Privacy policy

Who handles your data

LXWH Spaces, Lda., company no. (NIPC) 513 149 651, registered at Praceta da Tabaqueira A2, 1950-256 Lisboa, which runs the Lisbon WorkHub spaces, is the controller of your data.

For any question about your data, write to lisbon@workhub.pt.

What we collect on the website

Only what you give us in the forms, and some technical data:

• Name, email, phone or mobile and, if you give it, your company.
• Your VAT number (NIF), when you ask for an invoice with it on a purchase.
• The message or notes you write.
• For a visit: the building, the day and time you chose and what you're looking for.
• The space you're interested in, in a quote request, a purchase or on the waiting list.
• The campaign tags (UTM) of the link you arrived by, when the link has them.
• The language you use the website in.

Card and IBAN details are entered directly on Stripe's payment page and never reach Lisbon WorkHub.

We don't ask for sensitive data. Please don't include it in your message or notes.

What we use it for, and on what legal basis

• Answering your requests and booking visits: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• Waiting list for a space: the same basis, steps at your request before a contract.
• Online purchases and contracts: performance of the contract (Article 6(1)(b)). Invoicing: compliance with legal obligations (Article 6(1)(c)).
• If you are a member, to provide the service, give you access to the space, handle mail received in your name and send community announcements by email, which you can stop with one click: our legitimate interest in running the spaces and the community (Article 6(1)(f)).
• Video surveillance in the spaces, to protect people and property: legitimate interest (Article 6(1)(f)). Images are kept for 30 days.

The "I have read and accept the Privacy Policy" box on the forms confirms that you have read this policy. The legal basis for each use is the one given above.

We don't sell your data or use it for advertising.

Who we share it with

Your data is only seen by the Lisbon WorkHub team and by the service providers we use, who process it on our behalf, as processors:

• Supabase: the database of our management system, hosted in the European Union (Ireland).
• Vercel: website hosting, in the European Union (Dublin). It logs technical data for each visit (IP address, browser, page requested) to run and protect the site.
• Google Workspace: our email and documents.
• Stripe: online payments.
• TOConline: certified invoicing, in Portugal.
• OfficeRnD: member management, until we finish moving to our own system. While purchases are made through OfficeRnD, the purchase pages show the OfficeRnD store, and what you fill in there goes straight to OfficeRnD.

If you message us on WhatsApp, the conversation goes through Meta's services, under WhatsApp's own terms.

Some of these providers are US companies. Where data is transferred outside the European Union, the transfer relies on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

How long we keep it

• Requests and contacts that don't become clients: anonymised 24 months after the last contact.
• Online orders that are never paid: deleted after 30 days.
• Visitor and entry records for the spaces: 12 months.
• Former clients' personal data: anonymised 12 months after the relationship ends.
• Invoices and accounting records: 10 years, as required by law.
• Emails and operational records: 24 months.
• Video surveillance images: 30 days.

If you ask us to delete your data before then, we will, except for what the law requires us to keep.

Your rights

You can ask us at any time to:

• access your data;
• correct it (rectification);
• erase it;
• restrict how we use it;
• object to its use, in particular where the basis is legitimate interest;
• receive it in a format you can take to another service (portability);
• withdraw your consent, where the processing is based on it.

Just write to lisbon@workhub.pt. We reply within one month.

If you think we haven't handled your data properly, you can complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).

Cookies and browser storage

The website doesn't use tracking cookies, analytics or advertising tools. Fonts are served by the site itself.

• When you start booking a visit on the home page, your browser keeps your email and what you're looking for in that tab only (sessionStorage), to fill them in on the next page. That data is removed straight after, or when you close the tab.
• Your browser remembers whether you collapsed the side menu (localStorage). This isn't personal data and doesn't leave your computer.
• While purchases are made through OfficeRnD, the purchase pages load the OfficeRnD store, which may use its own cookies or storage, under OfficeRnD's terms.

Changes

If we change this policy, we'll publish the new version here with its date.