Privacy Policy

Last updated: October 2, 2026

This Privacy Policy explains how BOCEAN IMMIGRATION PORTUGAL, LDA ("we", "us", "our"), trading as Blue Ocean Immigration at nif-express.com, collects, uses, and protects your personal data when you use our service to obtain a Portuguese NIF.

We comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679 — "GDPR") and Portuguese law (Lei n.º 58/2019).

1. Data controller

BOCEAN IMMIGRATION PORTUGAL, LDA, NIPC 519043731, with registered office at Avenida da Liberdade, n.º 67B, 3.º B, 1250-140 Lisboa, Portugal. Contact: [email protected].

2. What data we collect

To process your NIF application, we collect:

Identification data: full name, date of birth, nationality, country of birth.
Travel document data: passport number, country of issue, issue and expiry dates, scanned copy of passport.
Contact data: email address, residential address.
Parental data (minors only): full name, ID document, address of each parent/legal guardian.
Payment data: processed entirely by Stripe Inc. We do not store credit card numbers, CVV, or expiration dates. We retain only the Stripe transaction reference and amount paid.
Technical data: IP address, browser user-agent, timestamps of access (kept in server logs for security and abuse prevention).
Marketing attribution data (only if you accept cookies): the campaign that brought you to the site — UTM parameters, advertising click ID, referring site — stored with your order.
Website usage data (only if you accept cookies, and only on our public information pages, never on checkout, account or document pages): how you interact with the page, as captured by Microsoft Clarity for heatmaps and session recordings. Per Microsoft, this includes interaction events (clicks, scrolling, mouse movement, window resizing, text selection), diagnostic events (script and image errors, performance), page events (page size and visibility) and a pseudonymous user and session ID. The content of input boxes and drop-down menus is masked and not uploaded to Clarity.
Checkout progress telemetry: a one-way hash of your session identifier, the checkout section reached, browser language, and device type (mobile/tablet/desktop). Used only to measure where visitors drop off during checkout. Never includes your name, email, IP address, or the plain session identifier.

3. Why we collect it (legal basis)

Purpose	Legal basis (GDPR Art. 6)
Process your NIF application with the Portuguese Tax Authority	Performance of a contract (Art. 6(1)(b))
Generate the legal documents (Procuração, Fiscal Representation Declaration, Service Agreement)	Performance of a contract (Art. 6(1)(b))
Send service-related emails (confirmations, NIF delivery, status updates)	Performance of a contract (Art. 6(1)(b))
Comply with Portuguese tax and accounting law	Legal obligation (Art. 6(1)(c))
Detect and prevent fraud or service abuse	Legitimate interests (Art. 6(1)(f))
Attribute your order to the marketing campaign that brought you here (only with cookie consent)	Consent (Art. 6(1)(a))
Improve our public information pages by seeing where visitors get stuck, with heatmaps and session recordings (Microsoft Clarity; only with cookie consent)	Consent (Art. 6(1)(a))

We share your data with the following processors and authorities, each strictly limited to the purpose described:

Autoridade Tributária e Aduaneira — the Portuguese Tax and Customs Authority — to register your NIF. This is the entire purpose of the service.
Stripe, Inc. (Ireland / United States) — to process card payments. Stripe is a PCI-DSS Level 1 certified processor. Stripe Privacy Policy.
Resend / AWS SES (Frankfurt, EU) — to deliver transactional emails to you.
Cloudflare, Inc. — DNS, CDN, and DDoS protection. Personal data is encrypted in transit only.
Cloudflare R2 (European Union region) — encrypted object storage for documents you upload (passport, proof of address, signed forms) and for the legal documents we generate. Data is stored at rest in the EU and encrypted server-side. Cloudflare Privacy Policy.
Microsoft (Microsoft Ireland Operations Limited and Microsoft Corporation) — Microsoft Clarity, which provides heatmaps and session recordings of our public information pages, only if you accept cookies. Microsoft states that Clarity operates as a data controller, that its data is stored in the Microsoft Azure cloud, and that EU customers contract with Microsoft Ireland Operations Limited, which transfers data to Microsoft Corporation (United States) under Standard Contractual Clauses. Microsoft Privacy Statement.
Hosting provider — to host the website servers (provider disclosed on request).

We do not sell, rent, or trade your personal data with anyone for marketing purposes.

