Provisional text, subject to legal review before publication.
1. Data controller
[ENTITÉ À DÉFINIR]. Contact for privacy matters: contact@thulis.com.
2. What data we collect
In the contact form: first name, last name, email, company, job title, phone, company size and your message. With your consent: anonymous audience measurement.
3. Why
To respond to your request and arrange a demo (pre-contractual steps), and, if you agree, to measure the website's audience in order to improve it (consent).
4. For how long
Contact data is kept for up to 3 years after the last contact, unless you become a customer.
5. Who has access
Our team and our technical service providers (hosting in the European Union), bound by contract. Your data is not sold or passed on.
6. Your rights
Access, rectification, erasure, restriction, portability and objection: write to contact@thulis.com. You may also lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
7. Data processed on the platform
The data customers enter on the Thulis platform is processed on their behalf, under the contract and the data processing agreement (Article 28 GDPR).
8. Google and Microsoft accounts connected to the platform
In the Thulis platform (app.thulis.com), each user may choose to connect their Google or Microsoft 365 account; this connection is never mandatory. Google Calendar (scopes: identity, email address, calendar.events): Thulis reads, creates, updates and deletes events in the user's primary calendar, solely to synchronise their appointments both ways with the Thulis calendar; no other Google data is accessed (no emails, contacts or files). Microsoft 365 (scopes: profile, Mail.Read, Mail.Send, Calendars.ReadWrite): Outlook calendar synchronisation, sending the platform's emails from the user's mailbox, and reading emails to attach them to platform records. This data is used only to provide these features: it is not sold, not used for advertising, not transferred to third parties and not used to train artificial intelligence models, and no one on our team reads it, except with the user's explicit consent (support), for legal compliance or for security purposes.
9. Retention and Limited Use of Google data
Access tokens are encrypted and hosted in the European Union. The user can disconnect their account at any time (Settings → Integrations), which deletes the tokens, or revoke access from their Google account (myaccount.google.com/permissions) or Microsoft account. Thulis's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.