Introduction
Portal Lusitano is committed to protecting the personal data of its users, in compliance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and Portuguese Law No. 58/2019 of August 8. This policy describes how we collect, use, store and protect your personal data.
Personal Data Collected
In the context of using our website, we may collect the following personal data:
- Identification data: full name, tax identification number (for horse sellers)
- Contact data: email address, phone number, postal address
- Browsing data: IP address, browser type, pages visited, date and time of access
- Transaction data: information relating to purchases and payments processed via Stripe
- Newsletter data: email address for sending communications
- Professional profile data: name, specialty, location (for registered professionals)
Purpose of Processing
Your personal data is processed for the following purposes:
- Account management and portal authentication
- Processing horse sale listings and associated payments
- Sending newsletters and informational communications (with your consent)
- Continuous improvement of the website and user experience
- Compliance with legal and tax obligations
- Management of the equestrian professionals directory
Legal Basis for Processing
The processing of your personal data is based on the following legal bases, as per Article 6 of the GDPR:
- Consent: for sending newsletters and marketing communications (Article 6(1)(a))
- Performance of contract: for processing sale listings and commercial transactions (Article 6(1)(b))
- Legitimate interest: for improving our services and website security (Article 6(1)(f))
- Legal obligation: for compliance with tax and legal obligations (Article 6(1)(c))
Data Retention Period
Your personal data is retained for the period strictly necessary for the purposes that motivated its collection:
- Account data: while the account is active, and up to 12 months after closure
- Transaction data: 10 years, as required by Portuguese tax obligations
- Newsletter data: until consent is withdrawn
- Browsing data and cookies: up to 13 months (as per CNPD guidelines)
Data Subject Rights
Under the GDPR, data subjects have the following rights:
- Right of access: obtain confirmation and access to your personal data
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request the deletion of your data ("right to be forgotten")
- Right to restriction: restrict processing in certain circumstances
- Right to data portability: receive your data in a structured, commonly used format
- Right to object: object to processing based on legitimate interest or direct marketing
To exercise any of these rights, send an email to portal.lusitano2023@gmail.com indicating the right you wish to exercise and the identification of the data subject.
Cookie Policy
Our website uses cookies to ensure its operation and improve the browsing experience. The cookies used are divided into the following categories:
- Essential cookies: necessary for the website to function (session, language preferences, cookie consent). Cannot be disabled.
- Analytics cookies (Google Analytics): allow us to understand how visitors use the site, anonymously and in aggregate. Can be refused.
- Marketing cookies (Meta Pixel): used to measure the effectiveness of advertising campaigns. Can be refused.
You can manage your cookie preferences at any time through the cookie banner or your browser settings.
Data Sharing with Third Parties
Your personal data may be shared with the following third parties, exclusively for the purposes described:
- Stripe: secure payment processing (PCI DSS certified)
- Supabase: secure data and image storage
- Google Analytics: statistical analysis of website usage
- Meta (Facebook Pixel): advertising campaign measurement
- Brevo (formerly Sendinblue): newsletter delivery
Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction or alteration, including SSL/TLS encryption, access control and continuous monitoring.
Right to Complain
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD):
CNPD — Comissão Nacional de Proteção de Dados, Av. D. Carlos I, 134 — 1st floor, 1200-651 Lisbon, Tel: +351 213 928 400, Website: www.cnpd.pt
Changes to This Policy
We reserve the right to update this privacy policy at any time. Any significant changes will be communicated through the website. We recommend periodically consulting this page.