional website (beedoit.app), including the pages of the Terms of Use and of this Policy, in which case the visitor’s device IP address and user agent are processed by Cloudflare’s servers to deliver the pages and protect against abuse.

8.8. GitHub, Inc. — hosting and distribution of the installation and update packages for the desktop application and of the corresponding version manifest, in which case the device’s IP address and user agent are transmitted to GitHub’s servers when updates are checked for or downloaded.

8.9. Personal data may also be disclosed: (i) to administrative, judicial or law enforcement authorities, upon a reasoned request or court order, in accordance with Applicable Law; (ii) to legal, accounting and audit advisers bound by confidentiality, for the regular exercise of rights and compliance with legal obligations; and (iii) to any successor of the Controller in the event of a merger, demerger, incorporation or transfer of business, provided that the guarantees set out in this Policy are maintained and data subjects are notified in advance.

8.10. An up-to-date list of processors and their processing locations may be requested from the Data Protection Officer at any time. The addition of a new processor handling categories of data not provided for in this Policy will be preceded by an update to it, pursuant to clause 20.

9. International data transfers

9.1. Owing to the location of the infrastructure of the processors listed in clause 8, personal data may be transferred to, stored and processed in countries other than the data subject’s country of residence, including the United States of America, whose legislation may not offer a level of protection equivalent to that of the GDPR or the LGPD.

9.2. International transfers are based on the mechanisms provided for in Chapter V of the GDPR and Article 33 of the LGPD, including: (i) adequacy decisions, where available, including the EU–U.S. Data Privacy Framework with regard to certified importers; (ii) the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 and the standard contractual clauses approved by the ANPD; and (iii) where necessary, the performance of a contract to which the data subject is party, at the data subject’s request.

9.3. The Controller assesses, for each processor, the security and protection guarantees offered, adopting supplementary measures, such as encryption in transit and at rest and minimisation of the data transferred, where necessary to ensure an essentially equivalent level of protection. Data subjects may obtain further information on the safeguards adopted by contacting the Data Protection Officer.

10. Security measures

10.1. The Controller adopts appropriate technical and organisational measures, pursuant to Article 32 of the GDPR and Article 46 of the LGPD, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to the rights and freedoms of data subjects, including:

10.2. Encryption of all communications between data subjects’ devices and the servers using the TLS (Transport Layer Security) protocol, with HTTPS; encryption of data at rest in the Infrastructure Providers’ storage systems.

10.3. Access control at database level through row-level security (RLS) policies enabled on all tables, so that each Account has access exclusively to its own records, regardless of the application layer.

10.4. Storage of passwords exclusively as salted cryptographic hashes; OAuth 2.0 authentication flow with PKCE; mandatory email confirmation; limitation of authentication attempts; storage of the session token in the operating system’s credential vault, in the desktop application.

10.5. Segregation of credentials: the client application uses only public keys; service keys, integration secrets and private signing keys are kept exclusively in server environments or secret vaults, never in source code or version control systems.

10.6. Validation of the cryptographic signature of electronic notifications received from the Payment Processor and idempotent handling of events; digital signing of the desktop application update packages and validation of that signature before installation.

10.7. A restrictive Content Security Policy (CSP) in the desktop application, limiting the origins from which resources may be loaded; validation of field size limits in the database itself; and periodic backups of the production databases.

10.8. Notwithstanding these measures, no method of electronic transmission or storage is absolutely secure; accordingly, the Controller cannot guarantee the absolute security of personal data, and undertakes to keep the measures permanently updated and to respond promptly to incidents.

10.9. Administrative access to production systems is restricted to the persons strictly necessary for operating the Platform, protected by strong authentication and subject to a duty of confidentiality; access to User Content for purposes other than maintenance, security, handling a request from the data subject or compliance with a legal obligation is prohibited.

11. Security incidents

11.1. The Controller maintains a security incident response procedure covering the detection, containment, risk assessment, mitigation, notification and recording of incidents.

11.2. In the event of a personal data breach affecting data subjects located in the European Union, the Controller will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 (seventy-two) hours after becoming aware of it, and will communicate the breach to the data subjects where it is likely to result in a high risk to their rights and freedoms, pursuant to Articles 33 and 34 of the GDPR. With regard to data subjects in Brazil, where an incident may result in relevant risk or harm, the Controller will notify the ANPD and the affected data subjects within the period set out in the applicable regulation, pursuant to Article 48 of the LGPD and the Security Incident Reporting Regulation approved by the ANPD.

11.3. The notification will include, at a minimum, a description of the nature of the data affected, information on the data subjects involved, the technical and security measures used to protect the data, the risks related to the incident, the measures taken or to be taken to reverse or mitigate its effects, and the contact details of the Data Protection Officer.

11.4. The Controller keeps a record of security incidents, including those that were not notified to the supervisory authority or to data subjects, containing the facts, their effects and the remedial action taken, for the period set out in the applicable regulation.

12. Retention periods and erasure

12.1. Personal data are kept only for as long as necessary to fulfil the purposes for which they were collected, subject to the periods below and to the retention cases permitted by Article 17(3) of the GDPR and Article 16 of the LGPD.

