Privacy policy.

Who we are

This website is run by Brumagaláctica Unipessoal, Lda, trading as Bumatic (NIPC 518972593), with its registered office at Rua António Joaquim Araújo 56, 1.º Esq., 2300-555 Tomar, Portugal. We are the data controller for the personal data described here.

For anything about your data, write to info@bumatic.com.

Website analytics

With your permission, we count visits to this website with our own statistics, to see which pages are useful. Nothing is counted unless you allow it. It is not used for advertising, and no other company's analytics service is involved: it runs on our own website hosting (Netlify, listed below).

• Your choice: a small prompt asks whether we may count your visit, with two answers that look the same: “Allow” and “Don’t allow”. We remember your answer for 6 months in the bx_ac cookie, then ask again. You can change it at any time here or under “Privacy choices” at the foot of every page; changing it does not affect what was counted before. If your browser sends a “Global Privacy Control” or “Do Not Track” signal, we never count your visits and do not ask.

  Your choice can be changed here once the page has loaded.

• What we record if you allow it: the pages you view and their titles; the website or campaign link that brought you here (the website’s name, not the page); how long a page was visible and how far you scrolled; clicks on email, phone, PDF and outside links; actions such as opening a job or sending a form; your country and region, worked out from your IP address at the moment of the visit; and your device type, browser, operating system and preferred language, from the information every browser sends with each request. A small script on our pages sends this to our website. Apart from the cookie with your answer, it stores nothing on your device, and it reads no identifier, screen size or settings.
• How visitors are counted: to count unique visitors, we combine your IP address and browser details with a random value that changes every day, and keep only a scrambled result (a “hash”). We do not store your IP address. The daily value is deleted afterwards, so the hash cannot be turned back into your IP address, and you cannot be recognised from one day to the next or across websites.
• Forms and accounts: if you allowed counting, that a form was sent, an account was created, or someone signed in or downloaded an investor document is counted on its own, with a random number instead of your visitor hash, so it cannot be joined to the pages you viewed. The portal pages you see after signing in, and the pages for creating an account, confirming an email address or choosing a password, are never counted.
• Why: to understand which content is useful and improve the website, based on your consent (Article 6(1)(a) GDPR and Article 5 of Portuguese Law 41/2004 on electronic communications privacy).
• How long: about 13 months, then deleted automatically.

Contact form

When you send us a message we receive your name, email address, company (if you give it), the topic and your message, and that you confirmed reading this policy. For security we also record a shortened IP address (the last part removed), your country and region, and your browser. Our team gets an email saying that a message has arrived, with its topic and reference only: the message itself stays in our website admin, where only our team can read it.

Why: to answer you (steps you ask us to take, Article 6(1)(b) GDPR, or our legitimate interest in answering enquiries, Article 6(1)(f)). How long: deleted automatically 24 months after we receive it, or sooner if you ask. If we reply by email, that conversation is kept in our mailboxes as business correspondence, for as long as the matter and our legal record-keeping duties require. Our security log records that a message was sent (its reference and topic, not your address) for 24 months.

Job applicants

When you apply for a job we receive your name, email address, phone number and location (if you give them), your LinkedIn or portfolio link, your CV and your note, that you confirmed reading this policy and, only if you ticked it, that you would like us to keep your application for other roles. We also record the same technical details as for the contact form. Your CV is stored encrypted. Our hiring team gets an email saying that an application has arrived, with the role and a reference only: your details and CV stay in our website admin.

• Why: to assess your application and contact you about it (steps taken at your request before a possible contract, Article 6(1)(b) GDPR). If you ticked the box, also to contact you about other suitable roles (your consent, Article 6(1)(a)), which you can withdraw at any time by writing to info@bumatic.com.
• Who sees it: only the Bumatic team members involved in hiring. We record who opens your application and your CV. We read every application ourselves: no decision about you is made by automated means.
• How long: deleted automatically 6 months after we receive it, or 12 months if you asked us to keep it for other roles; sooner if you ask. If you apply by email instead of the form, we handle your email the same way and delete it within the same time. Our security log records that an application was sent (its reference and the role, not your name or address) for 24 months. If you join Bumatic, what is needed for your employment moves to your staff record (see Bumatic staff).

