Privacy Policy.

1.Who We Are

This Privacy Policy explains how Viver Europa, Lda., trading as Viv Europe ("Viv Europe," "we," "us"), collects and uses your personal data when you use our website (viveurope.com) and Client Portal (portal.viveurope.com) - together, the "Platform." We are the controller of your personal data.

• Controller: Viver Europa, Lda. - NIPC 515916145, AMI Licence 21426.
• Registered office: Praça da Justiça, n.º 168, São Victor, 4715-125 Braga, Portugal.
• Office: R. de Augusto Rosa 79, 4000-098 Porto, Portugal.
• Privacy contact: contact@viveurope.com.

This Policy complements our Terms and Conditions and is provided in line with the EU General Data Protection Regulation (GDPR) and Portuguese data-protection law. Where translated versions are offered, they are non-certified convenience translations and the English version is the operative reference.

2.Personal Data We Collect

Depending on how you use the Platform, we may collect the following categories of personal data:

• Identity & contact data - name, email, phone, country of residence and nationality.
• Relocation & eligibility data - your answers to our eligibility test and intake forms: destination country, whether you hold EU/EEA citizenship, your work situation, approximate monthly income and savings range, family composition, and your timeline. If you enter your email to receive your results, request a proposal or hand off to WhatsApp, these answers are stored with your contact record.
• Tax intake data - if you use our tax-situation form: your income types, the countries they come from, annual income bands (never exact figures), tax-residency plans and interest in Portuguese tax regimes.
• Company-formation data - if you request a company-formation quote: details of the company and of each shareholder, which can include name, date of birth, nationality, home address, tax identification number, marital status and capital share.
• Property data - if you list a property or share housing preferences: your contact details, the property's address and photos, or your search criteria, budget and household details. If your case includes renting or buying a home, we also record the property, its price and contract dates, and the contact details of the landlord, seller or broker you give us - you are responsible for being entitled to share them.
• Account & Portal data - login credentials, your case roadmap, milestones, tasks and progress, the date and version of the Terms you accepted, and an optional profile photo that helps your case team recognise each applicant.
• Documents you upload - passports, identity, civil-status, financial and other supporting documents required for your application, including national identifiers such as a Portuguese tax number (NIF), social-security number (NISS) or US Social Security number where the process requires them.
• Payment data - card payments are handled by our payment processor (Stripe), from which we receive confirmation and transaction metadata but never your full card number. We also keep our own record of your installments, including bank transfers recorded by your case manager.
• Communications - messages via live chat (Intercom), emails, WhatsApp if you choose to contact us there, and scheduled-call details. If you email clients@viveurope.com about your case, that correspondence may be read back into the Portal for the case review described in Section 5.
• Technical & usage data - IP address, device and browser information, cookies and analytics events (subject to your consent), first-visit campaign parameters. At checkout we store the agreement version and the name you typed together with the payment record, and proposals you sign electronically carry the signature provider's own audit trail; your IP address is used for security and rate-limiting, not as a signature.

3.How We Collect Your Data

We collect personal data directly from you (through our forms, eligibility test, checkout, Portal uploads, chat and calls); automatically (through cookies and analytics, subject to your consent); and occasionally from third parties acting on your behalf - for example, a family member who purchases services for you and confirms they are authorised to provide your data. Records from our earlier internal systems - for example lease and purchase contracts from before the Portal existed - may also be imported into it.

4.Why We Use Your Data & Legal Bases

We process your personal data for the following purposes and on the following legal bases under Article 6 GDPR:

• Providing our services - managing your account, delivering relocation support and the Portal, preparing and e-signing proposals, and processing payments. Basis: performance of a contract.
• Eligibility assessments and quotes you request, including a one-time reminder if a proposal you generated yourself remains unsigned. Basis: contract / pre-contractual steps.
• Follow-up emails about your enquiry - after your eligibility result or a guide download, after a meeting with us, after a proposal, or when an enquiry from the last six months has gone quiet: a short series of at most four emails over a few weeks from one of our specialists, each with a one-click unsubscribe or a reply-to-stop line. We pause them while you are in conversation with us, and we never start them for enquiries older than six months. If we sent you a proposal that did not go ahead, we may also check in once, up to two years later, with at most two emails, each with a one-click unsubscribe. Basis: pre-contractual steps at your request and our legitimate interest in following up an enquiry you made; you can object at any time.
• WhatsApp messages about your enquiry - only if you ticked the WhatsApp box on a form or chose to continue to WhatsApp from the eligibility check. Reply STOP at any time. Basis: your consent, which you can withdraw at any time.
• Responding to your enquiries and routing them to the right specialist - which can include an independent professional, such as the certified accountant who prepares tax quotes. Basis: pre-contractual steps at your request.
• Meeting reminders by email and - only if you expressly opted in when booking - by SMS. Basis: contract / your consent for SMS.
• Introductions to partners you ask for - when you choose a partner service in the Portal (for example an apostille service or a relocation partner in another country), we email your name and email address to that partner, copy you, and record which partner you were introduced to. Basis: pre-contractual steps at your request.
• Copying people you name on a proposal - if you or your employer ask us to copy someone on a proposal, they receive the proposal document. Basis: contract / your request.
• AI-assisted case reviews and automated eligibility scoring, described in Section 5. Basis: performance of a contract and our legitimate interest in reviewing cases thoroughly; a person always decides.
• Newsletters and marketing emails. Basis: your consent, which you can withdraw at any time.
• Analytics, advertising measurement and non-essential cookies. Basis: your consent.
• Fraud prevention, anti-money-laundering checks, accounting and the e-commerce audit-trail. Basis: compliance with legal obligations.
• Security, service improvement and defending legal claims. Basis: our legitimate interests.

