In short
The Blue Ocean mobile app only processes the data needed to provide your services; it does not collect data for advertising and does not track you. We do not sell your data. You can exercise your rights and delete your account at any time via privacy@bocean.pt.
Data controller
BOCEAN IMMIGRATION PORTUGAL, LDA
NIPC 519043731
Av. da Liberdade, 67-B, 3.º B, 1250-140 Lisboa, Portugal
info@bocean.pt · +351 21 824 7167
Controller and Data Protection Officer (DPO)
The data controller is the entity identified above. For any data protection matter, contact our Data Protection Officer (DPO) at privacy@bocean.pt.
Scope
This policy applies to the App and complements the website Privacy Policy (bocean.pt). In case of any conflict regarding the App, this policy prevails.
Personal data we process
We process only the data needed to provide the services. We do not collect data for advertising and do not track you across apps or websites (no tracking). The following categories summarise the data processed:
| Category | Data |
|---|---|
| Account and authentication | Name, email, password (stored encrypted) and a session token on the device |
| Client profile | Date of birth, nationality, marital status, occupation, identification document number, tax number (NIF), address, postal code, city, country of residence and phone |
| Documents | Files you upload or that the team makes available (e.g. passport, proof of address, powers of attorney, contracts) |
| Communications | Messages exchanged with the Blue Ocean team inside the App |
| Requests / cases | Status and history of your requests |
| Technical and device data | Push notification identifier, device model and minimal technical logs for operation and security |
Purposes and legal bases (GDPR, art. 6)
We process your data for the following purposes, on the legal bases indicated. Special categories of data are processed only when strictly necessary for the case and with an appropriate legal basis.
| Purpose | Legal basis |
|---|---|
| Create and manage your account and provide the contracted services (NIF, residency, visas, etc.) | Performance of a contract — art. 6(1)(b) |
| Comply with legal obligations, including anti-money-laundering and document retention | Legal obligation — art. 6(1)(c) |
| App security, fraud prevention and technical logs | Legitimate interest — art. 6(1)(f) |
| Sending push notifications | Consent — art. 6(1)(a) (you can disable it in your device settings) |
Who has access (processors)
We do not sell personal data. Data may be processed on our behalf and under contract (art. 28 GDPR) by the processors below. We only share data with authorities when required by law (e.g. the Portuguese Tax Authority and AIMA).
| Processor | Purpose | Location |
|---|---|---|
| Google Cloud | Server hosting and infrastructure | European Union |
| Google Workspace / Google Drive | Document storage | EU/US — appropriate safeguards |
| Apple Push Notification service | Push notifications | US — appropriate safeguards |
| Electronic signature platform | Electronic signing of documents, where applicable | EU/US — appropriate safeguards |
International transfers
Data is hosted in the European Union. Where a processor involves a transfer outside the European Economic Area, we ensure appropriate safeguards (European Commission Standard Contractual Clauses or an adequacy decision).
Retention
We keep data only for as long as necessary for the stated purposes and applicable legal periods; after that it is deleted or anonymised:
| Data | Retention period |
|---|---|
| App account | While the account is active |
| Documents and case records | 7 years after the end of the business relationship, as required by anti-money-laundering law (Law no. 83/2017) |
| Technical logs | Limited period, for security |
Security
Data is transmitted over encrypted connections (HTTPS). Access is token-based and passwords are stored encrypted. We apply technical and organisational measures appropriate to the risk.
Your rights
You have the right of access, rectification, erasure ("right to be forgotten"), restriction, portability and objection, and to withdraw consent at any time. To exercise them, contact privacy@bocean.pt. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt (opens in a new tab).
Deleting your App account
You can delete your account directly in the App, under Account → Delete account. Access is removed immediately. Data subject to legal retention is kept only for the mandatory period and then deleted or anonymised, as described under "Retention".
Minors
The App is intended for adults. Data of minors is processed only within family cases, provided and authorised by the responsible adult.
Changes
We may update this policy. Material changes will be communicated in the App or by email. The date at the top indicates the latest version.
Contact
Privacy questions: privacy@bocean.pt — BOCEAN IMMIGRATION PORTUGAL, LDA, Av. da Liberdade, 67-B, 3.º B, 1250-140 Lisboa, Portugal.