Privacy Policy

Last updated: 2 September 2026

This Privacy Policy describes how Enbiente - Energia e Ambiente, Lda. ("Enbiente") processes the personal data collected through the Enbiwatt site. Processing is carried out in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and with Portuguese Law no. 58/2019 of 8 August, which gives it effect in national law.

1. Data controller

The controller of the personal data collected through this site is:

Entity: Enbiente - Energia e Ambiente, Lda.
Registered office: Rua Santa Isabel, Lote 2, Cave, Repeses, 3500-726 Viseu, Portugal
Company number: PT516571516
Email: [email protected]
Telephone: +351 232 099 900 (Portuguese landline rate)

2. What we collect

Enbiwatt has three forms and a virtual assistant, and each collects different things. We collect only what you give us through them.

The conversation travels with the request. When you leave your details through the assistant, the conversation history is attached to the request recorded in our management system, so the team has the context without asking you to repeat it. If you would rather it were not, use the site's contact form instead.

Contact form

Name: so we can identify you and address you properly in our reply.
Company: to put the enquiry in context, where relevant.
Email: for our reply and any follow-up.
Phone: an alternative way to reach you.
Message: free text, optional, that you chose to share.

Simulator filled in by you

Contact: name, email and phone, so we can send you the result.
Supply point: the installation's address, the meter's CPE code, and your current supplier.
Contract: customer type (home or business), tariff type, metering cycle and contracted power.
Consumption and prices: the kWh and the price per period shown on your bill, the number of days the bill covers, and the standing power charge.
Billing conditions: whether the contract is indexed, whether prices include the TAR grid fee, and whether you would accept direct debit and electronic invoicing.

Sending your bill

Contact: name, email and phone.
The bill itself: the file you send us, as PDF, JPG or PNG, up to 8 MB. An electricity bill normally carries your name, the installation's address, the CPE code and your consumption, and is treated in its entirety as personal data.

Virtual assistant

The text you type in the conversation: including anything you choose to share. The assistant does not ask for personal data in order to talk: it asks only in the contact form it shows inside the conversation, which is presented as such and requires your express agreement.
That form's data: name, email and phone, when you choose to fill it in.
The page language: so the reply is in the right language, and your theme preference.
Your IP address: only indirectly and to prevent abuse, as described in point 3.

3. What we do NOT ask for

Simulating a contract needs no bank details and no identity documents. Enbiwatt does not ask, on any of its forms, for an IBAN, a citizen card, a national identity number or any means of payment, and the forms say so explicitly.

The virtual assistant does not ask for them either. Do not give it, or type into the conversation, your IBAN, your Citizen Card number or any bank details: the assistant does not need them, and the site does not collect them anywhere.

If you are ever asked for any of these in Enbiwatt's name, do not provide them and please tell us.

In addition, the server may technically log, for short periods, the IP address and browser agent, for security and to prevent abuse of the forms (rate limiting per origin).

4. Purposes of processing

Your data is used solely to:

1. Prepare the simulation you asked for, comparing your current contract against the offers available on the market, and send you the result.

2. Reply to your enquiry.

3. Assess a possible service proposal and keep you informed during the commercial stage.

4. Keep a minimal history of commercial interactions for the relevant period.

5. Comply with applicable legal obligations, in particular accounting and tax obligations, where these apply to an established contractual relationship.

We do not use your data for automated marketing, profiling or behavioural advertising, nor for any purpose other than those listed above. We do not sell, rent or transfer your data to third parties for commercial purposes.

5. Legal basis

Processing of your personal data rests on the following bases:

Consent: Article 6(1)(a) GDPR, given when you submit a form with the consent box ticked. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Performance of a contract or pre-contractual steps: Article 6(1)(b) GDPR, where your request develops into the negotiation or performance of a proposal.
Compliance with a legal obligation: Article 6(1)(c) GDPR, in particular accounting, tax and invoicing obligations applying to contracts entered into.
Legitimate interests: Article 6(1)(f) GDPR, for minimal technical security records and prevention of form abuse.

6. Recipients and processors

Your data is accessed by:

The Enbiente team: responsible for reviewing the simulation, commercial contact and any follow-up.
Enbiente's internal middleware: which receives the submission from the site and records it in the company's CRM. This system is operated by Enbiente on its own infrastructure, under its direct control.
Automated reading of the bill: when you send the file, its figures are extracted with the help of automated processing on Enbiente's platform, so that nothing has to be transcribed by hand. The result is always checked by a member of the team before it is sent to you.
Transactional email provider: engaged to send you the simulation result and to notify the team of new submissions. It acts as a processor within the meaning of Article 28 GDPR, under a contract imposing the confidentiality and security duties the Regulation requires.
The language model provider behind the virtual assistant: receives the conversation text in order to generate a reply, and acts as a processor under article 28 GDPR. What is sent is not used to train models. It may be retained by the provider for a limited period for abuse detection and technical logging of the call. This provider does not receive the data you enter in the site's forms, nor the bill you send us: those go directly to Enbiente's management system and never pass through the model.

