Privacy policy

This policy explains how AIOBI processes the personal data collected on the aiobi.pt website, in its Portuguese and English versions, and in the newsletter subscribed to from it. The AIOBI Platform, at aiobi.ai, has its own privacy policy.

The controller of the personal data described in this policy is:

• AIOBI;
• address: Rua Mary Jane Wilson 21 3H, 9050-446 Funchal, Madeira, Portugal;
• email: info@aiobi.pt.

The identification details of the website provider are also in the Terms of use.

AIOBI has not appointed a data protection officer, because it is not required to: it is not a public authority or body, and its core activities do not consist of regular and systematic monitoring of people on a large scale or of large-scale processing of special categories of data (Article 37(1) GDPR). Questions about personal data go to the contact in section 2.

For any question about personal data, or to exercise the rights described in section 8, please email info@aiobi.pt with the subject "Personal data". You can also write to the address in section 1.

Each processing activity is described with its purpose, the data, the legal basis and the retention period. The retention periods are brought together in section 7.

AIOBI does not ask for special categories of data (for example, health data, racial or ethnic origin, religious or philosophical beliefs). Please do not include them in the forms or in the chat with the assistant.

AIOBI only sends marketing emails to people who have subscribed to the newsletter with their consent (section 3.8). The data from the contact and quote forms is not used for that purpose.

• Purpose: to reply to the message and pass it on to the right person in the team, according to the subject chosen.
• Data: name, email, subject, message and the fields shown for the chosen subject (organisation, severity of a support request, solution the feedback refers to, type of organisation and partnership model, media outlet, address of a news item), the page language and the date sent.
• Legal basis: AIOBI's legitimate interest in replying to those who contact it (Article 6(1)(f) GDPR). Where the message concerns an ongoing contract or a future proposal, steps prior to entering into a contract or performance of the contract (Article 6(1)(b) GDPR).
• Retention: 12 months from submission. If the message leads to a contract, the data is then processed as part of that relationship.
• How it works: the message is stored in the website's database and sent by email to info@aiobi.pt. The address given receives an automatic acknowledgement with the request number and without a copy of the message text. AIOBI replies within 48 working hours.

The form is protected against automated submissions by the website's own protections and, if you allow it, by Google reCAPTCHA (section 3.9). The draft message is kept only in your browser until you close the tab, and you can delete it with the "Delete draft" button (see the Cookie policy).

• Purpose: to prepare and send a proposal, and to contact the organisation about the request.
• Data: name, job title, organisation, tax number (optional), email, telephone (optional), message and the requested configuration (solution or service, sector, tier, number of users, size of the solution's value unit, current systems to migrate, extras, type of body and planned procurement procedure, term and payment method), the indicative amount shown, the page language and the date sent.
• Legal basis: steps taken at the data subject's request prior to entering into a contract (Article 6(1)(b) GDPR). For this reason, the form does not ask for consent: the notice next to the submit button refers to this section.
• Retention: 24 months from submission, if the request does not lead to a contract. If it does, the data is then processed as part of that relationship, with the applicable legal retention periods (for example, those for invoicing).
• How it works: the request is stored in the website's database and sent by email to info@aiobi.pt. The address given receives a confirmation email. If sending the email fails, the request is kept and handled in the same way.

The request may arrive with a configuration already prepared by the price calculator or by the website's assistant: that configuration contains no personal data, and it is the visitor who reviews, completes and sends it. The form has the same protections against automated submissions as the contact form (section 3.9). The draft request is kept only in your browser until you close the tab, and you can delete it with the "Delete draft" button (see the Cookie policy).

• How to apply: by email to info@aiobi.pt with the subject "Speculative application". The website does not store applications or files.
• Purpose: to assess the application for current or future vacancies.
• Data: whatever the applicant decides to send (for example, name, contact details, CV and cover letter). Please do not send data that is not needed to assess the application, or special categories of data.
• Legal basis: steps taken at the data subject's request prior to entering into a contract (Article 6(1)(b) GDPR), together with the Portuguese Labour Code rules on the protection of job applicants' data (Article 17).
• Retention: 12 months from receipt. After that, the application is deleted, unless a recruitment process in which you are taking part is ongoing or you authorise a longer period in writing.

