This website is managed and administered by MITUP, which carries out continuous work to guarantee the protection of personal data provided by the user, processing information under the terms provided for in Portuguese laws 58/2019 and 59/2019 of August 8, 2019, aligned with directive (EU) 2016/679 of April 27, 2016. As well as applying the best cybersecurity and data protection practices, described in ISO/IEC 27001:2013, ISO/IEC 27701:2019, ENISA, NIST CSF, Cert RMM, among other market best practices.

This privacy policy describes:

1. Who is responsible for my personal data?
2. What personal data is processed by MITUP?
3. How long will my personal data be kept?
4. How is my personal data stored?
5. To which entities can my personal data be sent?
6. What are my rights?
7. How can I find out about any changes to this privacy policy?

1. Who is responsible for my personal data?

Your data will be processed by MITUP, legal entity n.º 515.866.121, located at Av Dom Afonso V, 130, R/c Esq, CP 2870-065, Montijo, Portugal.

You may contact us and our data protection officer via email at dpo@mitup.pt.

2. What personal data is processed by MITUP?

3. How long will my personal data be kept?

The period of time during which your personal data is stored and kept varies according to the purpose for which the data was collected.

Thus, your personal data collected for marketing/commercial purposes will be kept for a maximum period of 12 months from the last contact made, provided that, within this period, you have not withdrawn your consent.

For personal data collected for the billing of projects carried out, we will keep your personal data throughout the duration of our commercial relationship, and after the end of the contract, we must store it for a period of 10 years.

Data collected for the execution of a project will be kept for the period necessary for its execution, as defined in the commercial contract.

4. How is my personal data stored?

Our obligation is to keep your data secure, and we apply appropriate security measures to ensure the protection of your personal data and prevent access by unauthorized persons. We subject our security systems and policies to periodic analysis to ensure that data is safe and protected.

MITUP is committed to applying secure practices based on ISO/IEC 27001:2013, ISO/IEC 27701:2019, ENISA, NIST CSF, Cert RMM, among other market best practices.

5. To which entities can my personal data be sent?

We only send data to third parties without your consent when required by law or judicial authority.

However, the processing of your personal data may be carried out by service providers acting on our behalf, namely marketing and digital/social media agencies, accounting management services, auditors and lawyers, and external entities such as SaaS platform providers, hosting, and maintenance services. Some of these providers are headquartered outside the EEA, which implies an international sharing of your data; however, we always take the necessary safeguards to ensure the secure processing of your data through contracts containing standard contractual clauses and the application of secure controls defined by digital privacy and cybersecurity best practices, as defined in item 4.

6. What are my rights?

As a data subject, you may exercise the following rights, within the legally established limits:

• Right of access to your personal data to know which data is being processed and the processing operations of your personal data;
• Right to rectification of any of your inaccurate or outdated personal data;
• Right to erasure of your personal data;
• Right to object, that is, to request that your personal data not be processed for reasons related to your personal situation;
• Right to withdraw your consent at any time, when this was the legal basis for processing your data;
• Right to request the limitation of processing of your personal data in the following cases:
  • If you contest the accuracy of your data, for a period that allows MITUP to verify its accuracy.
  • If the processing of certain data is unlawful and you oppose the erasure of the data, requesting, in return, the limitation of its use.
  • When MITUP no longer needs to process your data, but you request it for the purposes of declaration, exercise, or defense of a right in a judicial process.
  • When you have objected to the processing of your data carried out by MITUP based on a legitimate interest, while verifying whether the legitimate interest invoked prevails or not over the reasons invoked by the subject.
• Right to portability, that is, to receive the personal data you have provided in a structured, commonly used, and machine-readable format, and to transmit them to another controller.

To exercise these rights, you may send a written request to the contact indicated in the section “Who is responsible for my personal data?”.

To exercise your rights, you must indicate your name and the right you are exercising in your request.

If you consider that a violation of the data protection legislation in force has been committed regarding the processing of your personal data, you also have the right to lodge a complaint with the National Data Protection Commission (CNPD) – https://www.cnpd.pt/.

7. How can I find out about any changes to this privacy policy?

MITUP reserves the right, at any time, to make modifications or updates to this Privacy Policy, and these changes will be duly updated on the website https://mitup.pt.

We suggest that you consult it regularly to stay informed of any changes.

Updated on January 01, 2026.