Investor portal

To use the investor portal you create an account with the access code we sent you. We keep your name, organisation, country, email address, phone number (if you give it) and your password, which is stored only in a scrambled, one-way form that nobody, including us, can read. When you create your account you sign our confidentiality agreement (NDA) by typing your name; we keep a record of it: the name you typed, your email address and organisation, the time, a shortened IP address, your approximate location (city and country) and browser, and the exact version of the agreement. We also record which access code you used, when you sign in and which documents you view or download, with a shortened IP address, your country and region, and your browser.

When you create your account, sign in or download a document, our investor relations contact may receive an email saying so, with your name, email address and organisation (never where you were or which device you used). We delete these emails after 24 months, like the record of sign-ins and downloads.

• Why: to give you access to confidential material under the confidentiality agreement and keep it under control (Article 6(1)(b) GDPR); and to protect it from misuse, to be able to prove the agreement, and to follow up with you about a possible investment (our legitimate interests, Article 6(1)(f)).
• What you must give: the fields not marked optional; without them we cannot open your account.
• How long: your account, while you use it: you can delete it yourself at any time under Your data in the portal. If you have not signed in for two years, we email you, and delete the account a month later unless you sign in. The record of the confidentiality agreement you signed is kept for 6 years after your account is deleted, because its duties continue after that (Article 17(3)(e) GDPR). The record of sign-ins and downloads is kept for 24 months. An account whose email address is never confirmed is deleted automatically after 7 days.

Customer accounts

To use the customer portal you create an account with the access code we sent you. For a customer portal account we keep your name, company, country, email address, phone number (if you give it) and your password, stored only in a scrambled, one-way form. For security we also keep a record of when the account is created and confirmed, each sign-in and failed sign-in, password changes and resets, and the deletion of the account, each with a shortened IP address, your country and region, and your browser. When you confirm your email address, our team receives an email with your name, company and email address; we delete it after 24 months.

• Why: to provide the account and the services in it (Article 6(1)(b) GDPR) and to keep it secure (Article 6(1)(f)).
• What you must give: the fields not marked optional; without them we cannot open your account.
• How long: while your account exists. You can delete it yourself at any time under Your data in the portal. If you have not signed in for two years, we email you, and delete the account a month later unless you sign in. The security record is kept for 24 months. An account whose email address is never confirmed is deleted automatically after 7 days.

Bumatic staff

If you work at Bumatic, the staff privacy notice explains how we keep and use your details as your employer in the Bumatic Hub, our company portal.

Newsletter

If you sign up, we email you a link to confirm your address, and you are only subscribed once you open it and confirm (so nobody can subscribe someone else). We keep your email address, when you signed up and confirmed, the page you used, the note you were shown under the form, and, for security, a shortened IP address, your country and region, and your browser when you signed up. Why: to send occasional Bumatic news, based on your consent (Article 6(1)(a) GDPR and Article 13-A of Portuguese Law 41/2004). You can unsubscribe at any time, without giving a reason, by replying to any of our emails or writing to info@bumatic.com. How long: until you unsubscribe; a sign-up that is never confirmed is deleted after 7 days. Our security log records when a subscription was confirmed (not your address) for 24 months.

Emails we send you

When you use a form or an account, the website emails you only what is needed: a receipt with a reference number, a link to confirm your email address or to reset your password, or, if you have not used your account for almost two years, a reminder before we delete it. These emails never repeat what was typed into a form, and the number of emails any one address can receive in a day is limited, so the website cannot be used to send messages to other people. Replies reach our team at info@bumatic.com.

