This Privacy and Data Protection Policy governs the matter of personal data and its protection in relation to the use of the website https://www.nif4erasmus.com/ and its embedded forms.

The Portuguese National Law on the Protection of Personal Data (Law no. 58/2019, of August 8) and the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, hereinafter referred to as the “GDPR” or “Regulation”) ensure the protection of natural persons with regard to the processing of personal data and the free movement of such data.

In legal terms, Personal Data refers to any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifiers, or one or more specific elements of that natural person’s physical, physiological, genetic, mental, economic, cultural, or social identity.

This document complies with the applicable legislation on Personal Data protection. However, it may be supplemented by additional procedures on Data Protection, as defined and made public by NIF4Erasmus.

This Policy is intended to serve as guidance whenever questions arise concerning the processing of Personal Data in the various contexts in which users may be involved.

Accordingly, this Policy is addressed to all those who wish to understand how NIF4Erasmus processes and protects the Personal Data of its Data Subjects.

During the data collection process, only the data strictly necessary to fulfill the informed purpose, or purposes closely related thereto, will be requested, always based on the lawful grounds explained to the Data Subject.

1. Controller Identification

The responsible for the processing of personal data is NIF4Erasmus, composed of lawyers registered with the Portuguese Bar Association. NIF4Erasmus provides services to students participating in exchange programs who are coming to Portugal to study, among other related activities.

NIF4Erasmus seeks to apply best market practices regarding data protection and information security.

Likewise, it aims to adopt the necessary and appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of the Personal Data for which it is the Data Controller.

Without prejudice to the above, the applicable legislation shall prevail over this Policy if it exceeds its standards, imposes stricter requirements, or ultimately provides a higher level of protection.

In cases where this Policy offers a higher level of protection than the applicable law, or additional safeguards and rights for Data Subjects, this Policy shall take precedence.

2. Purposes of Personal Data Processing

Personal Data may only be processed for specific purposes, or other purposes closely related to them, that were communicated to the Data Subject at the time the data was originally collected. These purposes include:

NIF4Erasmus collects and processes personal data for the purpose of managing:

• Registration for its services: full name, identification document, mobile phone number, email, address, amount charged, IBAN (if applicable), nationality, date of birth, gender, proof of address, affiliation with a NIF4Erasmus Partner, data and documentation required for registration, online consent;
• Treasury management: name, identification document number, identification document, phone number, email, address, amount paid, date and time of payment, IBAN (if applicable), data and documentation required for registration and/or services requested by the user;
• Management and follow-up of the applicant in case of default or payment difficulty: name, phone number, email, address, amount charged, date of payment; IBAN (if applicable), data and documentation required for registration;
• Management of potential refunds: name, nationality, address, email, phone number, IBAN, amount charged, date of payment;
• Record of consent acquisition and respective proof of online consent: name, email, consent response, other variable data depending on the requested consent and its purpose;

NIF4Erasmus collects and processes personal data for the management of:

• Internal/external communication regarding the applicant’s matters or matters within the overall context of the services provided by NIF4Erasmus, via email, phone call, SMS, digital communication apps such as, but not limited to, WhatsApp, or postal mail: name, nationality, email, address, phone number, and other communication methods that may be indicated by the Data Subject;

For objectives and purposes related to NIF4Erasmus own advertising and marketing activities, the following data may be retained: nationality, age, gender.

3. Limits

Under no circumstances will Personal Data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health or sexual life, or genetic or biometric data be directly requested, except when, at the time of such request, the Data Subject freely and expressly gives their informed consent.

4. Legal Basis

The legal basis for this processing of Personal Data is as follows:

On the consent provided by the Data Subjects, for a variety of purposes, given freely, expressly, and substantiated through a clear and unambiguous affirmative act, in accordance with Article 6(1)(a) and Article 7 of the GDPR.

Even so, if requested, we will strive to ensure that the process of withdrawing consent is as simple as the process of giving it, should the Data Subject wish to do so. Instructions on how to proceed can be found in this Policy.

In cases where the Data Subject needs to provide Personal Data of third parties, they guarantee that they are legally authorized to do so, that they have informed the data subject about the processing of their data, and that they undertake to provide them with this Privacy Policy and any other applicable or future policies or terms related to the data and documents provided. In such cases, the Data Subject shall be solely responsible for complying with these obligations and with the applicable duty to inform.

5. Personal Data Retention Period

The retention period for personal data is that which is established by legal or regulatory provisions or, in their absence, the period necessary to fulfil the intended purpose.

With regard to personal data that NIF4Erasmus needs in order to demonstrate compliance with contractual or other obligations, such data may be retained until the applicable statute of limitations has expired.

6. Recipients of Personal Data

If necessary, NIF4Erasmus may engage companies and/or professionals to provide services such as cloud storage, email management, systems management and IT security, website development and maintenance, network security, health and safety, among others.

Additionally, NIF4Erasmus may use payment systems (such as Stripe, for example, but not limited to), artificial intelligence tools, external forms, and similar solutions, which may be integrated both into its website and its own forms.

Likewise, NIF4Erasmus may share data with entities that have legal authority to process the data in question, when such sharing is legally applicable.

7. Principles

Users are hereby informed that NIF4Erasmus collects the documents and personal data necessary for the provision of its services, ensuring that such data is appropriate, relevant, and not excessive, and limited to what is necessary in relation to the purposes for which it is processed.

To ensure that the data remains valid, current, accurate, and up to date, we kindly ask users to notify us of any changes or modifications that may have occurred.

