Privacy Policy

The data controller responsible for personal data collected through the Auto Porto platform is Auto Porto, a company registered in Portugal and operating the marketplace at auto-porto.com.

For any data protection enquiry or to exercise your rights, contact our team at contact@auto-porto.com. We will respond within 30 calendar days.

• Creating and managing your user account and profile.
• Processing, fulfilling and tracking your orders.
• Sending order confirmations, invoices, shipping updates and customer support responses.
• Verifying seller identity and compliance at registration and during account review.
• Improving the platform's performance, search relevance and user experience through analytics.
• Detecting and preventing fraud, abuse and other illegal activity.
• Sending promotional emails and newsletters where you have given explicit consent.
• Complying with tax, accounting and other legal and regulatory obligations.

• Sellers — receive your name, delivery address and order details necessary to fulfil your purchase.
• Payment providers — Stripe and equivalent processors receive transaction data to process payments securely.
• Logistics partners — carriers and delivery services receive the shipping information required to deliver your order.
• Analytics providers — aggregated, anonymised usage data is shared with analytics tools to improve the platform.
• Authorities — data may be disclosed to competent authorities when required by law, court order or to protect rights and safety.

We use cookies and similar technologies to operate the platform, remember your preferences, maintain your session and analyse traffic patterns. Cookies are small text files stored on your device by your browser.

• Essential cookies — required for the platform to function (session, cart, login). Cannot be disabled.
• Preference cookies — remember your language, currency and display settings.
• Analytics cookies — collect anonymised data on how visitors use the site to help us improve it.
• Marketing cookies — track your browsing to show you relevant advertisements. Only set with your consent.

You can manage or revoke cookie preferences at any time through the cookie banner or your browser settings. Disabling non-essential cookies will not affect your ability to browse or purchase on the platform.

We retain personal data only for as long as is necessary to fulfil the purposes described in this policy or as required by applicable law.

• Transaction records — retained for 7 years for tax and legal compliance.
• Account data — kept for the duration of your account plus 3 years after closure.
• Marketing data — retained until you withdraw consent or unsubscribe.
• Technical logs — typically retained for up to 12 months for security monitoring.

When data is no longer required it is securely deleted or anonymised so that it can no longer be linked to any individual.

To exercise any right, contact us at contact@auto-porto.com. You also have the right to lodge a complaint with your national supervisory authority (e.g. CNPD in Portugal, CNIL in France, ICO in the UK).

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:

• SSL/TLS encryption on all data transmitted between your browser and our servers.
• PCI-DSS compliant payment processing — we never store full card details.
• Access controls ensuring that only authorised personnel can access personal data.
• Regular security audits and vulnerability assessments of our infrastructure.
• Secure data centres with physical access controls and environmental protections.

Despite these measures, no internet transmission is 100% secure. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the competent supervisory authority within 72 hours as required by the GDPR.

Some of our third-party service providers (e.g. payment processors, analytics tools) may process data outside the European Economic Area (EEA). Where such transfers occur, we ensure that adequate protections are in place through:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Transfers to countries that benefit from an EU adequacy decision.
• Binding Corporate Rules where applicable within corporate groups.

We may update this Privacy Policy periodically to reflect changes in our practices, technology or legal obligations. The date at the top of the page indicates the most recent revision.

For material changes, we will notify you by email or via a prominent notice on the platform at least 14 days before the changes take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.