Where the documents you provide contain special-category data, we rely on your explicit consent (Article 9(2)(a)) and/or the establishment or defence of legal claims (Article 9(2)(f)).

5.Automated Processing & AI

Some of our processing is automated or assisted by artificial intelligence. We do not make decisions that produce legal or similarly significant effects for you solely by automated means: the outputs below inform our team and you, and a person decides.

• Eligibility test scoring - your answers are scored by fixed rules (income and savings thresholds, citizenship, family size) to show which routes you may qualify for. The result is a preliminary indication, not a decision: a specialist reviews your situation before any proposal or advice.
• Live-chat assistant - Intercom's assistant may draft first answers to your questions using the details you submitted through our forms; our team supervises the conversation.
• AI case reviews in the Portal - your case manager can ask an AI assistant (Anthropic's Claude, hosted in the United States) to review the state of your case and suggest next steps. The review reads your identity and case details, the status of your journey and documents, payments, your case manager's notes, recent Portal activity and your email correspondence with clients@viveurope.com. Passport, tax, social-security, bank-account and card numbers are removed before anything is sent. The provider processes this data only to produce the review and does not use it to train its models. The suggestions are stored with your case file for your case team; they are not shared with authorities and are never the sole basis for a decision about you.

You can ask us at any time to explain an automated output, to have a person review it, or to object to this processing: contact@viveurope.com.

6.Cookies & Analytics

Essential and functional cookies - including those that power our live chat - are always active because they make the site work. If you choose “Accept” in our cookie banner, we also load our analytics and advertising tools: Google Tag Manager, Google Analytics, Google Ads, the Meta (Facebook) Pixel, the OpenAI (ChatGPT Ads) pixel and PostHog. These let us measure our campaigns and understand how visitors use the site, including recording browsing sessions. Session recordings mask form inputs, so we do not capture what you type. We do not sell your personal data. Accepting and declining are equally easy, your choice is stored together with its date and the version of this notice, and you can change it at any time using “Cookie settings” in the website footer.

Some pages embed third-party content - for example YouTube videos (in privacy-enhanced mode), Instagram posts, our video player (Mux) and the HubSpot meeting scheduler. When such content loads, the provider may process technical data such as your IP address under its own privacy policy.

To protect our contact and newsletter forms from spam and automated abuse, we use Cloudflare Turnstile. It runs invisibly as an essential security measure on the basis of our legitimate interest, and may process device and browsing information to tell human visitors apart from bots. It is not used for advertising or profiling. This processing is governed by Cloudflare’s Turnstile Privacy Addendum.

7.Who We Share Your Data With

We never sell your personal data. We share it only as necessary with vetted service providers (processors) who act on our instructions, and with the independent professionals involved in delivering what you asked for:

• Infrastructure & storage - Vercel (website and application hosting, and storage of property photos you upload), Supabase (Portal authentication and secure document storage), Neon (application database), Browserless (secure rendering of your proposals and documents into PDF).
• CRM & communications - HubSpot (customer-relationship management and meeting scheduling), Mailchimp (newsletter delivery), Resend (transactional and confirmation emails), Intercom (live chat, and the details you submit through our website forms so our team and its assistant can answer you with context), Twilio (SMS meeting reminders, only if you expressly opted in), Pingram (Portal notification emails), Google Workspace (our email, calendar and Google Meet video calls), and our internal alerting and automation tools (Slack and n8n), which carry the details you submit so our team can respond quickly; n8n also reads your correspondence with clients@viveurope.com from our mailbox for the AI case review, passing it through without keeping a copy.
• Payments & signature - Stripe (payment processing) and SignWell (electronic signature of proposals and agreements).
• AI processing - Anthropic (the AI case reviews in the Portal described in Section 5), under a data-processing agreement that prohibits training on your data.
• Analytics & advertising (consent-based) - PostHog (product analytics and masked session replay), Google (tag management, analytics and ads measurement), Meta Platforms (advertising measurement via the Meta Pixel), OpenAI (advertising measurement for ChatGPT ads via the OpenAI pixel); see Meta’s Privacy Policy and OpenAI’s Privacy Policy.
• Security & monitoring - Cloudflare (Turnstile bot protection; governed by its Turnstile Privacy Addendum) and Sentry (error monitoring in the Portal).
• Independent professionals - where the service you request requires it: the independent certified accountant who prepares your tax quote (they receive your tax-intake answers), and the external lawyers, accountants or other specialists working on your case. Partner companies you ask to be introduced to receive your name and email address for that introduction, and anyone you or your employer ask us to copy on a proposal receives that proposal document.
• WhatsApp (Meta Platforms) - messaging, if you choose to contact us there. Anything you send in that chat is processed by WhatsApp under its own privacy policy.
• Sanity, Mux and Notion - content management, video hosting and internal records. The first two hold no client personal data; Notion held some earlier contract records that were imported into the Portal.