The website has an artificial intelligence assistant that answers questions about AIOBI, its solutions, services and prices. The assistant identifies itself as an AI system before the first message and is not a person (Article 50(1) of Regulation (EU) 2024/1689 on artificial intelligence). Answers appear as they are written, without changing the processing described in this section.

• Purpose: to answer questions, open pages and demos, calculate prices with the website's calculator, prepare a quote request that the visitor reviews and sends, and improve the service.
• Data: the messages written, the answers, the page and language of the conversation, the actions requested from the assistant and the date and time. The stored conversation does not include the IP address.
• What not to write: the assistant does not ask for contact details or sensitive data. To request a quote, please use the form. If you write an email address, a telephone number, a tax number or an IBAN, these are automatically replaced with a placeholder before the message is sent to the AI model provider and before the conversation is stored.
• Legal basis: AIOBI's legitimate interest in answering those who use the assistant and in improving the answers (Article 6(1)(f) GDPR). You may object at any time (section 8).
• Retention: conversations are kept on the website's server for 30 days from the last message and are then deleted automatically. A weekly internal report lists the questions the assistant could not answer, without contact details or IP addresses, to improve the website's content.
• Message limit: to limit the number of messages per visitor per day, the server calculates a code from the IP address and the date with a secret key. The code is pseudonymised data: it does not show the address, is not linked to the conversation and is deleted the following day.
• History in the browser: if you allow the "Functional" category (see the Cookie policy), your browser also keeps the history of your latest conversations, for up to 30 days per conversation. Without that permission, the conversation stays only on the open page.
• Deleting: the "Delete conversation" button removes the conversation from the browser and the server immediately. Without the history in the browser, the button is only available while the conversation is open: once you leave the website or reload the page, AIOBI can no longer link the conversation to you, and it is deleted automatically at the end of the period (Article 11 GDPR).
• AI model provider: messages are sent to an AI model provider, which acts as AIOBI's processor and processes them only to generate the answer. Under the provider's terms (checked on 28/09/2026), data sent through the programming interface is not used to train its models and is kept in abuse monitoring logs for up to 30 days, unless a longer period is required by law. The place of processing is in section 6.
• No decisions: the assistant's answers are not decisions about the visitor. Prices always come from the website's calculator, and the proposal is prepared by the AIOBI team.

When you open the main address (aiobi.pt) without having chosen a language, the server decides whether to show the website in Portuguese or English. To do so, it uses, in this order: the language you chose before, if stored in the language cookie; the country the IP address belongs to (Portugal, Portuguese-speaking African countries, Brazil or Timor-Leste); the browser language.

• How it works: the IP address is compared, on the server itself, with a list of address ranges for those countries. This function does not send the IP address to anyone and does not store it. The request is recorded, like all others, in the technical logs (section 3.6).
• Purpose: to show the website in the visitor's most likely language.
• Legal basis: AIOBI's legitimate interest in presenting the website in a language the visitor understands (Article 6(1)(f) GDPR). You can change the language on any page, and your choice prevails.
• Source of the list: the list is generated from the IP to Country Lite database by DB-IP, under the Creative Commons Attribution 4.0 International licence: IP Geolocation by DB-IP (opens another website).

• Purpose: to protect the website against abuse and attacks, and to diagnose errors.
• Data: in the server's technical logs, the IP address, the date and time, the address requested, the response code and the browser identification. The application logs do not store the content of messages or contact details.
• Form protection: the forms use the website's own protections against automated submissions (a hidden field, a minimum time to fill in and a limit on submissions from the same IP address). For the limit, the server uses a code calculated from the address, only in the server's memory and for a maximum of 24 hours, without attaching it to the message. If you allow it, the forms also use Google reCAPTCHA (section 3.9).
• Legal basis: AIOBI's legitimate interest in the security of the website and the service (Article 6(1)(f) and Article 32 GDPR).
• Retention: 14 days for technical logs; 24 hours for submission limits.

The news pages show summaries and analysis generated automatically by artificial intelligence from news published by identified sources, with a link to the original. Each news item has its own page, and both the card and the page state that the text was generated by AI (Article 50(4) of Regulation (EU) 2024/1689).

