Privacy Policy
1. Who we are
The controller is José Covas Education Academy, Lda, a Portuguese private limited company (sociedade por quotas), with registered office at Avenida Engenheiro Duarte Pacheco, Torre 1, Piso 2, Escritório 10, 1070-101 Lisbon, Portugal, registered with the Portuguese Commercial Registry under legal person and registration number 519 093 500, share capital EUR 1,000. Contact: academy@josecovas.com. Telephone: +351 962 802 463.
2. Scope
This Privacy Policy explains how personal data are processed when you visit shiftindex.org, contact us or, once the sales function is activated, purchase and receive a product. The public website does not require an account. An account is created only when you buy, and only to give you access to what you bought.
3. Personal data we may process
- Technical and security data: IP address, browser and device information, request time, pages requested, error records, security events and similar server or content-delivery logs generated when the website is accessed.
- Usage data: pages viewed, search terms entered on the site, the point reached in the purchase process, and the country supplied by our content-delivery network, each recorded against a daily code that cannot be linked to a device or person once that day has passed (see section 5). We do not use advertising trackers or cross-site behavioural identifiers.
- Purchase and delivery data (once sales are activated): name where supplied, email address, country or tax-location information, order or receipt identifier, product purchased, amount, currency, tax information, payment status and delivery records. Sales are processed by Paddle as Merchant of Record; full payment-card details are entered with and handled by Paddle and are not received or stored by us.
- Account data (once sales are activated): the email address you sign in with; the kinds of work you have access to and the edition each relates to; the date of each purchase and the Paddle transaction reference; and short-lived technical tokens used to sign you in and to keep you signed in. There are no passwords. You sign in by asking for a link, which we send to your email address; the link can be used once and expires after a short period. We do not store card details, billing addresses, invoices or any payment data — those are held by Paddle as Merchant of Record, and we link to your Paddle receipt rather than reproduce it.
- Communications: information contained in enquiries, support requests, privacy requests, complaints and related correspondence.
- Compliance records: evidence of consent, acceptance of terms, invoices, transaction records and information required to establish, exercise or defend legal claims.
4. Purposes and legal bases
We process personal data to operate and secure the website, prevent abuse and diagnose faults, based on our legitimate interests in providing a secure and reliable service; to produce limited aggregate analytics, based on legitimate interests where permitted and consent where legally required; to set up access, deliver the products, manage the licence and provide support, where necessary to perform a contract or take steps at your request before entering into a contract; to retain our own accounting and transaction records and respond to authorities, where necessary to comply with legal obligations; and to manage disputes and legal claims, based on legitimate interests and applicable law.
5. Cookies and analytics
The website operates without advertising cookies, cross-site tracking or third-party analytics services. We measure use of the website ourselves, and we do so without cookies, without browser storage and without any identifier that persists beyond a single day. For each request we derive a short code by combining the IP address and browser identification with a random value that is generated daily, held only in temporary storage and never retained. Once that daily value expires, the code cannot be linked back to a device or a person by anyone, including us. We record the code, the page or search term requested, and the country supplied by our content-delivery network. We do not store the IP address for this purpose. Essential technical storage may be used only where required for security, network operation or a function requested by the user. If this configuration changes or non-essential cookies are introduced, this policy and the consent mechanism will be updated before deployment.
If you create an account, we set one cookie when you sign in. It exists only to keep you signed in, is not used for advertising, analytics or tracking, and is deleted when you sign out or when it expires. Because it is strictly necessary to provide a service you asked for, it does not require your consent — but we tell you about it here.
6. Service providers and recipients
We use service providers for website hosting, content delivery and security, analytics, email delivery, accounting and professional support. Current providers may include Cloudflare and Resend. Other providers may act as our processor or as independent controllers depending on the activity. Personal data may also be disclosed to professional advisers, courts, regulators, tax authorities or law-enforcement bodies where required or legally justified.
Purchases are processed by Paddle, acting as authorised reseller and Merchant of Record. Paddle processes, as an independent controller, the data required for the transaction, including payment, tax, fraud prevention, the transaction receipt and buyer support, under its own Privacy Notice. José Covas Education Academy, Lda processes, as an independent controller, the data it receives or collects to deliver the product, manage the licence, provide support, maintain security records and comply with its own legal obligations. The Academy does not receive or store full payment-card details.
7. International transfers
Some providers may process personal data outside the European Economic Area. Where this occurs, transfers are made on a lawful basis, such as an adequacy decision, approved standard contractual clauses or another safeguard recognised under data-protection law. The database in which website usage records are stored is hosted in the European Union. Information about the relevant safeguards may be requested at academy@josecovas.com, subject to lawful confidentiality restrictions.
8. Retention
Account data are kept for as long as the account exists. You can export everything held in your account, or delete the account, from inside it; deletion removes the account and its access record, and does not affect invoices and accounting records that we are required by law to retain.
Technical and security logs are retained for the shortest period needed to operate and protect the website, normally no longer than 30 days, unless a longer period is required to investigate an incident. Aggregate analytics are retained for no longer than 24 months. Website usage records described in section 5 are deleted automatically 180 days after they are collected. Product-delivery and routine support records are normally retained for 24 months. Our accounting records and supporting transaction documents are retained for the period required by Portuguese tax and accounting law, generally 10 years. Consent and dispute records may be retained for the applicable limitation period where necessary to demonstrate compliance or protect legal rights. Data are deleted or anonymised when no longer required.
9. Your rights
Subject to applicable law, you may request access to your personal data, rectification, erasure, restriction, portability or information about processing, and may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing. These rights are not absolute and may be limited where data must be retained by law or for legal claims.
10. Automated decisions and children
We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects. The website and the products are not directed at children, and we do not knowingly request personal data from children under 16.
11. Security
We apply proportionate technical and organisational measures intended to protect personal data. No internet service can be guaranteed to be completely secure, and users should avoid sending unnecessary confidential information by email.
12. Complaints and contact
To exercise a right or raise a privacy question, contact academy@josecovas.com. You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).
13. Changes
We may update this policy to reflect changes in the website, providers or law. The current version will show its effective date, and material changes will be highlighted where appropriate. Effective date: 1 August 2026. Last updated: 20 August 2026.