SAV · GenwinIT
SAV application privacy notice
SAV is a B2B application restricted to customer organisations and their authorised users. This notice covers accounts, use and support of the application. The public website and commercial enquiries have a separate notice; customer documents are also subject to your organisation’s instructions and data-processing agreement.
Draft last updated:
1. Who provides SAV
SAV is provided by Genwinit unipessoal, Lda (GenwinIT). Contact: geral@genwinit.pt; Rua Serpa Pinto nº 74, 1º, 2350-552 Torres Novas, Portugal. These details reflect the identity and contact address published by GenwinIT.
For questions about data managed by your employer or another customer organisation, also contact that organisation. This email is a general privacy contact and does not identify an appointed data protection officer.
2. GenwinIT and your organisation
Where it determines its own purposes, such as managing customer relationships, providing support and protecting its service, GenwinIT is the controller for that processing. Not all account data or technical records necessarily belong to this context: the allocation depends on the specific purpose and contract.
When processing documents and business information solely on the customer’s instructions, GenwinIT acts as a processor. The customer organisation determines purposes, legal basis, access and the information owed to employees, customers, suppliers and other individuals. This notice does not replace the organisation’s notice or the data-processing agreement.
3. Data and its sources
Use may involve names, business email addresses, employee codes, authentication data, company and permissions, invitations, preferences, support requests and technical activity records. Data comes from users, organisation administrators or use of the service.
Depending on the modules used, the organisation supplies accounting documents and metadata, tax identifiers, invoices, payslips, accounts and banking transactions, employee names and leave dates, expenses, journeys and vehicle registration plates. Data may come from uploads, authorised integrations or text extracted from documents. Documents may contain third-party or specially protected data; the organisation must assess the need and lawful conditions for its processing.
4. Purposes and legal bases
Account features manage invitations, authenticate users, recover access, apply permissions and send service communications. Document and business modules support archiving, searching, extraction, consultation and authorised sharing, as well as leave and expense administration. Where performed on the customer’s behalf, these operations follow its instructions; the customer determines the applicable legal basis.
For our own purposes, business contact management, support and security are proposed on the basis of legitimate interests in administering and protecting the service, subject to assessment and balancing. Contract performance applies only where the individual is a party to that contract; a company contract does not automatically make this basis applicable to its employees. Specific legal obligations and, where required, consent are separate bases.
5. Access, communications and integrations
Organisation data is made available to users and accountants whom it grants access and to providers needed for the contracted operation. Exports, downloads and integrations may create copies outside SAV under the recipient’s responsibility.
The application includes configurable integrations for Amazon S3 storage, organisation or service SMTP email, Tawk.to support and extraction using an OpenAI-compatible service. Their presence in the product does not confirm activation or identify the actual contracted provider in each environment. The applicable subprocessor list must identify active services, functions and locations before the corresponding use.
Where used, the local document-upload module may retain failed files and communicate filenames, paths, sizes and dates to configured report recipients. Organisations should define access and local retention. Providers used by the public website form are not automatically providers of these application communications.
6. Measurement, diagnostics and support
Google Analytics, Hotjar and New Relic were identified on the currently available login page. These services are associated with usage measurement, interaction analysis and performance or error diagnostics, potentially processing identifiers, browser data, pages and events.
Restricted access and a B2B relationship do not remove information or legally required consent obligations. The presence of scripts does not demonstrate a previous user choice. Contact geral@genwinit.pt to clarify available choices.
7. Browser storage
The application uses localStorage for authentication context, selected company, date filters, PIN access state and language and per-user company preferences. This storage may contain identifiers, name and access context. It is not a cookie, but it also stores information on the device.
Some preferences persist after logout and have no explicit expiry in the reviewed implementation. Clearing site data in the browser removes local data and may end access or reset preferences; it does not erase server-side records. On shared devices, sign out and avoid saving access preferences.
8. OCR and AI-assisted extraction
OCR converts documents into text. Artificial-intelligence-assisted extraction can turn invoice and bank-statement text into structured fields and, when enabled, send that text to the configured external service. Do not assume that all document processing is local or that text is anonymised before transmission.
Results can contain errors and should be checked before accounting, tax, employment or financial use. Extraction alone is not a solely automated decision with legal effects. No such process has been confirmed in this preparation; any uses with significant effects require their own information and safeguards.
9. Retention and leaving the service
Documents and data processed on the customer’s behalf follow the retention, return and deletion instructions agreed with the organisation, including at contract termination. Deleting a file in the interface does not demonstrate immediate removal of backups, previous versions, exports or messages already sent.
Account, support and security data processed for our own purposes should be kept only as needed for the purpose and applicable obligations or defence of legal claims. The public contact form’s 14-day log period is not the application’s retention period.
10. Locations and international transfers
Storage and access depend on providers and settings of the contracted service. A European location for a public form component does not establish that application documents, support, monitoring and copies remain in the European Economic Area.
For transfers outside this area, the applicable information must identify destinations and the legal mechanism, such as an adequacy decision or standard contractual clauses with necessary measures. Request information and access to the relevant safeguards at geral@genwinit.pt.
11. Your rights and requests
Under the applicable conditions, you may exercise access, rectification, erasure, restriction, portability and objection, and withdraw consent without affecting previous processing. Rights concerning solely automated decisions also apply in the cases provided by law.
For GenwinIT’s own processing, send requests to geral@genwinit.pt. For documents and records controlled by your organisation, contact that organisation; GenwinIT provides the assistance required of it as processor. Proportionate identity verification may be needed. The usual response period is one month, subject to legal extensions and exceptions. You may lodge a complaint with the CNPD and seek a judicial remedy.
12. Points awaiting confirmation
Before approval, we will confirm legal bases for our own processing, active services and features, provider entities, transfer destinations and safeguards, retention periods and backup deletion. Monitoring settings, collected data and consent controls also remain pending. This draft does not confirm that an appropriate choice mechanism exists.
13. Information before using the service
This notice should be available before data collection, including at invitation or onboarding and on the login page, and remain accessible within the application. Preparing this page does not change the current login or onboarding screens; linking it at those points remains an implementation task.
Necessary authentication data and permissions enable access; without them, use of the service may not be possible. The organisation should identify any other mandatory data and the consequences of not providing it. Material notice changes should be communicated appropriately, without replacing renewed consent where required. The date above identifies this working version, not publication.