Privacy Policy
Last updated: August 19, 2026
This Privacy Policy explains how BOCEAN IMMIGRATION PORTUGAL, LDA ("we", "us", "our"), trading as Blue Ocean Immigration at nif-express.com, collects, uses, and protects your personal data when you use our service to obtain a Portuguese NIF.
We comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679 — "GDPR") and Portuguese law (Lei n.º 58/2019).
1. Data controller
BOCEAN IMMIGRATION PORTUGAL, LDA, NIPC 519043731, with registered office at Avenida da Liberdade, n.º 67B, 3.º B, 1250-140 Lisboa, Portugal. Contact: [email protected].
2. What data we collect
To process your NIF application, we collect:
- Identification data: full name, date of birth, nationality, marital status, country of birth.
- Travel document data: passport number, country of issue, issue and expiry dates, scanned copy of passport.
- Contact data: email address, residential address.
- Parental data (minors only): full name, ID document, address of each parent/legal guardian.
- Payment data: processed entirely by Stripe Inc. We do not store credit card numbers, CVV, or expiration dates. We retain only the Stripe transaction reference and amount paid.
- Technical data: IP address, browser user-agent, timestamps of access (kept in server logs for security and abuse prevention).
3. Why we collect it (legal basis)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Process your NIF application with the Portuguese Tax Authority | Performance of a contract (Art. 6(1)(b)) |
| Generate the legal documents (Procuração, Fiscal Representation Declaration, Service Agreement) | Performance of a contract (Art. 6(1)(b)) |
| Send service-related emails (confirmations, NIF delivery, status updates) | Performance of a contract (Art. 6(1)(b)) |
| Comply with Portuguese tax and accounting law | Legal obligation (Art. 6(1)(c)) |
| Detect and prevent fraud or service abuse | Legitimate interests (Art. 6(1)(f)) |
4. Who we share it with
We share your data with the following processors and authorities, each strictly limited to the purpose described:
- Autoridade Tributária e Aduaneira — the Portuguese Tax and Customs Authority — to register your NIF. This is the entire purpose of the service.
- Stripe, Inc. (Ireland / United States) — to process card payments. Stripe is a PCI-DSS Level 1 certified processor. Stripe Privacy Policy.
- Resend / AWS SES (Frankfurt, EU) — to deliver transactional emails to you.
- Cloudflare, Inc. — DNS, CDN, and DDoS protection. Personal data is encrypted in transit only.
- Cloudflare R2 (European Union region) — encrypted object storage for documents you upload (passport, proof of address, signed forms) and for the legal documents we generate. Data is stored at rest in the EU and encrypted server-side. Cloudflare Privacy Policy.
- Hosting provider — to host the website servers (provider disclosed on request).
We do not sell, rent, or trade your personal data with anyone for marketing purposes.
5. How long we keep it
| Data | Retention period |
|---|---|
| Identification & passport copy | 10 years (Portuguese tax law — Art. 123 CIRC, Art. 52 CIVA) |
| Generated legal documents | 10 years |
| Email correspondence | 5 years after last contact |
| Stripe transaction reference | 10 years |
| Server logs (IP, user-agent) | 30 days, then aggregated/anonymised |
| Account login data | Until you request deletion (subject to retention obligations above) |
6. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data ("right to be forgotten"), subject to legal retention obligations (Art. 17)
- Restrict processing (Art. 18)
- Receive your data in a portable format (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with the Portuguese supervisory authority — Comissão Nacional de Proteção de Dados (CNPD)
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
7. Security
We protect your data using:
- TLS 1.2+ encryption for all data in transit (HTTPS forced site-wide)
- HMAC-signed download tokens for legal document access
- Bcrypt password hashing
- Rate limiting on login and payment endpoints
- Regular security updates and audit logging
8. International transfers
Some of our processors (e.g., Stripe) operate from the United States. Such transfers are protected by Standard Contractual Clauses approved by the European Commission, providing GDPR-equivalent safeguards.
9. Cookies
We use a minimal set of essential cookies. See our Cookie Policy for details.
10. Mobile app (NIF Express for iOS and Android)
When you use our mobile app, the sections above apply equally. In addition:
Push notifications. If you allow notifications, your device's operating system gives us a push token, which we store and associate with your account so we can notify you when the status of your application changes. The token identifies your device for delivery purposes only — it contains no personal information. Notifications are delivered through Expo Application Services (EAS), Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS), acting as processors for delivery. You can withdraw permission at any time in your device settings; deleting your account in the app disables all notifications to your devices immediately.
Biometric sign-in (Face ID / fingerprint). If you enable biometric sign-in, the biometric check happens entirely on your device, using your device's secure hardware. We never receive, store or have access to your biometric data — the device only tells the app whether the check succeeded.
Draft application data. While you fill in an application, the app saves a draft on your device, in the operating system's encrypted secure storage (Keychain on iOS, Keystore on Android), so your progress is not lost. The draft never leaves your device until you submit, and is deleted when the application is created or when you discard it.
Device data. When you register a device for notifications we store the platform (iOS/Android) and app version alongside the push token, to help us troubleshoot delivery. App-specific identifiers are removed when you delete your account.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified by email to active clients. The "Last updated" date at the top reflects the most recent revision.
12. Contact
BOCEAN IMMIGRATION PORTUGAL, LDA
Avenida da Liberdade, n.º 67B, 3.º B, 1250-140 Lisboa, Portugal
NIPC: 519043731
Email: [email protected]