Data Protection

Bernays is operated as a sole proprietorship in Portugal. For the purposes of GDPR, Bernays is the data controller for the limited personal data we hold about you (account email, profile, audit records of your activity). For data inside your agency's workspace (clients, invoices, projects), your agency is the controller and Bernays is the processor.

• Authentication: email, password hash, IP, user agent.
• Profile: full name, role, optional avatar URL, employment metadata (job title, manager).
• HR-extended profile (only when enrolled): NIF, IBAN, salary, emergency contact. Field-level encrypted at rest with key versioning (AES-256-GCM).
• Activity audit: which actions you took, when, from which IP. Tamper-evident via daily ed25519-signed hash chain.

• Contract — for client invoicing, proposal handling, normal product use.
• Legitimate interest — for security telemetry and audit logging (low intrusiveness, high necessity).
• Legal obligation — for retention of invoicing and fiscal data (Portuguese fiscal law: 10 years).
• Consent — for explicit-consent activities (e.g. optional marketing communications). Recorded in a dedicated consents table; revocable at any time.

Bernays uses a small number of EU-friendly vendors. SCCs / DPAs are executed or pending with each.

• Active accounts: while your relationship with the agency is active + 1 year.
• Invoices and fiscal records: 10 years (Portuguese fiscal law).
• Audit log: 7 years (legal defence + forensic).
• Sessions: revoked on sign-out; otherwise auto-deleted after 24h.
• Erasure-requested data: 14-day grace, then PII scrubbed.

• Access & portability (Art. 15, 20) — download a JSON bundle of your data at Settings → Security → Export my data.
• Erasure (Art. 17) — delete your account at Settings → Security → Delete account. We revoke sessions immediately; PII is scrubbed after a 14-day grace window. Fiscal and audit records are retained for the legal minimum.
• Rectification (Art. 16) — most fields are editable directly in your profile. Email a request to the address below for fields you cannot self-edit.
• Object / restrict processing (Art. 18, 21) — contact us by email; we will pause processing where consent or legitimate-interest is the basis.
• Complaint — you may complain to the Portuguese supervisory authority, CNPD, or to the supervisory authority of your habitual residence.

Engineering controls are tracked in our internal DPIA (see docs/standards/security/dpia.md). Highlights:

• Authentication: passwords + 2FA (TOTP) + Passkeys (WebAuthn), magic link, per-account brute-force lockout.
• Session security: __Host- + HttpOnly + Secure + SameSite=Strict cookies, UA-anomaly detection, step-up reauth on sensitive mutations.
• Field-level encryption (AES-256-GCM) on NIF, IBAN, salary, government IDs.
• Tamper-evident audit log (daily ed25519 attestation), CSP Level 3 with nonce + strict-dynamic + Trusted Types, HSTS preload.
• Webhook signing + idempotency + 5-min replay window (Stripe, Resend).
• CI: SBOM (CycloneDX), gitleaks, semgrep, CodeQL, npm audit, license compliance.

For data-protection requests or questions, email privacy@bernays.pt. We respond within 30 days as required by GDPR Art. 12(3).