7. International transfers

With one exception, identified immediately below, your personal data is processed within the European Economic Area (EEA). Outside that exception we make no transfers to third countries, and any change to this policy will be covered by one of the appropriate safeguards in Chapter V GDPR, namely an adequacy decision or standard contractual clauses, with this document updated accordingly.

Exception: the virtual assistant. The language model provider named in point 6 processes the conversation text on infrastructure located in the United States of America. Processing restricted to the EEA is not available on the plan in place.

This transfer is covered by the appropriate safeguards in Chapter V GDPR, namely standard contractual clauses approved by the European Commission and the data processing agreement in place with the provider.

This applies only to the conversation text. Everything you submit in the site's forms, and the bill you attach, stay in the EEA and are not sent to the model provider.

8. Retention periods

The bill file you send us: kept only as long as needed to read its figures and prepare the simulation, and deleted within 12 months at the latest. The extracted figures may be kept without the original file.
Simulations and enquiries with no commercial follow-up: deleted or anonymised 24 months after the last contact, unless there is a legal basis for keeping them longer.
Enquiries with an established contractual relationship: kept for as long as needed to meet the contract's obligations and, after it ends, for the periods required by law, in particular 10 years for accounting and tax purposes (Article 123(6) of the Portuguese Corporate Income Tax Code and Article 52(1) of the VAT Code).
Technical security records: kept only as long as strictly necessary for the purpose that justifies them, as a rule no longer than 12 months.
Virtual assistant conversations: the history is held in server memory for 24 hours after the last message, only to keep the conversation going, and is lost sooner if the service restarts. It is not written to disk and the team cannot read it.
A conversation attached to a request: once you leave your details through the assistant, the copy that accompanies the request follows the periods for contact requests set out above.

9. Your rights

Under the GDPR you have the right, at any time, to:

Access: the personal data we process about you (Article 15).
Rectify: inaccurate or out-of-date data (Article 16).
Erase: your data, the right to be forgotten (Article 17), where the law allows.
Restrict: processing (Article 18).
Portability: receive the data you gave us, in a structured, commonly used format (Article 20).
Object: to processing based on legitimate interests (Article 21).
Withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3)).

[email protected]

10. Right to complain

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, telephone +351 213 928 400.

We would nonetheless encourage you to contact Enbiente first, so that we can try to resolve the matter directly before any formal complaint.

11. Cookies and local storage

This site uses no identification, tracking or marketing cookies.

To remember your light or dark theme preference, one key is written to the browser's local storage (enbiwatt-theme). It is strictly functional, contains no personal data, is never sent to the server, and can be cleared at any time from your browser settings.

Aggregate traffic analysis, where enabled, is provided by Umami, a cookieless analytics service that collects no personal data and cannot identify an individual visitor.

The virtual assistant stores a second key (bia:conversation), in the browser's session storage, so the conversation survives navigation between pages. It is deleted automatically when you close the tab and is never sent to the server. Like the first, it is strictly functional and can be cleared at any time in your browser settings.

The virtual assistant uses no cookies.

12. Security

Enbiente applies technical and organisational measures appropriate to the state of the art and to the risk involved, to protect the confidentiality, integrity and availability of your data, in particular:

No security measure guarantees absolute protection. In the event of a personal data breach involving a high risk to your rights and freedoms, Enbiente will meet the notification duties to the CNPD and the communication duties to data subjects set out in Articles 33 and 34 GDPR.

Encryption in transit: communication between your browser and the site is fully encrypted (HTTPS / TLS).
Authenticated transmission: between the site and the internal middleware, with a key that rotates on a time window.
Security headers: applied to every response (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy).
File validation: the bill is checked for type and size on the server, not only in the browser.
Access control: to the CRM and internal systems, on a need-to-know basis.
Rate limiting: per origin, with logging and periodic review of anomalous attempts.

13. Automated decisions

The comparison between your contract and the market's offers is made automatically from the data you gave us. Its result is an informative recommendation, sent to you to consider: it produces no legal effects, concludes or alters no contract, and binds you to nothing.

The virtual assistant answers questions and helps route your request to the team. It makes no decisions about you: it does not approve or refuse requests, it does not set prices or tariffs, and it does not build profiles. Any proposed contract is prepared and confirmed by a person.

We take no decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR.

14. Minors

We do not knowingly collect data from anyone under 18, the minimum age required to submit the forms under the Terms and Conditions. If you become aware that a minor's data has been given to us without their legal guardians' consent, please contact us so that we can delete it.

Terms and Conditions

15. Changes to this policy

This policy may be updated to reflect legal, regulatory or operational changes. The version in force is always the one published on this page, and the last-updated date shown at the top is the valid reference. Material changes will be flagged visibly before they take effect.