8. Exercise of Rights

1. Right to Information: to be informed, prior to the processing of Personal Data, about aspects related to its processing, and to request additional information at any time regarding the use of their Personal Data;

2. Right of Access: to obtain confirmation as to whether or not their Personal Data is being processed, and to access the Personal Data they have provided to NIF4Erasmus and that is held by the organization at the time the right of access is exercised;

3. Right to Data Portability: to request the transfer of the Personal Data they provided to NIF4Erasmus, if technically feasible;

4. Right to Rectification: to request the correction or update of their Personal Data;

5. Right to Erasure: to request the deletion of their Personal Data, when permitted by law or contract;

6. Right to Restriction: to request a limitation on how NIF4Erasmus uses their Personal Data, including the correction or clarification of any doubts regarding its content or processing;

7. Right to Object: to object to the continued processing of their data;

8. Right not to be subject to automated individual decision-making;

9. Right to lodge a complaint with the competent supervisory authority: the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD).

• The email address info@nif4erasmus.com, with the subject line "EXERCISE OF RIGHTS";
• Your request must include the date, full name, mobile phone contact and applicable email address, and a clear description of the specific request;
• We will process your request within one month and notify you via the email address you provided.

9. Processing of Personal Data of Minors

In accordance with Article 8 of the GDPR and Article 16 of the Portuguese National Law on the Protection of Personal Data (Law no. 58/2019, of 8 August), the personal data of minors may only be processed based on consent in relation to the direct offering of information society services if they are at least 13 years old.

If the minor is under the age of 13, the processing is only lawful if consent is given by their legal representatives.

10. Data Processing Security

Personal data is processed with the level of protection legally required to ensure its security and to prevent alteration, loss, unauthorized processing or access, taking into account the state of the art, the cost of implementation, the nature, scope, context, and purpose of the processing, as well as the varying likelihood and severity of risks to the rights of natural persons.

All information, data, and documents are protected by professional secrecy, in accordance with Article 92 of the Statute of the Portuguese Bar Association (Law no. 145/2015, of 9 September).

11. Amendments and Modifications to the Privacy and Data Protection Policy

NIF4Erasmus may modify this Privacy and Data Protection Policy at any time.

Updates will be made as appropriate, in response to legislative changes and business needs, in order to keep the data subject informed. Therefore, we recommend consulting this Policy regularly if you wish to stay informed about how your data is processed.

12. General Terms and Conditions of Website Use

It is recommended for the user to consult the Website’s Terms and Conditions of Use.

13. Forms

It is recommended that the user consult the Annexes attached to this document, as they form an integral part of the Privacy and Data Protection Policy.

14. Applicable Law

This Privacy and Data Protection Policy shall be governed by and interpreted in accordance with Portuguese law.

15. Other Provisions

If any provision of this Privacy and Data Protection Policy is deemed invalid, it shall be considered null and void, without affecting the validity and effectiveness of the remaining provisions, which shall remain fully in force.

The user may contact us regarding any matter related to this Privacy and Data Protection Policy or any issue concerning the use of the website or their data by emailing info@nif4erasmus.com.

Last updated: 09 June 2025

ANNEX I

This Annex aims to inform users about the general rules regarding the processing of personal data provided when using the form to request the service for obtaining a Portuguese Tax Identification Number (NIF), or NIF with fiscal representation. The data is collected and processed in accordance with the applicable legislation, namely Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”). This document complements and forms an integral part of the Privacy and Data Protection Policy of the website https://www.nif4erasmus.com.

As part of this service, various types of personal data will be collected according to the purpose of the service and limited strictly to what is necessary. The following personal data will be collected: full name, date of birth, nationality, a copy of an identification document, residential address, proof of address, email, and WhatsApp contact. The collection of this data is essential for the preparation of a Power of Attorney, which will authorize our team to request the NIF from the Portuguese Tax and Customs Authority (AT) or other competent services in Portugal.

The User expressly authorizes NIF4Erasmus to send communications via WhatsApp or email.

By submitting the form, the User expressly consents to the processing and storage of the information and documents provided, explicitly authorizing their use for the preparation of the power of attorney and the processing of the NIF request. The User acknowledges and accepts that the information may be shared, in a limited manner, with the competent authorities or with partners who assist in the execution of the service, such as lawyers or legal representatives.

In accordance with the applicable legislation, the user has the following rights:

• to obtain clear, transparent, and understandable information about how their personal data is used;
• to request a copy of their personal data that is being processed;
• to correct or update inaccurate or incomplete data;
• to request the deletion of their personal data;
• to lodge a complaint with the supervisory authority: If the user believes that their data has been processed unlawfully, they may file a complaint with the supervisory authority. However, we encourage the user to first share any concerns directly with us;
• to copy or transfer their data to another database;
• to request the restriction of the processing of their data.

The data provided will be treated with the highest level of confidentiality and used exclusively for the purposes described above. All shared data and documents will be stored only for as long as necessary to achieve the intended purpose. Once the service is completed, the information will be deleted, except in cases where retention is required to comply with applicable legal obligations.

All information, data, and documents are protected by professional secrecy, in accordance with Article 92 of the Statute of the Portuguese Bar Association (Law no. 145/2015, of 9 September).

The user may exercise their rights at any time under the applicable data protection legislation, unless data retention is legally required. For any questions or requests related to personal data or the NIF request process, the user may contact our team at the email address info@nif4erasmus.com.

By submitting the form, the user declares that they have read and understood this Privacy Policy and fully agree with its terms.