5. How long we keep it

Data	Retention period
Identification & passport copy	10 years (Portuguese tax law — Art. 123 CIRC, Art. 52 CIVA)
Generated legal documents	10 years
Email correspondence	5 years after last contact
Stripe transaction reference	10 years
Server logs (IP, user-agent)	30 days, then aggregated/anonymised
Account login data	Until you request deletion (subject to retention obligations above)
Checkout started but never paid (abandoned)	Reduced to a minimal record after 14 days of inactivity; your contact details are anonymised unless linked to a paid order
Checkout progress telemetry (hashed session, section, language, device)	30 days
Microsoft Clarity session recordings (only with cookie consent)	30 days from the time of recording; favourited recordings and a random sample up to 9 months (as stated by Microsoft)
Microsoft Clarity heatmaps (only with cookie consent)	Accessible for up to 9 months (as stated by Microsoft)

You have the right to:

Access the personal data we hold about you (Art. 15)
Rectify inaccurate data (Art. 16)
Erase your data ("right to be forgotten"), subject to legal retention obligations (Art. 17)
Restrict processing (Art. 18)
Receive your data in a portable format (Art. 20)
Object to processing based on legitimate interests (Art. 21)
Withdraw consent at any time, where processing is based on consent
Lodge a complaint with the Portuguese supervisory authority — Comissão Nacional de Proteção de Dados (CNPD)

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

7. Security

We protect your data using:

TLS 1.2+ encryption for all data in transit (HTTPS forced site-wide)
HMAC-signed download tokens for legal document access
Bcrypt password hashing
Rate limiting on login and payment endpoints
Regular security updates and audit logging

8. International transfers

Some of our processors (e.g., Stripe) operate from the United States. Such transfers are protected by Standard Contractual Clauses approved by the European Commission, providing GDPR-equivalent safeguards.

9. Cookies

We use a minimal set of essential cookies and, only if you accept them in the cookie banner, analytics and advertising-measurement cookies (Google Analytics and Microsoft Clarity). See our Cookie Policy for details, including how to withdraw your consent at any time.

10. Mobile app (NIF Express for iOS and Android)

When you use our mobile app, the sections above apply equally. In addition:

Push notifications. If you allow notifications, your device's operating system gives us a push token, which we store and associate with your account so we can notify you when the status of your application changes. The token identifies your device for delivery purposes only — it contains no personal information. Notifications are delivered through Expo Application Services (EAS), Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS), acting as processors for delivery. You can withdraw permission at any time in your device settings; deleting your account in the app disables all notifications to your devices immediately.

Biometric sign-in (Face ID / fingerprint). If you enable biometric sign-in, the biometric check happens entirely on your device, using your device's secure hardware. We never receive, store or have access to your biometric data — the device only tells the app whether the check succeeded.

Draft application data. While you fill in an application, the app saves a draft on your device, in the operating system's encrypted secure storage (Keychain on iOS, Keystore on Android), so your progress is not lost. The draft never leaves your device until you submit, and is deleted when the application is created or when you discard it.

Device data. When you register a device for notifications we store the platform (iOS/Android) and app version alongside the push token, to help us troubleshoot delivery. App-specific identifiers are removed when you delete your account.

Signing in with Google, Apple or Microsoft DRAFT

You can sign in or fill in your details with Google. If you do, the provider tells us your name, your email address, whether the provider has verified that address, and an identifier for your account at the provider. We ask for nothing else, we do not post anything on your accounts and we do not keep the provider's access tokens.

We use this data only to recognise you when you sign in and to create or protect your NIF Express account (performance of a contract, GDPR Art. 6(1)(b)). If an account with the same email address already exists, we never connect the provider without first sending a confirmation link to that address. You can disconnect a provider at any time in your portal, as long as another way to sign in remains. Each provider acts as an independent controller of the data it holds about you: see the privacy policies of Google, Apple and Microsoft.

Microsoft work and school accounts are not accepted, only personal Microsoft accounts.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email to active clients. The "Last updated" date at the top reflects the most recent revision.

12. Contact

BOCEAN IMMIGRATION PORTUGAL, LDA
Avenida da Liberdade, n.º 67B, 3.º B, 1250-140 Lisboa, Portugal
NIPC: 519043731
Email: [email protected]