• Purpose: to provide information on artificial intelligence, data, cybersecurity and digital transformation.
• Data: the texts may mention people named in the original news, with the data given there (for example, name and position). The source is the published news item, shown on each news item.
• Legal basis: AIOBI's legitimate interest in informing the public on matters of general interest (Article 6(1)(f) GDPR), balanced against freedom of expression and information (Article 85 GDPR and Article 24 of Portuguese Law 58/2019). This policy informs the people mentioned (Article 14(5)(b) GDPR).
• Retention: 30 days on the website. The internal record of publication decisions is deleted after 12 months.
• How it works: to generate the texts, the text of the news (from the source's feed or, when a news item is redone, from the original page, which is not stored) is sent to the AI model provider (section 5). No visitor data is used.
• Removal request: anyone can ask for a news item to be removed by emailing info@aiobi.pt with the address of the news item and the reason. Each news item has a "Request removal" link that prepares this email. The request is reviewed by a person in the AIOBI team, who replies within 48 working hours. While reviewing the request, AIOBI may take the news item down as a precaution. You may also object to the processing of your data (section 8).

• Purpose: to send AIOBI's newsletter by email, with news about AIOBI's solutions, services and activity.
• Data: the email address and the consent record (date and time, version of the text accepted, language and page on which you subscribed). Your name is not requested.
• Legal basis: your consent (Article 6(1)(a) GDPR and Article 13-A of Portuguese Law 41/2004), given by ticking the box, which is never pre-ticked, next to the subscription field.
• Unsubscribing: every newsletter has a link to unsubscribe, which works immediately. You can also ask to unsubscribe by emailing info@aiobi.pt. Unsubscribing does not affect processing carried out before.
• How it works: the subscriber list is managed by AIOBI's own system, hosted on the same server as the website, and the newsletter is sent through the email provider (section 5). The newsletter does not use tracking pixels or links that identify who opens or clicks. The form is protected as described in section 3.9.
• Retention: while the subscription is active. After you unsubscribe, the email stops receiving the newsletter immediately, and the record of the subscription and the unsubscription is kept for 3 years, only to demonstrate consent and unsubscription in the event of a complaint, and then deleted.

• When: only if you allow the "Form protection" category in the cookie notice or in "Cookie preferences", and only when you start filling in the contact, quote or newsletter form. Without permission, the forms still work, with the website's own protections (section 3.6).
• Purpose: to tell people apart from automated submissions and protect the forms against abuse.
• Data: the IP address and device and browser information (for example, configuration, interaction with the page and Google cookies), collected by Google reCAPTCHA. AIOBI only receives the result of the check, does not store it and does not send the IP address to Google from the website's server.
• Legal basis: your consent (Article 6(1)(a) GDPR and Article 5 of Portuguese Law 41/2004). You can withdraw it at any time in "Cookie preferences", with effect from the next page.
• Who processes it: Google, as AIOBI's processor, with possible processing in the United States of America (section 6). Google's Privacy Policy (opens another website) and Terms of Service (opens another website) also apply.
• Retention: AIOBI keeps no reCAPTCHA data. Google's cookies are listed in the Cookie policy.

• When: the Google Maps map only loads if you allow the "Maps" category or if you select "View on the map". Until then, the page shows a picture of the location stored on the website itself, and no data is sent.
• What happens: when the map loads, your browser connects to Google's servers, and Google receives the IP address and the referring page and may store its own cookies.
• Legal basis: your consent, given by allowing the category or by selecting the button (Article 6(1)(a) GDPR and Article 5 of Portuguese Law 41/2004). The click applies to that view only.
• Who processes it: AIOBI only decides to include the map on the page. What Google does with the data is decided by Google, as controller, under Google's Privacy Policy (opens another website), with possible processing in the United States of America.
• Retention: AIOBI keeps no map data.

The website only stores in your browser what it needs to work (for example, the language, the theme, form drafts and your cookie choices). Only with your consent does it also keep the history of conversations with the assistant, recent searches, the last subject chosen in the contact form and the subtitle options for the videos ("Functional"), load Google reCAPTCHA ("Form protection") and load the Google Maps map ("Maps"). It does not use analytics, advertising or social media cookies. The full inventory, with retention periods, is in the Cookie policy.

