Privacy Policy

How we collect, use, and protect your personal data.

1. Introduction

Sway, Lda. ("Sway", "we", "us", or "our"), with registered address at Rua Exemplo, n.º 1, 2.º Andar, 1000-001 Lisboa, Portugal (NIPC 123 456 789), is committed to protecting your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and Lei n.º 58/2019 of 8 August (Portuguese Data Protection Law).

This Privacy Policy describes how we collect, use, store, and protect personal data when you visit our website or use our services, and explains your rights as a data subject.

2. Data Controller

The data controller responsible for your personal data is:
Sway, Lda.
Rua Exemplo, n.º 1, 2.º Andar
1000-001 Lisboa, Portugal
NIPC: 123 456 789
Email: privacy@gowithsway.com

3. Data We Collect

We may collect the following categories of personal data:

  • Identity data: name, job title, organisation name.
  • Contact data: email address, telephone number, postal address.
  • Account data: username, password (hashed), subscription details.
  • Usage data: information about how you use our platform, including log data, IP address, browser type, pages visited, and time stamps.
  • Communications data: messages you send us via contact forms or support channels.
  • Payment data: billing information (processed by our secure payment provider; we do not store full card details).
  • Special categories of data: our platform is designed for use by healthcare professionals. To the extent that our customers process patient health data through the platform, such processing is governed by a separate Data Processing Agreement (DPA) between Sway and the healthcare provider acting as data controller.

4. Purposes and Legal Bases for Processing

Purpose Legal Basis (GDPR)
Providing and managing our services Performance of a contract (Art. 6(1)(b))
Account registration and management Performance of a contract (Art. 6(1)(b))
Responding to enquiries and support requests Legitimate interests (Art. 6(1)(f))
Sending service-related communications Performance of a contract (Art. 6(1)(b))
Marketing communications (opt-in only) Consent (Art. 6(1)(a))
Analytics and website improvement Legitimate interests (Art. 6(1)(f))
Compliance with legal obligations Legal obligation (Art. 6(1)(c))
Prevention of fraud and abuse Legitimate interests (Art. 6(1)(f))

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Account data is retained for the duration of the contractual relationship and for up to 7 years thereafter for tax and legal compliance purposes, in accordance with Portuguese law.

6. Data Sharing and Transfers

We do not sell your personal data. We may share data with:

  • Service providers acting as data processors on our behalf (e.g., cloud hosting, payment processing, email delivery), under appropriate data processing agreements.
  • Professional advisers such as lawyers and accountants, under obligations of confidentiality.
  • Regulatory or law enforcement authorities when required by applicable law.

Where we transfer data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses approved by the European Commission).

7. Your Rights

Under the GDPR and Portuguese data protection law, you have the following rights:

  • Right of access — obtain a copy of the personal data we hold about you.
  • Right to rectification — request correction of inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal obligations.
  • Right to restriction of processing — request that we limit how we use your data.
  • Right to data portability — receive your data in a structured, machine-readable format.
  • Right to object — object to processing based on legitimate interests or for direct marketing.
  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us at privacy@gowithsway.com. We will respond within 30 days.

8. Supervisory Authority

You have the right to lodge a complaint with the Portuguese data protection supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)
Rua de São Bento, n.º 148, 3.º
1200-821 Lisboa
Tel.: +351 213 928 400
www.cnpd.pt

9. Cookies

We use cookies and similar tracking technologies on our website. Please refer to our Cookie Policy for full details.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. Our platform uses encryption in transit (TLS) and at rest.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on our website. The date of the most recent revision is shown below.

Last updated: January 2025