Privacy Policy

Vetzzo, based in Armamar, Douro, Portugal, is the entity responsible for the processing of personal data collected through the vetzzo.com website and the Vetzzo platform (the "Platform").

For any data protection matter, including the exercise of your rights, contact us at privacidade@vetzzo.com.

Processing is carried out in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 — "GDPR") and Portuguese Law no. 58/2019 of 8 August.

This policy explains what personal data we collect, for which purposes and on which legal bases, who we share it with, how long we keep it and what rights you have. It applies to buyers, website visitors and scout applicants. The relationship with scouts as service providers is additionally governed by their service agreement.

We collect only the data necessary to provide our service:

• Account and authentication data: full name, email address and password (stored as a secure hash).
• Contact data: mobile phone number (optional, used for WhatsApp/SMS notifications).
• Import request data: make, model, year and specifications of the desired vehicle, budget, preferred countries of origin and, where applicable, tax number (NIF) and address for invoicing and import purposes.
• Contract and acceptance data: record of acceptance of the Terms and the Service Agreement, including date, time and IP address, as well as the express consent to early start of the inspection — kept as evidence.
• Payment data: processed directly by Stripe. Vetzzo does not store full card details; it only receives confirmation and a transaction reference.
• Scout application data (where applicable): identification, professional qualifications, supporting documents and countries of operation.
• Technical and usage data: pages visited and interactions with the Platform, collected through essential session cookies.
• Communications: content of the messages you send us (email, contact forms) and a log of notifications sent.

We do not collect special categories of data (health data, beliefs, etc.).

We process your data only where a legal basis exists, under Article 6 of the GDPR:

• Account management and secure authentication — performance of the contract (art. 6(1)(b)).
• Provision of the import service and coordination between buyer and scout (inspection, transport, ISV, DAV, IMT, registration) — performance of the contract (art. 6(1)(b)).
• Sending transactional notifications about the status of your order (email, WhatsApp, SMS) — performance of the contract (art. 6(1)(b)). These communications are necessary to provide the service and do not constitute marketing.
• Invoicing and compliance with Portuguese tax and accounting obligations — compliance with a legal obligation (art. 6(1)(c)).
• Sending marketing communications (news, promotions) — only with your prior consent (art. 6(1)(a)), which you may withdraw at any time.
• Security, fraud prevention and service improvement based on usage metrics — Vetzzo's legitimate interest (art. 6(1)(f)), balanced against your rights.

Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

We clearly distinguish two types of communication:

• Transactional communications — they inform you about the status of your order and are an integral part of the contracted service. While you have an active order, they cannot be cancelled without ceasing to receive the service.
• Marketing communications — we only send these if you have given prior, specific consent. You can unsubscribe at any time via the link in each message or by contacting privacidade@vetzzo.com.

We share data only to the extent necessary and with entities bound by confidentiality and security obligations. Our processors (art. 28 GDPR) are:

• Supabase — database, authentication and file storage. Hosted in the eu-west-2 region (London, United Kingdom), a third country covered by a European Commission adequacy decision.
• Stripe — payment processing. Entity based in the USA; transfers under the Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
• Resend — sending transactional emails.
• Twilio — sending WhatsApp and SMS notifications. Entity based in the USA; transfers under the SCCs and the EU-US Data Privacy Framework.
• Vercel — hosting and delivery of the web application (EU infrastructure, with possible transfer to the USA under the SCCs/Data Privacy Framework).
• Mapbox — map display on the tracking dashboard. Entity based in the USA; transfers under the SCCs/Data Privacy Framework.

In addition, your data may be disclosed to:

• The scout you select — name and vehicle details strictly necessary to carry out the inspection (see section 7).
• Administrative partners and authorities — official customs broker (despachante), IMT and the Portuguese Tax and Customs Authority (AT), where necessary to complete the import and comply with legal obligations.

We never sell your personal data to third parties.

When you select a scout through the Platform, we share with them the data necessary for the inspection. The scout processes that data on behalf of and under the instructions of Vetzzo, as a processor under Article 28 of the GDPR, and is contractually required to:

• use the data exclusively to carry out the assigned inspection;
• not retain it beyond what is necessary to complete and deliver the report;
• apply appropriate security measures and maintain confidentiality;
• notify Vetzzo without delay of any data breach.

Some of our processors are based outside the European Economic Area. In those cases, we ensure the transfer benefits from appropriate safeguards under Articles 44 to 49 of the GDPR, namely:

• United Kingdom (Supabase/London) — under the European Commission's adequacy decision.
• United States (Stripe, Twilio, Mapbox and, where applicable, Vercel) — under the Standard Contractual Clauses (SCCs) approved by the European Commission and/or participation in the EU-US Data Privacy Framework.

You may request more information about these safeguards at privacidade@vetzzo.com.

We keep data only for as long as necessary for each purpose:

• Account data — while the account is active; deleted within 30 days of a cancellation request, unless a legal retention obligation applies.
• Order, contract and inspection report data — for the duration of the contractual relationship and, after its conclusion, for as long as necessary to exercise or defend legal claims (applicable limitation period).
• Records of contract acceptance and consent (date, time, IP) — for the same period, as evidence.
• Tax and accounting documents — 10 years, as required by Portuguese tax and commercial legislation.
• Unsuccessful scout application data — up to 12 months, then deleted.
• Records of marketing consent and objection — for as long as needed as proof of GDPR compliance.
• Communications (emails, notifications) — up to 2 years.

You may request deletion of your account at any time via privacidade@vetzzo.com, without prejudice to the legal retention periods above.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure, including password hashing, access controls, secure connections (HTTPS) and the selection of processors offering security guarantees. In the event of a data breach posing a risk to your rights, we will comply with the notification duties under Articles 33 and 34 of the GDPR.

Under the GDPR, you have the following rights:

• Access — obtain confirmation and a copy of the data we process about you (art. 15).
• Rectification — correct inaccurate or incomplete data (art. 16).
• Erasure — request deletion of your data, unless a legal retention obligation applies (art. 17).
• Restriction — restrict processing in certain circumstances (art. 18).
• Portability — receive your data in a structured, commonly used format (art. 20).
• Objection — object to processing based on legitimate interest and, at any time, to processing for marketing purposes (art. 21).
• Withdrawal of consent — at any time, where processing is based on your consent.

To exercise these rights, contact us at privacidade@vetzzo.com. We will respond within the legal period of one month.

You also have the right to lodge a complaint with the supervisory authority, the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt.

We use only essential cookies, necessary to keep your session authenticated and ensure the secure operation of the Platform. We do not use tracking cookies, behavioural advertising cookies or third-party marketing cookies. As they are strictly necessary for the service you request, these cookies do not require prior consent under Portuguese Law no. 41/2004. Should we introduce non-essential cookies in the future (for example, analytics), we will ask for your consent beforehand.

The Platform is intended exclusively for people aged 18 or over. We do not knowingly collect data from minors. If we become aware that we have collected data from a minor without a valid basis, we will delete it.

We may update this policy whenever necessary. Material changes will be communicated to registered users by email, and the last-updated date at the top of this page will be revised. The version in force at the time of each processing operation applies.

For any matter related to the privacy and protection of your personal data: privacidade@vetzzo.com — Vetzzo, Armamar, Douro, Portugal.