GDPR — General Data Protection Regulation
Last updated: March 2025 · EMPTYTROUBLES - Sistemas de Informação Lda
1. Data controller
EMPTYTROUBLES - Sistemas de Informação Lda
EMPTYTROUBLES - Sistemas de Informação Lda, based in Portugal. DPO contact: empty.pt empty.pt
2. Legal basis for processing
- Contract performance — processing necessary to provide the WebCard service (Art. 6(1)(b))
- Legal obligation — retention of fiscal and accounting data (Art. 6(1)(c))
- Legitimate interests — platform security and fraud prevention (Art. 6(1)(f))
- Consent — marketing communications, where applicable (Art. 6(1)(a))
3. Your rights under GDPR
Access (Art. 15)
You can request a copy of your personal data that we process.
Rectification (Art. 16)
You can correct inaccurate or incomplete data.
Erasure (Art. 17)
You can request deletion of your data, subject to legal obligations.
Portability (Art. 20)
You can receive your data in a structured, machine-readable format.
Opposition (Art. 21)
You can object to processing based on legitimate interests.
Restriction (Art. 18)
You can request restriction of processing in certain circumstances.
4. International transfers
Data is stored on servers located in the European Union. When we use sub-processors outside the EU (e.g.: Stripe in the USA), we ensure adequate transfer mechanisms under GDPR (standard contractual clauses or adequacy decisions).
5. Exercising rights and complaints
To exercise any right, contact us at empty.pt. You also have the right to lodge a complaint with the CNPD — Comissão Nacional de Proteção de Dados. empty.pt. CNPD — Comissão Nacional de Proteção de Dados.