Security log

To detect misuse of our forms and accounts, and to be able to show what happened, we record each form sent, each account created, confirmed or deleted, each sign-in and failed sign-in, each password change, and what our staff do in the website admin, with the time, a shortened IP address (the last part removed), the country and region, and the browser (our legitimate interest, Article 6(1)(f) GDPR). Entries about accounts and sign-ins include the email address used; entries about forms keep only the form's reference. If a sign-in fails for an address that has no account, or a sign-up is refused, the address is not kept. If a sign-up is never confirmed, its entry (with the address typed) is kept like the others. Entries cannot be edited and are deleted automatically after 24 months.

Cookies and similar technologies

Apart from the visit statistics, which run only if you allow them (see Website analytics), we use only cookies that are strictly necessary for something you ask for, such as staying signed in, so they need no consent. We do not use advertising or tracking cookies, and no other company sets cookies through our website.

Service providers and transfers

We use a small number of providers who process data for us under data processing agreements:

• Netlify (Netlify, Inc.) hosts this website and runs its forms and portals. The data described above is stored in Netlify’s EU data centre in Frankfurt, Germany; the website’s programs that handle forms and sign-ins currently run in Netlify’s data centre in the United States. Netlify is a US company (see below for how transfers are protected).
• Resend (Resend, Inc.) delivers the emails the website sends, from its EU region in Ireland. Resend is a US company; the same safeguards apply.
• Microsoft (Microsoft 365) hosts Bumatic's own email and files: the emails the website sends our team (described above) arrive in our mailboxes there. Microsoft is a US company; the same safeguards apply.

Transfers to the United States rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (10 July 2023) for providers certified under it, and on the standard contractual clauses in each provider's data processing agreement. You can ask us for a copy of these safeguards at info@bumatic.com.

Every page, typeface and script of this website is served from our own hosting: your browser does not contact other companies’ servers when you visit it.

We do not sell personal data or share it with anyone for their own marketing.

Security

The website is served over HTTPS only. Passwords are stored as one-way scrypt hashes; sign-in attempts, sign-ups and forms are limited to stop guessing and abuse; staff access is restricted to named people; strict security headers stop other websites injecting code into ours; and we record who opens job applications, investor activity and requests about personal data.

Backups. Once a month our CEO, CTO or CFO downloads a backup copy of what the website keeps (accounts, signed agreements, applications, messages, newsletter sign-ups and the security log; never passwords), so that nothing is lost if something goes wrong. It is kept encrypted in Bumatic's own Microsoft 365 storage, in a folder only they can open, and only the latest one or two copies are kept: what we delete also leaves the backups within about two months.

Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict its use, or to receive it in a portable format, and you can withdraw any consent at any time (this does not affect what was done before). You can change or delete your customer or investor account yourself in the portal; for anything else, write to info@bumatic.com. We answer within one month.

Your right to object. Where we rely on our legitimate interests (security records, the record of investor sign-ins and downloads, following up with investors, answering enquiries), you can object at any time, on grounds relating to your particular situation, by writing to info@bumatic.com. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims (for example the record of a confidentiality agreement you signed). You can always object to any use of your data for direct marketing, and we will stop.

Giving us your details is up to you. To reply to a message we need your name, email address and message; to consider an application, your name, email address and CV; to open an account, the fields not marked optional; for the newsletter, your email address. Without them we cannot do these things.

No automated decisions. We do not make decisions about you based solely on automated processing.

Children. Our website is not directed at children: please do not use our forms or accounts if you are under 16.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

Legal information

Brumagaláctica Unipessoal, Lda (trading as Bumatic), a Portuguese single-member private limited company (sociedade unipessoal por quotas). Registered office: Rua António Joaquim Araújo 56, 1.º Esq., 2300-555 Tomar, Portugal. Commercial registration and tax identification number (NIPC): 518972593. Email: info@bumatic.com.

Changes

If we change how we use personal data, we will update this page and its version date. This version (2026-10-04): our monthly backup copies are described (under Security), and customer accounts are opened with an access code we send you. Version 2026-10-03: visit statistics only with your permission; job applications kept for 6 months, or 12 if you ask; emails to our team carry references instead of your details; accounts not used for two years are deleted after a reminder; no city is kept, except in a signed agreement.