1. Introduction
Comprar Empresa, Unipessoal Lda. ("We", "Company" or "Data Controller"), based in Portugal, is committed to protecting the privacy of users ("User" or "Data Subject") of the platform comprar-empresa.pt ("Platform").
This Privacy Policy describes how we collect, use, share and protect your personal data, in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and Law No. 58/2019 of 8 August.
2. Data Controller
Entity: Comprar Empresa, Unipessoal Lda.
Email: [email protected]
Address: Portugal
3. Personal Data Collected
3.1 Data provided directly by the User
- Identification data: name, email, phone, NIF (when applicable)
- Account data: access credentials, communication preferences
- Advertisement data: information about published businesses
- Communications: messages exchanged through the Platform
3.2 Data collected automatically
- Technical data: IP address, browser type, operating system
- Usage data: pages visited, time spent, clicks
- Cookies and similar technologies: as described in our Cookie Policy
3.3 Data obtained from third parties
- Social authentication: basic profile data when using login with Google or Facebook
- Payment services: transaction confirmation (without card data)
4. Purposes and Legal Basis for Processing
| Purpose | Legal Basis (Art. 6 GDPR) | Data Used |
|---|---|---|
| Account creation and management | Contract execution | Name, email, phone |
| Advertisement publication | Contract execution | Business data, contact |
| Facilitating contact between users | Contract execution | Messages, contact data |
| Payment processing | Contract execution | Billing data |
| Service communications | Legitimate interest | Email, name |
| Marketing (with consent) | Consent | Email, preferences |
| Platform analysis and improvement | Legitimate interest | Usage data |
| Fraud prevention | Legitimate interest | Technical data, usage patterns |
| Compliance with legal obligations | Legal obligation | As required by law |
5. Data Sharing
5.1 Categories of Recipients
- Other Users: data necessary to facilitate transactions
- Service providers: hosting, email, payments, analysis
- Authorities: when required by law or court order
5.2 International Transfers
Some of our service providers may be located outside the European Economic Area. In these situations, we ensure that there are adequate safeguards, namely:
- Decisions of adequacy by the European Commission
- EU standard contractual clauses
- Certifications (e.g. EU-US Data Privacy Framework)
6. Retention Period
| Type of Data | Retention Period |
|---|---|
| Active account data | During the account's validity |
| Published advertisements | 2 years after expiration |
| Messages between users | 1 year after the last interaction |
| Billing data | 10 years (tax obligation) |
| Usage data | 26 months |
| Data after account deletion | 30 days (backup), except for legal obligations |
7. Your Rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15): to obtain confirmation and a copy of your data
- Right to rectification (Art. 16): to correct inaccurate or incomplete data
- Right to erasure (Art. 17): to request the deletion of your data
- Right to restriction (Art. 18): to restrict processing in certain circumstances
- Right to data portability (Art. 20): to receive your data in a structured format
- Right to object (Art. 21): to object to processing based on legitimate interest
- Right to withdraw consent: at any time, without affecting the lawfulness of prior processing
7.1 How to Exercise Your Rights
You can exercise your rights through:
- Email to: [email protected]
- Settings of your account on the Platform
We will respond within a maximum of 30 days. We may request identity verification.
7.2 Right to Complain
You have the right to lodge a complaint with the National Data Protection Commission (CNPD):
Website: www.cnpd.pt
Email: [email protected]
8. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Data encryption in transit (TLS/SSL) and at rest
- Role-based access control
- Secure authentication with two-factor option
- Monitoring and intrusion detection
- Regular backups and recovery plans
- Team training in data protection
9. Cookies and Tracking Technologies
We use cookies and similar technologies for:
- Essential operation of the Platform
- Usage and performance analysis
- Personalisation (with consent)
- Marketing (with consent)
You can manage your cookie preferences through the cookie banner or browser settings.
10. Minors
The Platform is not intended for individuals under 18 years of age. We do not intentionally collect data from minors. If we become aware of such collection, we will delete the data immediately.
11. Automated Decisions
We do not use fully automated decision-making processes that produce significant legal effects on Users. Any automated analysis is supervised by humans.
12. Changes to This Policy
We may update this Policy periodically. Significant changes will be communicated through:
- Highlighted notice on the Platform
- Email to registered users
- Updating the "Last updated" date
13. Contact
For questions regarding this Policy or the processing of your data:
Email: [email protected]
Subject: Data Protection - [Description of request]