Privacy Policy

1.1. The data controller responsible for the personal data collected through the Euro Duty platform is the entity that manages and operates said platform.

1.2. Euro Duty is an independent digital platform of an informative and educational nature about European labor and tax legislation.

1.3. For any questions related to personal data protection, data subjects can contact us through the channels provided on the platform.

2.1. This Privacy Policy has been prepared in compliance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation - GDPR);

• Law No. 58/2019, of August 8 (GDPR Implementation Law in Portugal);

• Law No. 41/2004, of August 18 (Electronic Communications Law);

• Directive 2002/58/EC (ePrivacy Directive).

2.2. Euro Duty undertakes to respect the fundamental principles of the GDPR: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality and accountability.

3.1. Euro Duty may collect the following categories of personal data:

TECHNICAL DATA (collected automatically):

• IP address and approximate geographic location;

• Device type, operating system and browser;

• Pages visited, time spent and navigation patterns;

• Cookie identifiers and session tokens.

USAGE DATA (entered by the user):

• Data entered into tax simulators and calculators (salaries, family situation, country of residence);

• Language and country preferences;

• Conversation history with the AI Assistant;

• Contact data (if voluntarily provided).

3.2. We DO NOT collect sensitive data under Article 9 of the GDPR (racial or ethnic origin, political opinions, religious beliefs, health data, sexual orientation, biometric or genetic data).

4.1. Personal data is processed for the following purposes:

PRIMARY PURPOSES:

• Provide platform services (simulators, calculators, AI assistant);

• Process the tax and labor calculations requested by the user;

• Personalize the user experience (language, preferred country);

• Answer questions through the AI Assistant.

SECONDARY PURPOSES:

• Improve and optimize the platform based on usage analyses;

• Ensure security and prevent fraud or abuse;

• Comply with applicable legal obligations;

• Conduct aggregated and anonymized statistical analyses.

4.2. Data is not sold to third parties and is not used to create commercial profiles. If you subscribe to the newsletter, your email address is used to send it to you (see section 19).

5.1. The processing of personal data by Euro Duty is based on the following legal bases provided for in Article 6 of the GDPR:

CONSENT (Art. 6(1)(a)):

• Use of non-essential cookies;

• Sending promotional communications (if applicable);

• Data processing in the AI Assistant.

CONTRACT PERFORMANCE (Art. 6(1)(b)):

• Provision of services requested by the user;

• Processing of simulations and calculations.

LEGITIMATE INTEREST (Art. 6(1)(f)):

• Continuous improvement of the platform;

• Security and fraud prevention;

• Anonymized statistical analyses.

LEGAL OBLIGATION (Art. 6(1)(c)):

• Compliance with applicable legal obligations.

5.2. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

6.1. Personal data is retained only for the period strictly necessary for the purposes for which it was collected:

• Session and browsing data: up to 12 months;

• Analytics cookies: as defined in the cookie policy (max. 24 months);

• AI Assistant history: stored locally in the user's browser;

• Contact data: until response to the request or 36 months after last contact;

• Data for legal compliance: according to applicable legal periods.

6.2. After the end of the retention period, data is securely deleted or irreversibly anonymized.

6.3. Data entered into the simulators is processed in real time and is NOT permanently stored on our servers.

7.1. Euro Duty does NOT sell, rent or trade personal data to third parties.

7.2. Data may be shared with:

• Hosting and infrastructure service providers (subcontractors);

• Analytics service providers (e.g., Google Analytics, with IP anonymization);

• AI service providers (for Assistant processing);

• Competent authorities, when legally required.

7.3. All subcontractors are bound by data processing agreements (DPA) in compliance with Article 28 of the GDPR.

7.4. INTERNATIONAL TRANSFERS: Some service providers may be located outside the EEA. In these cases, we ensure that adequate safeguards are in place:

• European Commission adequacy decisions;

• Standard Contractual Clauses approved by the Commission;

• Certification under the EU-US Data Privacy Framework.

8.1. Euro Duty uses cookies and similar technologies to improve the user experience.

8.2. TYPES OF COOKIES USED:

STRICTLY NECESSARY COOKIES:

• Basic platform functionality;

• Session and language preferences;

• Security and authentication.

PERFORMANCE AND ANALYTICS COOKIES:

• Google Analytics (with IP anonymization);

• Usage and aggregated behavior analysis.

FUNCTIONALITY COOKIES:

• Experience personalization;

• Memorization of user preferences.

8.3. The user can manage cookie preferences through:

• Their browser settings;

• The cookie consent banner (when available).

8.4. Disabling essential cookies may affect platform functionality.

8.5. ADVERTISING COOKIES:

Third parties, including Google, use cookies to serve ads based on a user's prior visits to our website. Through the use of advertising cookies, Google and its partners may serve ads to users based on their visits to this and/or other sites on the Internet. Users can opt out of personalized advertising by visiting Google Ads Settings.

9.1. Under the GDPR, data subjects have the following rights:

RIGHT OF ACCESS (Art. 15): Obtain confirmation as to whether your data is being processed and access a copy thereof.

RIGHT TO RECTIFICATION (Art. 16): Request correction of inaccurate or incomplete data.

RIGHT TO ERASURE (Art. 17): Request deletion of personal data ('right to be forgotten').

RIGHT TO RESTRICTION (Art. 18): Restrict processing of data in certain circumstances.