We may also share data with competent public authorities (such as AIMA, the Portuguese Tax Authority and Social Security), and with the banks and other institutions your process requires (for example to open an account), where this is necessary to deliver the service you purchased, and with advisers, auditors or authorities where required by law or to prevent fraud.

8.International Transfers

Some of our providers are located outside the European Economic Area - primarily in the United States, including our hosting, analytics, CRM, email, SMS, signature, monitoring and AI providers listed above. Where personal data is transferred outside the EEA, we rely on appropriate safeguards - principally the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework - so your data continues to receive an equivalent level of protection.

9.How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes described above:

• Enquiry and eligibility data - kept while our relationship with you is active; you can ask us to delete it at any time.
• Marketing data and follow-up emails - until you unsubscribe or object, or our relationship ends.
• Client case files and documents - for the service period in your Order (by default two years from the Order, see Section 19 of the Terms) and for as long as required afterwards to meet our legal obligations. AI case-review outputs and your profile photo are kept with the case file and deleted with it; you can remove the photo yourself at any time.
• Accounting and tax records - for the period required under Portuguese law (generally 10 years).
• Anti-money-laundering records - for the legally required retention period (generally 7 years from the end of the business relationship or the transaction).
• Analytics data and session recordings - for the retention period configured in our analytics tools, after which they are deleted or aggregated.

When personal data is no longer needed, we securely delete or anonymise it.

10.Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (the "right to be forgotten"), where applicable;
• Restrict or object to certain processing;
• Receive and port your data to another provider;
• Withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise any of these rights, contact us at contact@viveurope.com. We respond within one month, as the GDPR requires. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) - www.cnpd.pt.

11.How We Protect Your Data

We treat your data and documents with a high degree of security. Documents are stored on enterprise-grade infrastructure with private storage policies, authentication layers and encryption, and access is limited to you and the Viv Europe personnel assigned to your case. Secrets are stored server-side only, and the Platform uses HTTPS, HSTS and other security headers. We also run regular vulnerability scanning and independent security testing of our infrastructure. No method of transmission or storage is completely secure, but we work continually to protect your information.

12.The Client Portal

When you become a client and use the Portal, some additional processing applies:

• Product analytics and error monitoring run for logged-in users on the basis of our legitimate interest in keeping the Portal working: analytics are tied to an internal account identifier (not your name or email), on-screen text and everything you type are masked in session replays, and error reports do not include your personal details.
• Case documents are shared within your case - the family members on one relocation process, your assigned case managers, and where needed the external professionals working on it.
• Some deliveries happen by email - for example messages from your case manager and secure, time-limited links to documents, sent to the addresses on your case.
• Login security - we process your IP address for rate-limiting and abuse prevention, and send a fresh verification code to your email for every login.
• Your acceptance of the Terms is recorded on your account - the date and the version you accepted, so we can show you what changed when they are updated.
• AI case reviews - your case manager may use the AI assistant described in Section 5 to review your case.
• Emails to external professionals about your tasks copy our shared case mailbox (clients@viveurope.com), and the Portal records when and to whom each was sent.
• Payments - the Portal keeps the schedule and status of your installments, including bank transfers your case manager records, and your process starts once the first payment is settled.

13.Children’s Data

Our services are intended for adults. However, relocation applications often involve minor family members. We process minors’ personal data only when it is provided by a parent or guardian who confirms they have the authority to do so, and solely to deliver the relocation service requested. Profile photos of minors are optional and, like their documents, are added only by the parent or guardian.

14.Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available on this page, together with its effective date and version number. Where changes are material, we will take reasonable steps to notify you - for example by email or through a notice in the Portal. Version 2.0 (September 2026) added Section 5 on automated processing and AI, the Portal's AI case reviews, profile photos and payment records, the follow-up email series, partner introductions, and the providers involved. Version 2.1 (September 2026) added the one-time check-in after a proposal that did not go ahead.

15.Contact Us

For any question about this Policy or about how we handle your personal data, contact us at contact@viveurope.com, or write to Viver Europa, Lda., Praça da Justiça, n.º 168, São Victor, 4715-125 Braga, Portugal.