Privacy Policy

Last Updated: September 2026

At Offlx ("we", "our", "us"), we handle your property with care, and we treat your personal data the exact same way. We operate in full compliance with the EU General Data Protection Regulation (GDPR) (EU 2016/679).

This Privacy Policy explains how we handle your personal information when you visit our website (offlx.pt), book an intro call, or hire us to look after your home in Lisbon.

1. Who Responsible for Your Data (Data Controller)

Offlx
Lisbon, Portugal
Direct Contact: us@offlx.pt

2. What Data We Collect & Why

We only collect data that is strictly necessary to schedule calls and care for your home. We do not run advertising scripts, tracking cookies, or automated profiling.

A. Introductory Calls (Cal.com)

When you schedule an intro call through our website, we collect:

Your Name
Your Email Address
Meeting Notes: Any details you voluntarily share regarding your property care needs.
Why we need it: To confirm, schedule, and host your 15-minute intro call.
Legal Basis: GDPR Article 6(1)(b) - Taking steps at your request prior to entering a contract.

B. Active Home Watch & Property Oversight

When you become a client, we store the operational details needed to manage your home securely:

Access Credentials: Key mapping IDs, alarm codes, gate PINs, and utility meter locations.
Property Records: Service agreements, walkthrough photo reports, relative humidity logs, and mail summaries.
Why we need it: To perform physical home inspections, prevent moisture damage, manage emergencies, and keep your home secure.
Legal Basis: GDPR Article 6(1)(b) - Execution of a home watch service agreement.

3. Security Architecture & Encryption

We enforce a strict technical wall between our public website and your property data. We do not store your home's access codes or inspection reports on our web server.

Zero-Knowledge Code Vaults (Bitwarden): Your alarm codes, digital door PINs, and access instructions are stored inside zero-knowledge encrypted vaults. They are encrypted locally on our devices before syncing.
Encrypted Property Documentation (Proton Drive): Your service contracts, humidity logs, and walkthrough photo reports are stored on Proton Drive (hosted in Switzerland) using end-to-end encryption (E2EE).
Transit Security (Cal.com): All booking data sent through our scheduling tool is encrypted in transit via standard HTTPS/TLS protocols.

Neither our web host nor any outside third party holds the decryption keys to your property records or access credentials.

4. Third-Party Service Providers

We never sell, rent, or trade your personal data. We rely exclusively on the following infrastructure partners to run our operations under strict GDPR-compliant agreements:

Service Provider	Role	Data Held	Location & Security
Cal.com, Inc.	Calendar Booking	Name & Email	EU / US (Data Privacy Framework & Standard Contractual Clauses)
Proton AG	Contracts, Reports & Email	Property Logs & Photos	Switzerland / EU (End-to-End Encrypted under Swiss Federal Data Protection Act)
Bitwarden, Inc.	Access Credentials Vault	Alarm PINs & Codes	EU / US (Zero-Knowledge AES-256 Bit Encryption)
Cloudflare, Inc.	Website Hosting	None (Static Assets)	Global / EU (Delivers site files without tracking cookies)

5. Cookies & Tracking

Our website is built using static code. We do not use tracking cookies, local storage tracking, or third-party web analytics (like Google Analytics).

All images, fonts, and scripts are served directly from our own domain to ensure third-party networks cannot log your IP address when you browse our site.

6. How Long We Keep Your Data

Unconverted Booking Inquiries: If you book a call but do not become a client, your meeting details and notes are permanently deleted after 90 days.
Access Credentials (PINs & Codes): Alarm codes, door PINs, and key references stored in Bitwarden are permanently destroyed immediately upon contract cancellation.
Contracts & Walkthrough Reports: Stored securely in Proton Drive for the duration of our service agreement and subsequent statutory limitation periods.
Tax & Financial Records: Invoices and payment logs are retained as required by Portuguese tax law (Autoridade Tributária e Aduaneira).

7. Your Rights Under GDPR

You have full control over your personal data. Under the GDPR, you have the right to:

Access the personal data we hold about you.
Correct any inaccurate or incomplete data.
Request Erasure of your data (subject to legal or tax retention obligations).
Restrict or Object to how we process your information.
Request Data Portability to move your data elsewhere.

To exercise any of these rights, email us directly at us@offlx.pt.

If you believe your data is being handled improperly, you also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD - Comissão Nacional de Protecção de Dados) at cnpd.pt.