> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wede.pt/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy Policy

> How wede processes personal data, as a processor for its customers and as a controller for its own customer relationships

*Version 2.0, 22 October 2026. Replaces version 1.0 of June 2026. GDPR (EU) 2016/679.*

## 1. Who we are

The wede platform is provided by **WEDELI, LDA** ("wede", "we"), a company registered in Portugal.

* Privacy: [privacy@wede.pt](mailto:privacy@wede.pt)
* General: [geral@wede.pt](mailto:geral@wede.pt)
* Security: [security@wede.pt](mailto:security@wede.pt)

> [!NOTE]
>
> The formal appointment of a Data Protection Officer is in progress. Until then, every privacy request goes to [privacy@wede.pt](mailto:privacy@wede.pt).

## 2. Our two roles

**Processor.** For the data an organisation that uses wede (a "Tenant") sends to the platform or creates in it, wede acts as a processor under Article 28 GDPR, on the Tenant's documented instructions. The Tenant is the controller: it decides what is sent, why, and for how long within the limits below. This covers events and their content, teams and their members, missions, positions, devices, the audit log and everything derived from them. People whose data is in a Tenant's account should address their requests to that Tenant; wede helps the Tenant answer them.

**Controller.** wede is the controller for the data of its own customer relationships: the contact details of the people who sign contracts, receive invoices or talk to us, billing records, and the security records of access to wede's own systems.

## 3. Data processed on behalf of Tenants

* **Accounts:** name, email, role, sign-in history, single sign-on and directory provisioning data when the Tenant uses them.
* **Operations:** events (type, priority, vertical, zone, location, times, status and the content the Tenant sends), missions and their reports, reconciliation records and the operation ledger.
* **Teams:** member names, roles, availability, equipment and the last known position of each member, sent by the Tenant's field application at the intervals the Tenant sets (by default every 60 seconds online and every 300 seconds over fallback channels).
* **Devices:** a device identifier generated by the wede SDK and kept in the storage the Tenant's application chooses, platform and version, the offline queue with its sequence numbers and integrity hashes, and other identifiers of the same machine the Tenant registers (for example a terminal ID or a serial number).
* **Delivery:** the phone number or address an event is delivered to, encrypted with the Tenant's own key and kept only while the delivery runs.
* **Security and audit:** an audit log of every action (user, action, time, IP address and browser), integrity incidents and personal data incidents.

**Event content.** wede processes the content of an event to deliver it, to apply the Tenant's parser configuration (for example, which fields a field team may see) and to keep a mission working. It is not used for any other purpose. For event types that do not send a field team, the stored content is cleared once the event is delivered; for types that do, it is kept until the event is closed or its missions end. The Tenant decides what an event contains and must not send special categories of data (such as health data) without a lawful basis of its own.

## 4. Retention

Every Tenant has two periods, set by wede per vertical and country, and shown to the Tenant's administrators in the dashboard:

| Data | Default period | At the end |
| - | - | - |
| Operational data with personal content (event content, mission details, positions, delivery destinations, messages and calls to teams, fallback channel messages, connectivity reports) | 1 year. The Tenant's administrator can shorten it, never below 30 days | Deleted or cleared |
| Evidence records (audit log, operation ledger, reconciliation, synchronisation records, device chains, integrity and data incidents) | 5 years; 7 years for banking, 10 years for healthcare | Anonymised: people, devices and free text are removed; what is needed as proof (actions, times, amounts, results) stays |
| Records without personal data (continuity periods, usage counts, signed evidence packs) | Kept | Kept |

The periods are provisional and will be confirmed per country. Removal runs every day.

**Deleting a user.** A Tenant's administrator can delete an account of the organisation. The account is blocked and every session ends at once; 30 days later the name, email, password and position are removed for good. Until then the deletion can be undone. Evidence records keep only an internal reference and follow the retention above.

**End of contract.** At the end of a contract wede returns or deletes the Tenant's data as agreed in the contract, except what the law requires wede to keep.

## 5. Data processed as controller

| Purpose | Data | Legal basis |
| - | - | - |
| Contracts, invoices and payments | Names, emails, company details, invoices | Art. 6(1)(b) contract, 6(1)(c) legal obligation |
| Security of wede's systems | Sign-in records, IP addresses | Art. 6(1)(f) legitimate interest |
| Service emails (alerts, notices, password resets) | Email address | Art. 6(1)(b) contract |

Billing records are kept for 10 years (tax obligation). Other records follow the periods above.

## 6. Sub-processors

| Sub-processor | Purpose | Location |
| - | - | - |
| Google Cloud Platform | API hosting, database, key management, secrets | EU (europe-west1, Belgium) |
| Vercel | Hosting of the dashboard web application (app.wede.pt) | Global network |
| Resend | Transactional email | EU |
| Stripe | Payments | EU and US |
| Communications providers contracted per country | SMS, voice and other fallback channels, only for the Tenants that use them; the message passes through the provider | Depends on the country |

wede informs Tenants in advance of any change of sub-processor, so that they can object (Article 28(2) GDPR).

## 7. Transfers outside the EU

Data is stored in the EU. Where a sub-processor processes data outside the EU, the transfer relies on an adequacy decision of the European Commission or on the Standard Contractual Clauses approved by the Commission.

## 8. Security

* Encrypted connections (TLS) for all traffic.
* Each Tenant's sensitive data is encrypted with the Tenant's own key, protected by a master key held in a hardware security module.
* Passwords stored as bcrypt hashes; API keys stored as hashes and shown only once.
* Sessions expire after 8 hours and can be revoked at once; 5 failed sign-ins lock an account for 15 minutes.
* Role-based access on every request and strict separation between Tenants. The wede team has no access to event content.
* An audit log that cannot be changed or deleted by anyone, wede included, until it is anonymised at the end of its period.

See [Security](/concepts/security.md) and [ISMS](/compliance/isms.md).

## 9. Personal data incidents

If wede becomes aware of a personal data breach affecting a Tenant's data, it notifies the Tenant without undue delay, as a processor under Article 33(2) GDPR, and keeps it informed until the incident is closed, so that the Tenant can meet its own notification duties.

## 10. Rights of data subjects

Under the GDPR you may ask for access, rectification, erasure, restriction, portability and objection. If your data is in a Tenant's account, send your request to that Tenant; wede assists it. For data wede holds as controller, write to [privacy@wede.pt](mailto:privacy@wede.pt). The audit log is not erased on request while it is needed as proof; it is anonymised at the end of its period.

## 11. Dashboard storage

The wede dashboard (app.wede.pt) keeps the session in a cookie limited to the dashboard (`SameSite=Lax`, 8 hours) and in the browser's local storage, together with the user's role, organisation and email, so that a page reload keeps the user signed in. It also stores interface preferences (theme, sound, chosen country, dismissed tips). Signing out removes the session. There are no advertising, tracking or third-party analytics cookies.

## 12. Changes

wede may update this policy when the law or the service changes. Significant changes are announced by email at least 30 days in advance. The current version is always at [docs.wede.pt/legal/privacy](https://docs.wede.pt/legal/privacy).

## 13. Complaints

You can lodge a complaint with a supervisory authority. In Portugal: CNPD, Comissão Nacional de Proteção de Dados ([cnpd.pt](https://www.cnpd.pt), [geral@cnpd.pt](mailto:geral@cnpd.pt)).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.