Privacy Policy — Centro Nacional de Exames

1. Who We Are

Centro Nacional de Exames operates at centronacionaldeexames.pt. We are the data controller for information collected through this website. For data protection queries, contact us at privacy@centronacionaldeexames.pt.

2. Data We Collect

Full name, email address, phone number, and nationality — provided when you make a booking.
NIF (Portuguese tax number) — optional, provided at your discretion.
Examination details — exam date, centre, and driving licence category.
Payment data — processed by Stripe. We do not receive or store full card numbers.
Usage data — IP address, browser type, pages visited, collected automatically via analytics.
Cookies — see our Cookie Policy for full details.

3. How We Use Your Data

To process and confirm your booking.
To match you with an appropriate translator.
To send booking confirmation and official documentation by email.
To handle customer service queries and complaints.
To comply with legal and tax obligations.
To improve the website through anonymised analytics.

4. Legal Basis for Processing

Contract performance — processing your booking requires handling your personal data.
Legal obligation — we may be required to retain certain records.
Legitimate interests — improving our service and preventing fraud.
Consent — where we ask for your explicit consent (e.g. marketing emails).

5. Data Retention

We retain booking data for up to 7 years to comply with Portuguese tax and accounting obligations. Anonymous analytics data may be retained indefinitely. You may request deletion of your data subject to legal retention requirements.

6. Data Sharing

Translators — we share your name, exam date, and examination centre with your assigned translator to fulfil the service.
Stripe — payment data is processed by Stripe, Inc. See stripe.com/privacy.
Analytics providers — anonymised usage data only.
We do not sell your personal data to third parties.

7. Your Rights

Right of access — request a copy of your personal data.
Right to rectification — correct inaccurate data.
Right to erasure — request deletion of your data (subject to legal obligations).
Right to restriction — limit how we process your data.
Right to portability — receive your data in a portable format.
Right to object — object to processing based on legitimate interests.
Right to complain — lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados) at cnpd.pt.

8. International Transfers

Your data may be processed outside the European Economic Area by providers such as Stripe (USA). Such transfers are made under appropriate safeguards including Standard Contractual Clauses approved by the European Commission.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or by a prominent notice on this website. The "Last Updated" date at the top of this page indicates when the policy was last revised.