Privacy policy

Who is responsible

PeerVio is a service operated from Portugal and the contact for everything relating to data is contacto.peervio@gmail.com.

Each institution is responsible for processing its applicants' data. For that data, PeerVio acts as a processor, handling it on the institution's instructions.

PeerVio is independently responsible for the data of your PeerVio account (name, email, encrypted password and preferences), which you can reuse to contact several institutions, for the data of people who visit our site and for the professional contacts described below.

What data we process

Depending on your role, we process:

Applicants:

• first name (visible to whoever you talk to) and surname (not shared); email; sign-in method (link, password or Google account); areas or courses of interest; consent to marketing communications; conversation content; date and time of messages; the page of the institution's site where you opened the chat and the origin of the visit (the site you came from, such as a search or a social network, and the campaign parameters of the link, without storing the full address); technical data (hashed version of the IP address and browser, to limit abuse).

Ambassadors and staff:

• name; email; profile photo; course, year and introduction; availability; conversation content; content they publish.

Administrators:

• name; email; job title; records of actions in the dashboard.

What we use data for and on what basis

Each use has its legal basis:

• connecting applicants with students and staff and enabling the conversation, and sending notifications by email and, if you enable them, on your device: performance of the service you asked for and the institution's legitimate interest in replying to those who contact it;
• giving the institution a dashboard to follow conversations, manage people and see aggregated statistics, including where applicants come from and on which pages of the site they open the chat: the institution's legitimate interest;
• ensuring security and limiting abuse (for example, with the hashed IP address and with an anti-bot check from Cloudflare when creating an account or recovering the password): legitimate interest;
• when the institution turns it on, sending your contact to its CRM (email, area of interest, funnel stage, the channel you came from, marketing consent, date of the first conversation and a short summary): your consent, which you can withdraw at any time. The content of messages is never copied to the CRM;
• marketing communications from the institution: your consent, which you can withdraw at any time.

We do not do targeted advertising, profiling or automated decisions, and we do not sell your data.

Professional contacts

When we contact or are contacted by people who work at an institution, we process the name, professional email, job title and content of messages. We obtain this data from institutions' websites, from colleagues' referrals or from direct contact by those who write to us, and we use it to propose and provide the service. The basis is the legitimate interest in contacting professionals in connection with their role, and you can object at any time by writing to contacto.peervio@gmail.com; we will stop contacting you. We keep this data while there is a relationship with the institution and, with no reply, for a maximum of 24 months after the last contact.

Our website

If you fill in the "Let's talk?" form, the email you enter is sent through the formsubmit.co service to our mailbox, so that we can reply to you. We measure the site's audience with Cloudflare Web Analytics, which does not use cookies or create individual profiles. Our pages load fonts from Google, which means your IP address reaches Google when you visit the site.

Minimum age

The service is intended for people aged 16 or older. We do not intentionally collect data from people under 16; if we learn that this has happened, we delete the data concerned.

Who we share it with

We share data only when necessary:

• with the students and staff of the institution you choose to talk to;
• with the institution's own CRM, only when it turns it on and with your consent;
• with processors who help us provide the service: Supabase (database and authentication, on servers in the European Union, Ireland), Netlify (hosting and distribution of pages), Resend (transactional email), Google (sign-in with a Google account, if you choose it, and fonts), Cloudflare (site audience measurement and anti-bot check when creating an account or recovering the password) and formsubmit.co (site form);
• with authorities, when the law requires it.

International transfers

Database data is processed in the European Union. Some processors may process data outside the European Economic Area, for example in the United States; in those cases, the transfer is covered by appropriate safeguards, such as a European Commission adequacy decision or the European Union's standard contractual clauses. When an institution is outside the European Union, including in Brazil and Mexico, the transfer of applicants' data to it is governed by the data processing agreement, and local data protection laws also apply, such as the LGPD in Brazil and the LFPDPPP in Mexico.

How long we keep it

By default, applicants' data and conversations are kept for two years after the last interaction and are then irreversibly anonymised (only aggregated statistics remain). The institution may set another period, within what the law allows. You can delete your account at any time from the service itself; we delete the account data without undue delay and within 30 days at most, unless the law requires us to keep some of it.

Your rights

You have the right of access, rectification, erasure, portability, restriction and objection to the processing of your data, and you can withdraw at any time a consent you have given, without affecting what was done before. You can exercise them in the service itself or by email to contacto.peervio@gmail.com, saying what you want; we may ask you for information to confirm who you are. We reply within 30 days. If your data is processed by an institution as controller, we forward the request to it.

You also have the right to lodge a complaint with the data protection authority of your country. In Portugal it is the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt). We would appreciate the chance to resolve it first, but you are not obliged to.

Security

We apply technical and organisational measures appropriate to the risk. Connections are encrypted in transit, data is encrypted at rest, and each institution's data is isolated from any other's, with that isolation enforced at the database level itself. Internal access is restricted to what is strictly necessary.

We do not detail the specific measures here, for security reasons. Institutions that use the service receive the full description in the data processing agreement they sign with us.

Cookies and similar technologies

We only use the storage strictly necessary to keep you signed in. Audience measurement is done without cookies. We do not use advertising cookies or cross-site tracking.

Links to other sites

Our service may contain links to third-party sites, including your institution's, which have their own privacy policies and for which we are not responsible.

Changes and contact

We may update this policy; the date above shows the version in force and, when the change is important, we will let you know before it takes effect. For any privacy question, contact contacto.peervio@gmail.com.