Privacy & your data
Document version: 2026-10-21
The operator’s statutory identification is incomplete. These documents remain a draft pending the tax identification and business establishment address.
Operator: João Martins, Lagos, Portugal. Contact: geral@novyst.com
Privacy contact email: geral@novyst.com
Data and purposes
The operator identified above is responsible for personal data processed by SourceEU. We use account identity, email, password hash, language and security preferences to provide the account; company details, sourcing requests, proposals, files and messages to provide business introductions and collaboration; and subscription references for billing. Company, product, quantity, budget range, timing and project stage help the platform team and suppliers you contact understand your declared needs. Providing the required account fields is necessary to register; “not decided” is available for budget and timing. Do not submit sensitive personal information in project or profile text.
Legal bases and visibility
Account and project processing is necessary to provide the requested service. Billing records also support legal obligations. Security, abuse prevention and limited service statistics support our legitimate interests in operating a reliable platform, balanced against your rights. Optional newsletters depend on separate consent, which you may withdraw. Manufacturer names and full profiles are accessible to accounts with confirmed email. Buyer profiles, requests and conversations are not public: access is limited to their authorised participants and authorised staff for support, moderation or security. Readiness labels reflect your answers; they do not automatically reject you or assess creditworthiness.
Providers and international processing
KnownHost supplies hosting, server storage, backups and the cPanel email infrastructure. Stripe processes subscription payments; SourceEU stores payment references and status, not full card numbers or security codes. Tax invoicing uses Portugal’s Autoridade Tributária portal. Providers may process data outside the European Economic Area. Their published privacy and transfer information is linked below; applicable contractual safeguards and provider arrangements must be confirmed for the operator’s account. Data is disclosed to authorities when legally required and to project participants when you choose to contact them. We do not sell buyer profiles.
Cookies, records and retention
The secure session cookie lasts one day, or 30 days if you choose Remember me. The language cookie lasts up to one year. Cookie preferences may be saved locally in your browser. Optional internal statistics and Google Analytics only load after consent; advertising features are disabled. Search logs omit account identifiers, redact recognised emails and phone numbers, and are removed after 90 days by maintenance. Account information remains while the account is used; deletion removes or anonymises account details and withdraws company profiles and requests. Shared messages, support, moderation and billing records may remain where needed for other participants, dispute handling or applicable retention duties. Retention requests are reviewed individually; backups follow the hosting provider’s retention cycle.
Your rights and complaints
You may request access, correction, erasure, restriction, portability where applicable, or object to processing based on legitimate interests. Withdraw newsletter consent through its preferences link. Account settings allow profile updates, data export and an account deletion request. Contact the privacy email above for assistance or a review of your readiness information. We normally respond within one month; if a lawful extension is needed, we explain it within that period. You may complain to Portugal’s CNPD or another competent supervisory authority. These rights may be limited by lawful retention duties or the rights of others. We will explain any refusal.
Optional analytics
With your permission, our internal statistics measure public page views, approximate visit sources and registrations. No names, emails, full URLs or private projects are collected. A random visit cookie lasts 30 minutes; internal analytics records are deleted after 90 days. Your choice lasts 180 days and can be changed in Cookie preferences.
Google Analytics
With your permission, Google Analytics also measures public page views. Google receives technical device and connection data, without account details or URL query strings. Google cookies last 30 minutes. Advertising features are disabled. Google may process data outside the EEA under its safeguards. You can withdraw consent here at any time.
Google Analytics
Google Analytics retains individual event and user data for two months without extending retention for new activity. Aggregated reports may remain longer. Our internal visit records are deleted after 90 days by scheduled maintenance.