RIGHT TO PORTABILITY (Art. 20): Receive data in a structured, machine-readable format.

RIGHT TO OBJECT (Art. 21): Object to processing based on legitimate interest or direct marketing.

RIGHT TO WITHDRAW CONSENT: Withdraw consent at any time, without affecting the lawfulness of prior processing.

9.2. To exercise any of these rights, contact us through the channels provided. We will respond within a maximum of 30 days.

10.1. Euro Duty implements appropriate technical and organizational measures to ensure the security of personal data:

TECHNICAL MEASURES:

• Data encryption in transit (HTTPS/TLS);

• Data encryption at rest;

• Firewalls and intrusion detection systems;

• Regular backups and recovery plans;

• Role-based access control.

ORGANIZATIONAL MEASURES:

• Employee training in data protection;

• Internal information security policies;

• Regular risk assessments;

• Incident response procedures.

10.2. In case of a data breach with risk to the rights of data subjects, we will notify the supervisory authority within 72 hours and, where applicable, the affected data subjects.

11.1. The Euro Duty platform is not intended for minors under 16 years of age.

11.2. We do not intentionally collect personal data from minors under 16.

11.3. If we become aware that we have collected data from a minor without valid parental consent, we will delete that information immediately.

11.4. Parents or legal guardians who believe their child has provided personal data should contact us to request deletion.

12.1. Euro Duty's AI Assistant uses automated processing to generate responses to user questions.

12.2. This processing does NOT constitute 'automated decision-making' under Article 22 of the GDPR, since:

• It does not produce legal effects on the user;

• It does not similarly significantly affect the user;

• The responses are merely informative and non-binding.

12.3. We do not carry out 'profiling' for marketing purposes or price discrimination.

12.4. Tax calculations are simulations based on parameters entered by the user and public legislation, without legal impact.

13.1. If you consider that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority.

13.2. In Portugal, the supervisory authority is:

NATIONAL DATA PROTECTION COMMISSION (CNPD)

Av. D. Carlos I, 134 - 1st floor

1200-651 Lisbon, Portugal

Tel: (+351) 213 928 400

Email: geral@cnpd.pt

Website: www.cnpd.pt

13.3. Residents of other EU Member States may lodge a complaint with the data protection authority in their country of residence.

13.4. Before filing a complaint, we encourage direct contact with us to try to resolve the matter amicably.

14.1. Euro Duty reserves the right to update this Privacy Policy at any time.

14.2. Changes will be published on this page, with an indication of the date of the last update.

14.3. In case of significant changes that affect users' rights, we may notify through a notice on the platform.

14.4. Continued use of the platform after the publication of changes constitutes acceptance of the new policy.

14.5. We recommend periodically consulting this page to stay informed about our privacy practices.

15.1. For questions related to personal data protection, including the exercise of your rights, you can contact us through:

• The contact channels provided on the platform;

• The contact form (when available).

15.2. We undertake to respond to all requests related to data protection within a maximum of 30 days, as provided for in the GDPR.

15.3. In cases of complexity or high volume of requests, the period may be extended by a further 60 days, upon informing the data subject.

15.4. You can also write to us at contact@euroduty.eu.

This website uses Google Analytics (G-H7CXPCMRRZ) to monitor website traffic and user behavior on an anonymous basis. This helps us improve our services. By accepting our cookie banner, you consent to this data collection.

EuroDuty uses TikTok to publish informative, educational and promotional content related to the domains euroduty.eu and euroduty.com. This content includes explanatory videos about topics covered on the site.

INTERACTION WITH TIKTOK CONTENT:

When the user views or interacts with EuroDuty videos on TikTok, the TikTok platform may collect usage data and metrics, in accordance with its own Privacy Policy. EuroDuty does not receive or control this data.

LINKING TIKTOK ACCOUNT TO EURODUTY (API):

EuroDuty allows users to link their TikTok account to the site to publish videos directly to their TikTok account. This link is optional and only occurs when the user explicitly authorizes it through the official TikTok API.

When the user authorizes this link, EuroDuty may receive:

• Access token provided by TikTok

• TikTok account identifier

• Permissions related to video upload and publishing

• Basic profile information (only if authorized)

EuroDuty does not receive private messages, contacts, advanced statistics or any unauthorized data.

PURPOSE OF TIKTOK DATA USE:

Data provided by TikTok is used exclusively to:

• Publish videos created on EuroDuty directly to the user's TikTok account

• Manage authentication and keep the link active as long as the user authorizes it

EuroDuty does not sell or share this data with advertisers and does not use it for behavioral profiling or marketing analysis. EuroDuty does display Google ads, and those ads may use cookies as described in the advertising section of this Policy.

COOKIES AND TIKTOK PIXEL:

If EuroDuty uses the TikTok Pixel to measure campaign performance, this use will be indicated in this Policy. Currently, EuroDuty does not use the TikTok Pixel.

STORAGE AND SECURITY:

Data from TikTok is stored securely and encrypted. EuroDuty does not share, sell or transfer this data to third parties.

REVOCATION AND DELETION:

The user can revoke EuroDuty's access to their TikTok account at any time in TikTok settings. When access is revoked:

• The token becomes invalid

• The link is deactivated

• Associated data is deleted within a reasonable timeframe

TIKTOK PRIVACY POLICY:

For more information about how TikTok handles data, the user should consult the official TikTok Privacy Policy.