12.2. Registration data, User Content and preferences: for as long as the Account remains active, including after cancellation of the Subscription, in Read-Only Mode, so that the data subject can continue to access their Content.

12.3. Deletion of the Account by the data subject: registration data, User Content and preferences are erased immediately from the production systems, and the Subscription is automatically cancelled with the Payment Processor. Backup copies that may contain such data are erased within 30 (thirty) days, in accordance with the regular rotation cycle, and until then remain protected and inaccessible for any other purpose.

12.4. Inactive Accounts: Accounts that remain without any access for 2 (two) consecutive years will be erased, subject to prior notice sent to the registered email address at least 30 (thirty) days in advance, and the data subject may keep the Account by signing in again during that period.

12.5. Billing data and transaction records: for the period required by applicable tax, accounting and financial legislation, which may reach 5 (five) years or more depending on the jurisdiction, part of which data is kept by the Payment Processor as an independent controller.

12.6. Application access logs: for 6 (six) months, where Article 15 of the Brazilian Civil Rights Framework for the Internet applies, or for the period defined by the Infrastructure Providers for security purposes.

12.7. Communications with support: for the period necessary to handle the request and, thereafter, for the limitation period applicable to the establishment, exercise or defence of legal claims.

12.8. At the end of the retention periods, personal data will be securely erased or irreversibly anonymised, and anonymised data may be used for statistical purposes.

12.9. Blocking of data, when requested by the data subject or ordered by the supervisory authority, will entail the temporary suspension of any processing operation, except storage, for the period necessary to resolve the dispute that gave rise to it.

13. Data subject rights

13.1. Pursuant to Articles 15 to 22 of the GDPR, data subjects located in the European Union have the right of access, the right to rectification, the right to erasure (“right to be forgotten”), the right to restriction of processing, the right to data portability in a structured, commonly used and machine-readable format, the right to object to processing based on legitimate interests and the right not to be subject to automated individual decision-making, as well as the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

13.2. Pursuant to Articles 17 to 22 of the LGPD, data subjects have the right to obtain from the Controller, at any time and upon request: (i) confirmation of the existence of processing; (ii) access to the data; (iii) correction of incomplete, inaccurate or outdated data; (iv) anonymisation, blocking or erasure of unnecessary or excessive data or data processed in breach of the LGPD; (v) portability of the data to another service or product provider, subject to commercial and industrial secrets; (vi) erasure of personal data processed with the data subject’s consent; (vii) information on the public and private entities with which the Controller has shared data; (viii) information on the possibility of refusing consent and the consequences of refusal; (ix) withdrawal of consent; (x) objection to processing carried out on the basis of one of the cases exempt from consent, in the event of non-compliance with the LGPD; and (xi) review of decisions taken solely on the basis of automated processing.

13.3. Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with a supervisory authority: in the European Union, with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement, pursuant to Article 77 of the GDPR; in Brazil, with the National Data Protection Authority (ANPD), through gov.br/anpd.

13.4. The right to data portability covers the personal data provided by the data subject and processed on the basis of the performance of the contract, including the User Content, which will be made available in a structured, commonly used and machine-readable format, such as JSON or CSV, upon request to the Data Protection Officer, until an export feature is made available directly on the Platform.

13.5. Exercising data subject rights is free of charge and will not result in any form of discrimination, restriction of access to features or change in contractual conditions, save for the consequences inherent in the right exercised, such as the impossibility of providing the service after the erasure of the data necessary for its performance.

14. Procedure for exercising rights

14.1. Certain rights may be exercised directly on the Platform, autonomously and immediately: correcting the name, in Settings → Account; changing the password; and the complete erasure of data, through Settings → Delete account.

14.2. Other rights may be exercised by sending an express request to the Data Protection Officer at suporte@beedoit.app, preferably from the email address linked to the Account. To protect the data subject, the Controller may request reasonable additional information to confirm their identity before acting on the request.

14.3. The Controller will respond to requests free of charge, in a simplified format and immediately, where possible, or through a clear and complete statement within 15 (fifteen) days, pursuant to Article 19 of the LGPD, and, for data subjects located in the European Union, within 1 (one) month, extendable by up to 2 (two) further months where necessary, taking into account the complexity and number of requests, pursuant to Article 12(3) of the GDPR, informing the data subject of the extension and the reasons for it.

14.4. Requests that are manifestly unfounded or excessive, in particular because of their repetitive character, may be refused with reasons, in accordance with Applicable Law.

14.5. Where the requested action cannot be taken immediately, the Controller will inform the data subject of the factual or legal reasons preventing it or, where applicable, that it is not the controller of the data, indicating, whenever possible, the responsible party.

15. Automated decision-making and profiling

15.1. The Controller does not take decisions producing legal effects or similarly significantly affecting data subjects based solely on automated processing of personal data, nor does it carry out profiling for advertising, credit or behavioural assessment purposes.

