Privacy Policy

The Nazaré platform, managed by the Municipality of Nazaré, is committed to protecting the privacy of its users. This privacy policy describes how we collect, use, store, and protect personal data, in accordance with the General Data Protection Regulation (GDPR) and Law No. 58/2019.

1. Introduction

This policy applies to all personal data collected through our platform and mobile application. By using the platform, the user agrees to the collection and use of information as stipulated in this policy.

2. Collection of Personal Data

2.1. Types of Data Collected

The Nazaré.pt Marketplace may collect the following personal data:

• Identification Data: First name, last name, email address, phone number;
• Account Data: Username, password;
• Payment Data: Banking information (e.g., IBAN), data related to payment methods;
• Browsing Data: IP address, cookies, geolocation;
• Communication Data: Messages sent through customer support, notes, reviews, and questions left about products;
• Satisfaction Data: Responses to satisfaction surveys.

2.2. Methods of Collection

Data is collected in the following situations:

1. Registration on the Platform: During the account creation process, users provide necessary personal information;
2. Browsing and Use of Features: Through cookies and other technologies, the Marketplace collects data on users’ browsing behavior, including pages visited and time spent in each section;
3. Interaction with Customer Services: Information is collected during interactions with customer support, including calls, emails, and chats;
4. Responses to Surveys and Feedback: User satisfaction data is collected through surveys and feedback forms sent after purchases or interactions.

3. Purposes of Data Collection

Nazaré uses personal data for the following purposes:

• Execution and Management of Contracts: Management of purchase and sale or service contracts;
• Order Processing: Management and processing of purchase orders;
• Communication with Clients: Clarifying doubts and effective communication with users;
• Processing Information Requests: Responding to requests for additional information;
• Handling Complaints: Managing complaints, including regulator processes, pre-litigation, or exercising rights in legal proceedings;
• Statistical Analysis Activities: Conducting statistical analyses to improve services provided;
• System Development: Verification, maintenance, and development of systems and statistical analyses.
• Direct Marketing Communications: Sending marketing communications, if the user has consented to the processing of personal data for this purpose;
• Fraud Prevention and Control: Implementing measures to prevent and combat fraud;
• Requesting Feedback: Collecting feedback on purchased products or services;
• Conducting Satisfaction Surveys: Carrying out surveys to assess customer satisfaction;
• Event and Campaign Management: Management and participation in events, contests, and promotional campaigns.

4. Who Has Access to the Data

The Nazaré.pt Platform Management Team takes all precautions to safeguard personal data against any loss, unauthorized access, modification, intrusion, alteration, disclosure, or destruction.

Access to Information:

• The Platform Management Team: The Nazaré.pt management team has access to information from both merchants and buyers strictly for platform management and operation purposes;
• Sellers: Sellers have access to buyers’ information only to the extent necessary to process orders and provide services. This access is strictly controlled, and sellers are not authorized to use personal data for any purpose other than fulfilling their contractual obligations.

The Nazaré.pt Platform Management Team cannot be held responsible for risks associated with the functioning of the Internet, which it does not control. We encourage users to be particularly aware of the risks of data loss or confidentiality breaches of transmitted data. The same applies in cases of force majeure or any event beyond the control and responsibility of the Platform Management Team.

5. Permission Management

Permissions can be managed directly in the device settings or in the application.

6. User Rights

In accordance with the General Data Protection Regulation (GDPR), users have the following rights:

• Right of Access: This right allows users to consult information on the processing operations concerning them, such as the type of data and the source of collection. It also allows them to request a copy of all information related to the user, regardless of the legal basis for processing;
• Right to Rectification: If there is any error in the provided data or if information needs to be updated, users have the right to update their data, regardless of the legal basis of processing;
• Right to Withdraw Consent: If users have given their consent to process personal data, they have the right to withdraw this consent at any time;
• Right to Restrict Processing: Users may request the limitation of the processing of their personal data;
• Right to Portability: This right allows users to request their data when processed based on consent or a contractual relationship. In this case, the entity in charge must provide the data in a technically usable format;
• Right to Object: Users have the right to object to the processing of their data, especially when processing is based on the controller’s “legitimate interest,” provided this interest is not considered “overriding”;
• Right to Erasure: If data is processed based on consent or legitimate interest (not overriding), users may request deletion of their personal data. To do so, they simply need to withdraw consent or object to processing;
• Right Regarding Data After Death: Users have the right to define directives regarding the retention, deletion, or communication of their personal data applicable after death.

Users may exercise the above rights via the Electronic Form available for this purpose.

Data Retention

Users’ personal data is retained according to the following guidelines:

• Payment Data: Stored for up to 3 years after the date of the transaction;
• Contractual Relationship: Data is kept during the contractual relationship. If there is inactivity exceeding 3 years since the last contact with the customer, the data will be deleted;
• Exercise of Rights: Data related to requests for exercising rights is kept for 5 years after the response, then deleted;
• Fraud Prevention: Data stored for 7 years from response date, then archived for an additional 7 years;
• Illegal Product Reports: Data related to reports is stored for 3 years from the date of report, then deleted;

7. Security of Personal Data

We implement appropriate technical and organizational measures to protect personal data. However, users should be aware that no data transmission over the Internet is completely secure.

8. Changes to the Privacy Policy

We reserve the right to update this policy, recommending that users regularly check for updates.

Date of last update: 29/07/2025