Privacy Policy

Last updated: 22.10.2026

1. Introduction

MPS ÁGUA, LDA ("Company", "we", "our" or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your personal information when you use the website https://aguaqui.pt/, the AguAqui mobile application, or contact us through customer support (telephone, WhatsApp, Telegram). We comply with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Portuguese data protection laws.

2. Data Controller

MPS ÁGUA, LDA, NIF: 518493938, 2735-340 Sulim Park, Pav. 74, Estrada de Paço de Arcos, Alto da Bela Vista, Agualva Cacém, Sintra, Portugal. Email for privacy matters: business@aguaqui.pt

3. Personal Data We Collect

3.1 Information you provide directly:

• full name;
• mobile phone number, which identifies your account and is used to sign in with a one-time verification code;
• email address;
• billing and delivery address;
• tax identification number (NIF), when you request an invoice;
• order history and delivery preferences;
• information you send us through contact forms, telephone, WhatsApp or Telegram;
• payment information (processed by our payment providers; we do not store full card details).

3.2 Information collected automatically:

• IP address;
• browser type and device information;
• usage data;
• cookies and tracking data;
• device token for push notifications (mobile application).

3.3 Accounts created through customer support: if you place an order through our customer support (telephone, WhatsApp, Telegram), we create a customer account with the data you provide (name, phone number, delivery address) in order to process and deliver your order. You can access this account on the website or in the application with your phone number.

4. How We Use Your Data

Purpose	Legal basis
Creating and managing customer accounts	Performance of a contract
Processing, paying and delivering orders	Performance of a contract
Customer support	Performance of a contract
Service notifications (orders, payments, deliveries, cancellation, failed payment, price change)	Performance of a contract
Managing water subscriptions and their contracts (electronic acceptance, changes, cancellation)	Performance of a contract
Keeping proof of contract acceptance	Legitimate interests and legal obligations
Invoicing and accounting	Legal obligation
Preventing fraud and securing accounts	Legitimate interests
Improving the website, the application and our services; analytics	Legitimate interests / consent (analytics cookies)
Marketing messages and targeted advertising	Consent

5. Payment Processing

Payments are processed securely by:

• Paybyrd (MB WAY and card payments on the website);
• Revolut Business Merchant (card payments and subscriptions via Revolut Checkout).

We do not store full payment card details. Payment data is handled directly by the payment processors in accordance with their privacy and security policies.

For subscriptions, the payment provider keeps a secure token of your card so that the monthly amount can be charged automatically; we never see or store the full card number.

6. Third-Party Service Providers

We may share personal data with the following service providers, only to the extent necessary to provide their services on our behalf:

• Zoho CRM (customer relationship management);
• Paybyrd and Revolut Business Merchant (payment processing);
• WhatsApp (Meta) and Telegram (customer support messages and verification codes);
• Twilio (sending verification codes by SMS);
• Ringostat (call tracking and telephone support);
• Google Firebase and Apple Push Notification service (push notifications);
• Google Analytics, Google Ads and Google Tag Manager (analytics, advertising and tag management);
• Meta Pixel (marketing and advertising);
• Granite (granite.so) (website and application hosting).

These providers process data in accordance with the GDPR.

7. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to ensure its functionality, analyze traffic, improve user experience and deliver targeted advertising (Google Analytics, Google Ads, Meta Pixel). Non-essential cookies are only placed with your consent, which you can manage in the cookie banner or in your browser settings. More information is available in our Cookie Policy.

8. Data Retention

• Customer account and order data: while the account is active and for up to 3 years after the last order.
• Invoices and accounting records: 10 years, as required by Portuguese tax law.
• Marketing data: until you withdraw consent.
• Customer support messages: up to 2 years.
• Subscription contracts and records of electronic acceptance (date, time, channel, IP address): for the duration of the contract and 10 years after it ends.

After these periods, data is deleted or anonymized.

9. Your Rights Under the GDPR

You have the right to:

• access your personal data;
• rectify inaccurate data;
• request deletion ("right to be forgotten");
• restrict processing;
• object to processing, including direct marketing at any time;
• data portability;
• withdraw consent at any time.

To exercise these rights, contact us at business@aguaqui.pt. You also have the right to lodge a complaint with the Portuguese Data Protection Authority: Comissão Nacional de Proteção de Dados (CNPD), https://www.cnpd.pt/

10. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure or destruction, including sign-in with one-time verification codes.

11. International Data Transfers

Some service providers (for example Google, Meta, Apple, Zoho, Telegram, Twilio) may process data outside the European Economic Area (EEA). In such cases, appropriate safeguards such as Standard Contractual Clauses or adequacy decisions are used.

12. Account Deletion and Data Requests

You may request account deletion, access to your stored personal data or correction of inaccurate data by email. Requests will be handled within the legally required timeframe (one month, extendable in the cases provided for by the GDPR).

13. Changes to This Policy

We may update this Privacy Policy periodically. Updates will be published on this page with a revised "Last updated" date, and significant changes will be communicated to registered users.

* In case of discrepancy between the Portuguese and English versions, the Portuguese version shall prevail.