AIOBI does not sell personal data and does not share it for advertising purposes. The data may be processed on AIOBI's behalf and on its instructions by the following categories of processors, under a contract that complies with Article 28 GDPR:

With the map on the contact page (section 3.10), Google receives data as a controller, not on AIOBI's behalf. You can ask for the identity of each processor through the contact in section 2. The data may also be disclosed to public authorities where the law requires it.

Where a processor handles data outside the European Economic Area, the transfer only takes place with one of the safeguards provided for in the GDPR:

• an adequacy decision of the European Commission (Article 45 GDPR), such as the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), for certified recipients; or
• standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR and Commission Implementing Decision (EU) 2021/914).

Situation by recipient:

• Hosting: the server is in France, in the European Union, and the provider is established in the European Union. If the provider accesses the data from outside the European Economic Area (for example, for technical support), it may only do so with one of the safeguards above, under its data processing agreement.
• Email: the provider may process the data in its data centres outside the European Union, including in the United States of America, on the basis of the EU-US Data Privacy Framework (the provider's group is certified) and the standard contractual clauses in its data processing agreement.
• AI models: the provider is established in Ireland and processes the data in the United States of America, through entities of the same group and sub-processors, on the basis of standard contractual clauses included in its data processing agreement.
• Google reCAPTCHA: Google may process the data in the United States of America, on the basis of the EU-US Data Privacy Framework (Google LLC is certified) and the standard contractual clauses in its data processing agreement.

You can ask for more information about these safeguards, or a copy of them, through the contact in section 2.

The same periods apply to the copies received by email at info@aiobi.pt. At the end of each period, the data is deleted. AIOBI may only keep it for longer where the law requires it, or to establish, exercise or defend a legal claim in a specific case, and only for as long as necessary.

Under Articles 15 to 22 GDPR, you have the right to:

• know whether AIOBI processes your data and obtain a copy (access), including the identity of the recipients;
• correct inaccurate or incomplete data (rectification);
• ask for the data to be deleted (erasure);
• ask for processing to be restricted;
• receive the data you provided in a structured, commonly used format, or ask for it to be sent to another organisation (portability), for processing based on consent or a contract (sections 3.2, 3.8, 3.9 and 3.10);
• object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (sections 3.1, 3.4, 3.5, 3.6 and 3.7);
• withdraw consent at any time, without affecting processing already carried out: for the newsletter, with the unsubscribe link; for reCAPTCHA and the map, in "Cookie preferences".

How to exercise them: email info@aiobi.pt with the subject "Personal data", stating the right you wish to exercise. The request is free of charge. AIOBI replies within one month, which may be extended by two further months for complex or numerous requests, with notice within the first month (Article 12(3) GDPR). If there are reasonable doubts about your identity, AIOBI may ask for the information strictly needed to confirm it.

In the assistant, the "Delete conversation" button immediately deletes the open conversation, in the browser and on the server (section 3.4). For recent searches, the "Clear" button deletes them from this browser.

If you consider that the processing of your data breaches the law, you have the right to lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD):

• Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal;
• telephone: +351 213 928 400;
• email: geral@cnpd.pt;
• website: www.cnpd.pt (opens another website), "Apresentar queixa" (lodge a complaint) section.

You may also complain to the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place (Article 77 GDPR).

AIOBI does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The suggested tier and the calculator's indicative amount result from applying the published price table to the chosen configuration; they are not decisions about the person. Proposals are prepared by the AIOBI team.

The website is intended for organisations and professionals, not for children. Newsletter subscription and permissions in the cookie notice may only be given by people aged at least 13 (Article 8 GDPR and Article 16 of Portuguese Law 58/2019).

AIOBI applies technical and organisational measures appropriate to the risk (Article 32 GDPR), including: encrypted communication (HTTPS); server access restricted to authorised people; application logs without message content or contact details; form data and assistant conversations in separate databases; and automatic deletion at the end of each period.

The date of the last update and the version are shown at the top of the page. If a change alters the way data is processed, AIOBI gives notice on the website and, where the change concerns processing that depends on consent, asks for that consent again.