15.2. The automatic ordering of tasks, the generation of recurring task occurrences, access control according to Subscription status and the time calculations performed by the Platform are technical operations intended exclusively to perform the contracted features, according to transparent and deterministic rules defined by the User or described in the Terms of Use, and do not constitute automated decisions for the purposes of Article 22 of the GDPR and Article 20 of the LGPD.

15.3. Should the Controller implement features based on artificial intelligence or automated processing capable of producing significant effects for data subjects, this Policy will be updated in advance, describing the logic involved, the significance and the envisaged consequences of the processing, and indicating how to request review by a natural person.

16. Personal data of children and adolescents

16.1. Personal data of children and adolescents are processed in their best interests, pursuant to Article 14 of the LGPD and Brazilian Law No. 8,069/1990 (Statute of Children and Adolescents).

16.2. With regard to data subjects located in the European Union, the processing of data of minors below the digital age of consent set by the law of the respective Member State, between 13 (thirteen) and 16 (sixteen) years of age, requires consent given or authorised by the holder of parental responsibility, pursuant to Article 8 of the GDPR. Personal data of children, meaning persons under 12 (twelve) years of age, will only be processed with specific and prominent consent given by at least one parent or legal guardian, and the Controller will make all reasonable efforts to verify that consent was given by the guardian, taking into account available technology.

16.3. Parents or legal guardians may exercise, on behalf of the minor, all the rights provided for in clause 13, including erasure of the data and deletion of the Account, by sending a request to suporte@beedoit.app together with information enabling reasonable verification of their status.

16.4. Information on the processing of children’s data is provided in a simple, clear and accessible manner, taking into account the physical-motor, perceptual, sensory, intellectual and mental characteristics of the user, pursuant to Article 14(6) of the LGPD.

17. Local storage, cookies and similar technologies

17.1. The Platform uses only local storage mechanisms that are strictly necessary for its operation, which do not require consent under Article 5(3) of Directive 2002/58/EC (ePrivacy Directive) and the corresponding national rules, namely:

17.2. (i) the authentication session token, stored in the operating system’s credential vault, in the desktop application, or in the browser’s local storage (localStorage), in the web application; (ii) the language and visual theme preference, for correct display of the interface before authentication; (iii) the state of the Pomodoro cycle in progress, stored exclusively on the device; and (iv) the position of the floating window on screen, in the desktop application.

17.3. The Platform does not use advertising cookies, third-party cookies for cross-site tracking, tracking pixels, device fingerprinting or behavioural analytics technologies for marketing purposes.

17.4. The data subject may delete locally stored data at any time by signing out of the Platform, clearing the browser’s browsing data or uninstalling the desktop application, bearing in mind that this may require new authentication and reconfiguration of local preferences.

17.5. The desktop application records, on the device itself, the position of the floating window and the automatic opening preference, which are used solely to restore the interface to the state in which the User left it and are not associated with any analytics or tracking purpose.

18. Electronic communications

18.1. The Controller sends the data subject only transactional and service communications necessary for performing the contract or complying with legal obligations, such as: email address confirmation messages; password reset messages; notices about the end of the Trial Period; notices about changes to the Terms of Use, to this Policy or to prices; notices of deletion of inactive Accounts; and security incident communications. Payment receipts are sent directly by the Payment Processor.

18.2. Sending promotional or marketing communications will depend on the data subject’s prior, free, informed and unambiguous consent, which may be withdrawn at any time through the unsubscribe link included in each message or by request to the Data Protection Officer.

18.3. Emails sent by the Controller do not contain open-tracking pixels or links with individualised tracking parameters for marketing purposes.

19. Third-party services and websites

19.1. The Platform may contain links or redirects to third-party services and websites, such as the Payment Processor’s payment page and Customer Portal, the identity provider’s authentication page and the repository distributing application versions.

19.2. When accessing such services, the data subject is subject to the privacy policies and terms of use of the respective third parties, which in those cases act as independent controllers, and the Controller is not responsible for their data processing practices. Data subjects are advised to read the respective policies carefully.

20. Updates to this Policy

20.1. This Policy may be updated periodically as a result of legislative or regulatory changes, guidance from supervisory authorities, changes in the processors engaged or the evolution of the Platform’s features, the date of the last update being indicated at the top of the document.

20.2. Relevant changes, in particular those involving a new processing purpose, new categories of data, new disclosures or changes in legal bases, will be notified to the data subject reasonably in advance, by email or by a prominent notice on the Platform, and, where the new operation requires consent, such consent will be requested in advance.

20.3. The activation of any new features involving additional processing of personal data, such as determining the data subject’s country from the IP address in order to display prices, will be preceded by an update to this Policy.

20.4. Previous versions of this Policy may be made available to the data subject upon request to the Data Protection Officer, for consultation and to evidence the conditions in force at the time of a given processing operation.

21. Contact and Data Protection Officer

21.1. For clarification about this Policy, to exercise data subject rights or for any communication relating to the processing of personal data, the data subject may contact the Data Protection Officer at suporte@beedoit.app.

21.2. This Policy shall be interpreted together with the Terms of Use and Applicable Law, and public policy provisions affording broader protection to the data subject shall prevail in any event.