1. Who we are
e-expat is a trading name of JASMINELOFT, Lda., a company registered in Portugal under NIPC and commercial registry number 519004442, with registered office at Avenida António Augusto de Aguiar 29, Bloco D, 8.º Esq., 1050-251 Lisboa, Portugal. We are the controller of the personal data described on this page. You can reach us at hello@e-expat.com.
This policy covers www.e-expat.com, the forms on it, and what you send us by email, WhatsApp or WeChat while we handle your enquiry or your case. It is written under the General Data Protection Regulation (GDPR) and Portuguese Law 58/2019.
2. What we collect, and why
Browsing. The site sets no cookies. It counts visits with Vercel Web Analytics, which writes nothing to your browser and shows us aggregate figures only: the pages read, the country and device type, the referring page, and seven actions recorded as fixed codes (finishing Build my path, pressing a WhatsApp button, opening the WeChat card, switching language, pressing an Ask-AI button, asking for a free Employer Match Report preview or a free School Match Report preview, asking for a free Program Match Report), never anything you type. Our host, Vercel, keeps standard server logs (IP address, time, page requested) for a short period to keep the site running and secure. Section 9 describes the storage the checkout uses.
Contact and free case check. Name, email, the country you live in, your nationality, what you want to do in Portugal and anything you choose to write. We use it to answer you and to say whether we can take your case. Basis: steps you ask for before a contract (art. 6(1)(b) GDPR).
Online orders. Name, email, phone number, country of residence, the service you chose and the answers on the order form. Stripe collects the payment details; we never see your full card number. We use this data to deliver the service, invoice you and keep the accounting records the law requires. Basis: contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)).
Documents for a service. Depending on the service, we ask for a passport or ID card, proof of address, bank statements, proof of income, an employment contract, a criminal record certificate, a lease, or a marriage or birth certificate. These are the documents the tax office, Social Security, AIMA, the consulate, the bank or the school require, and we collect only what your file needs. Basis: contract. A criminal record certificate is processed only because the application you asked for requires it, with your explicit consent given at upload (art. 9 and art. 10 GDPR).
Employer Match Report. Your CV, work history, skills, languages, target role and salary expectations. We use it only to build your report. We never send your CV to an employer, never register you with a recruiter or a contact database, and never apply on your behalf.
School Match Report. Your children's first names or initials, ages, school year, languages, any learning or support needs you choose to tell us, your area of Portugal and your budget. We use it only to build the report and to call admissions offices. We do not give a school your child's name unless you ask us to.
Program Match Report. Your education, graduation year, grades, English test and score, the level, field, countries, budget and intake you want, your plans after graduating and anything you choose to write, plus a transcript if you send one. We use it only to build your report and, if you ask us to apply for you, for that application. Basis: steps you ask for before a contract (art. 6(1)(b) GDPR).
Payment. Stripe processes the payment and shares with us your name, email, the amount, the VAT applied and a payment reference. We keep these records for ten years as Portuguese tax law requires.
3. How data reaches us
The forms on this site send what you type, and any file you attach, to our mailbox by email through Web3Forms, a form service operated by Web3Creative (India). Web3Forms keeps a copy of each submission and its files on its own systems for up to three years unless we delete it sooner. We delete uploads there once they are in our case files, and in any case within seven days.
The contact buttons open WhatsApp or show a WeChat QR code. Messages you send there are held by Meta (WhatsApp) and Tencent (WeChat) under their own terms. Once a document is in your case file we delete it from the chat.
4. Who sees your data
Inside e-expat, only the people working on your case.
Our processors, who act on our instructions:
- Web3Creative (Web3Forms), India: delivery and storage of form submissions and uploaded files.
- Microsoft: our mailbox and case files, hosted in the EU.
- Stripe Payments Europe, Limited, Ireland: payments.
- Vercel Inc., United States: hosting, and the aggregate visit statistics described in section 2.
Licensed professionals in our network: lawyers, solicitadores, certified accountants and our partner bank. They file your application under the power of attorney you sign, and they are separate controllers for the parts of the work the law reserves to them. Your engagement letter names them.
Authorities and institutions your service requires: the tax authority (AT), Social Security, AIMA, Portuguese consulates, the bank, and schools you ask us to contact. We send them only what the application needs.
Nobody else. We do not sell or rent personal data, and employers never receive anything about you.
5. Where your data goes
Our mailbox and case files are hosted by Microsoft in the EU. Vercel, Web3Forms, Stripe, Meta and Tencent operate infrastructure outside the European Economic Area. Where data leaves the EEA, the transfer rests on the European Commission's standard contractual clauses in each provider's data processing agreement, or on an adequacy decision where one applies. You may ask us for a copy of the relevant clauses.
6. How long we keep it
- Enquiries and free case checks that do not become a case: 12 months after our last message.
- Report intakes (CV, school details) and the report itself: 12 months after delivery, then deleted.
- Service case files, including copies of identity and financial documents: 5 years after the service is completed, the period in which a claim about the work could still be made.
- Invoices and payment records: 10 years, as Portuguese tax law requires.
- Copies in Web3Forms, WhatsApp and WeChat: deleted once the document is in the case file.
- Server logs: no longer than 30 days.
You may ask for earlier deletion at any time. We comply unless a legal duty requires us to keep the record.
7. Your rights
You may ask us to show you the data we hold about you, correct it, delete it, restrict or object to its use, or hand it to you or to another provider in a portable form. Where we rely on consent you may withdraw it at any time; this does not affect what was done before. Write to hello@e-expat.com. We answer within one month.
You may also complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or to the authority of the country where you live.
8. Security
The site is served over HTTPS with a content security policy that blocks scripts we did not ship. Our mailbox requires multi-factor authentication. Documents you send are opened in preview and filed; we do not forward identity documents by email inside the team. No transmission over the internet is entirely secure, so we recommend sending documents through the upload on your confirmation page or through WhatsApp rather than as plain email attachments.
9. Cookies and storage
The site sets no cookies when you load a page. At checkout it keeps your name, email, order and your answers on the order form in your browser's sessionStorage (keys e-expat-order, e-expat-service-order and e-expat-school-order) so that the confirmation page can show them. This is strictly necessary for the order you asked for and is cleared when you close the tab. If you arrive through an ad or a tracked link, the site also keeps that link's utm_source, utm_medium, utm_campaign and gclid parameters in sessionStorage (key e-expat-source), to record which ad or link brought you to the site; it is cleared when you close the tab, and it reaches us only as the last line of a message you send. The cookie page has the details.
10. Children
The School Match Report processes children's details supplied by a parent or guardian. We do not knowingly collect data directly from anyone under 16, and we do not use children's data for anything other than the report.
11. Changes
If the site starts collecting more than this page describes, this page changes first and the date at the top moves with it.
Última atualização: 6 October 2026. Dúvidas sobre esta página: fale com a gente.
