1 · Who We Are & Data Controller
WebPies ("we", "us", "our") is an independent design and software engineering studio operated by Vance & Okafor Lda., a Portuguese company registered at 14 Rua das Janelas Verdes, 1200-690 Lisboa, Portugal.
We act as the data controller under the General Data Protection Regulation (EU GDPR) and the Portuguese Data Protection Act (Law 58/2019) for personal data processed through webpies.com and our software licensing services.
2 · Categories of Personal Data We Collect
We collect only what is strictly necessary to run our studio, deliver digital licenses, and process orders:
- Account & Checkout Data: Your name, email address, billing address, business name, and VAT/tax number.
- Payment Identifiers: Processed securely via Stripe, Paddle, or SSLCommerz. We never view or store complete credit card details.
- Licensing Telemetry: When activating a software license, our server logs the authorized client domain name, WordPress version, PHP version, and activation timestamp.
- Communications: Support tickets, emails, and briefs submitted through our contact forms.
- Privacy-Friendly Analytics: Cookieless, anonymized traffic counts hosted in the EU without persistent fingerprinting.
3 · Legal Bases for Processing
Under GDPR Article 6, we process your personal information under the following lawful bases:
- Performance of a Contract (Art. 6(1)(b)): To generate software licenses, authenticate account dashboards, and deliver client studio services.
- Legal Obligation (Art. 6(1)(c)): To maintain corporate accounting books and tax invoices for the statutory 10-year period under Portuguese commercial law.
- Legitimate Interests (Art. 6(1)(f)): To maintain application security, mitigate fraudulent payment disputes, and defend software copyright against unauthorized redistribution.
- Consent (Art. 6(1)(a)): For optional marketing updates, which feature double-opt-in confirmation and one-click unsubscription at any time.
4 · Third-Party Data Processors
We share data exclusively with trusted technical sub-processors under signed Data Processing Agreements (DPAs):
- Stripe & Paddle: PCI-DSS compliant checkout and sales tax settlement.
- Cloudflare: Global CDN, TLS termination, and DDoS defense.
- Transactional Email Services: Secure dispatch of order receipts, password resets, and license tokens.
- Chartered Portuguese Accountants: Mandatory statutory filing of fiscal invoices.
We do not sell, lease, or syndicate your personal data to ad networks, broker marketplaces, or data mining firms under any circumstances.
5 · Cookies & Client-Side Local Storage
We employ only strictly necessary session cookies and client-side browser storage essential for core functionality:
webpies_session&XSRF-TOKEN— Authenticate your login and safeguard POST requests against cross-site attacks.nx_cart— Preserves your shopping cart items in local storage without unneeded server queries.- Theme & Locale Cookies — Stores your dark/light preference and active language.
For a complete breakdown of cookie lifetimes and technical attributes, please review our detailed Cookie Policy.
6 · Data Retention Schedule
We keep your personal information only as long as necessary for business, legal, and operational purposes:
- Account Profiles: Maintained until you request deletion, after which accounts are permanently purged within 30 days.
- Order & Fiscal Invoices: Retained for 10 years in compliance with Portuguese commercial and tax law.
- License Activation Logs: Maintained for the duration of the active license plus 12 months for warranty support.
- Contact Form Inquiries: Stored for up to 24 months, then automatically purged.
7 · Your GDPR & Privacy Rights
Under the GDPR, you enjoy the following enforceable statutory rights:
- Right of Access (Art. 15): Obtain confirmation and copies of personal data we hold.
- Right to Rectification (Art. 16): Update inaccurate or incomplete records directly via your account.
- Right to Erasure (Art. 17): Request deletion ("Right to be Forgotten") where retention is not mandated by tax laws.
- Right to Data Portability (Art. 20): Receive your purchase and account history in an accessible JSON/CSV format.
- Right to Object & Restrict (Art. 18 & 21): Object to processing based on legitimate interests.
- Supervisory Complaint: You may lodge a complaint with the Portuguese Data Protection Commission (CNPD — Comissão Nacional de Proteção de Dados, cnpd.pt) or your local EU authority.
To exercise your rights, email [email protected]. We fulfill requests within 30 calendar days.
8 · Technical & Organizational Security Measures
We implement defense-in-depth technical safeguards to protect client data:
- All network communication is strictly enforced with TLS 1.3 encryption and HSTS headers.
- User passwords are encrypted with salted
bcrypt(work factor 12). - Production databases are stored in encrypted European data centers and backed up daily.
- Strict access controls and multi-factor authentication (MFA) govern administrative credentials.
- In the unlikely event of a personal data breach, we will notify affected users and supervisory authorities within 72 hours under GDPR Article 33.
9 · Protection of Children's Privacy
Our software products, developer tools, and studio services are intended exclusively for professional founders, developers, and commercial entities. We do not knowingly solicit or collect personal data from anyone under 16 years of age. If you believe a minor has submitted personal information, please inform us immediately for prompt deletion.
10 · International Data Transfers
The majority of our hosting infrastructure and sub-processors reside within the European Economic Area (EEA). When data is processed outside the EEA (such as US-based credit card verification via Stripe or Paddle), transfers are protected by European Commission Standard Contractual Clauses (SCCs) and adherence to the EU-US Data Privacy Framework.
11 · Revisions & Policy Updates
We may update this Privacy Policy from time to time to reflect evolving technical standards, new product features, or regulatory requirements. For material changes, we will alert registered account holders by email and display a prominent notice across our platform for 30 calendar days before modifications take effect.
12 · Data Protection Contact & Inquiries
For data inquiries, access requests, or privacy clarifications, contact our data protection team:
- Email: [email protected]
- Postal Address: Vance & Okafor Lda., Rua das Janelas Verdes 14, 1200-690 Lisboa, Portugal
- Average Response Time: ~6 to 24 business hours.