Privacy Policy

Vetzzo, based in Armamar, Douro, Portugal, is the entity responsible for the processing of personal data collected through the vetzzo.com website and the Vetzzo platform (the "Platform").

For any data protection matter, including the exercise of your rights, contact us at vetzzo@proton.me.

Processing is carried out in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 — "GDPR") and Portuguese Law no. 58/2019 of 8 August.

This policy explains what personal data we collect, for which purposes and on which legal bases, who we share it with, how long we keep it and what rights you have. It applies to buyers, website visitors, scout applicants and people who take part in the referral programme. The relationship with scouts as service providers is additionally governed by their service agreement.

We collect only the data necessary to provide our service:

• Account and authentication data: full name, email address and password (stored as a secure hash).
• Contact data: mobile phone number (optional, used for WhatsApp/SMS notifications).
• Import request data: make, model, year and specifications of the desired vehicle, budget, preferred countries of origin and, where applicable, tax number (NIF) and address for invoicing and import purposes.
• Referral programme data: if you create a referral code, your name and Portuguese mobile number, and the code we assign to you; when a buyer enters the code of the person who referred them in an import request, that code is stored with the request.
• Contract and acceptance data: record of acceptance of the Terms and the Service Agreement, including date, time and IP address, as well as the express consent to early start of the inspection — kept as evidence.
• Payment data: processed directly by Stripe. Vetzzo does not store full card details; it only receives confirmation and a transaction reference.
• Scout application data (where applicable): identification, professional qualifications, supporting documents and countries of operation.
• Technical and usage data: pages visited and interactions with the Platform, collected through essential session cookies.
• Communications: content of the messages you send us (email, contact forms) and a log of notifications sent.

We do not collect special categories of data (health data, beliefs, etc.).

We process your data only where a legal basis exists, under Article 6 of the GDPR:

• Account management and secure authentication — performance of the contract (art. 6(1)(b)).
• Provision of the import service and coordination between buyer and scout (inspection, transport, ISV, DAV, IMT, registration) — performance of the contract (art. 6(1)(b)).
• Sending transactional notifications about the status of your order (email, WhatsApp, SMS) — performance of the contract (art. 6(1)(b)). These communications are necessary to provide the service and do not constitute marketing.
• Invoicing and compliance with Portuguese tax and accounting obligations — compliance with a legal obligation (art. 6(1)(c)).
• Referral programme — creating and managing your code, linking to it the import requests of the people you refer, checking eligibility and paying the reward — performance of a contract or steps taken at your request before entering into one (art. 6(1)(b)).
• Keeping the referral code on your device so it is not lost — only with your consent (art. 6(1)(a) GDPR and art. 5 of Portuguese Law no. 41/2004).
• Sending marketing communications (news, promotions) — only with your prior consent (art. 6(1)(a)), which you may withdraw at any time.
• Security, fraud prevention and service improvement based on usage metrics — Vetzzo's legitimate interest (art. 6(1)(f)), balanced against your rights.

Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

We clearly distinguish two types of communication:

• Transactional communications — they inform you about the status of your order and are an integral part of the contracted service. While you have an active order, they cannot be cancelled without ceasing to receive the service.
• Marketing communications — we only send these if you have given prior, specific consent. You can unsubscribe at any time via the link in each message or by contacting vetzzo@proton.me.

We share data only to the extent necessary and with entities bound by confidentiality and security obligations. Our processors (art. 28 GDPR) are:

• Supabase — database, authentication and file storage. Hosted in the eu-west-2 region (London, United Kingdom), a third country covered by a European Commission adequacy decision.
• Stripe — payment processing. Entity based in the USA; transfers under the Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
• Resend — sending transactional emails.
• Twilio — sending WhatsApp and SMS notifications. Entity based in the USA; transfers under the SCCs and the EU-US Data Privacy Framework.
• Vercel — hosting and delivery of the web application (EU infrastructure, with possible transfer to the USA under the SCCs/Data Privacy Framework).
• Mapbox — map display on the tracking dashboard. Entity based in the USA; transfers under the SCCs/Data Privacy Framework.
• Anthropic — internal team assistant: when the Vetzzo team drafts a reply to a buyer, the buyer's name, request description and message are sent to the Anthropic (Claude) API to suggest wording. Entity based in the USA; transfers under the SCCs/Data Privacy Framework.

In addition, your data may be disclosed to:

• The scout you select — name and vehicle details strictly necessary to carry out the inspection (see section 7).
• Administrative partners and authorities — official customs broker (despachante), IMT and the Portuguese Tax and Customs Authority (AT), where necessary to complete the import and comply with legal obligations.

We never sell your personal data to third parties.

When you select a scout through the Platform, we share with them the data necessary for the inspection. The scout processes that data on behalf of and under the instructions of Vetzzo, as a processor under Article 28 of the GDPR, and is contractually required to:

• use the data exclusively to carry out the assigned inspection;
• not retain it beyond what is necessary to complete and deliver the report;
• apply appropriate security measures and maintain confidentiality;
• notify Vetzzo without delay of any data breach.

Some of our processors are based outside the European Economic Area. In those cases, we ensure the transfer benefits from appropriate safeguards under Articles 44 to 49 of the GDPR, namely:

• United Kingdom (Supabase/London) — under the European Commission's adequacy decision.
• United States (Stripe, Twilio, Mapbox, Anthropic and, where applicable, Vercel) — under the Standard Contractual Clauses (SCCs) approved by the European Commission and/or participation in the EU-US Data Privacy Framework.

You may request more information about these safeguards at vetzzo@proton.me.

We keep data only for as long as necessary for each purpose:

• Account data — while the account is active; deleted within 30 days of a cancellation request, unless a legal retention obligation applies.
• Order, contract and inspection report data — for the duration of the contractual relationship and, after its conclusion, for as long as necessary to exercise or defend legal claims (applicable limitation period).
• Records of contract acceptance and consent (date, time, IP) — for the same period, as evidence.
• Tax and accounting documents — 10 years, as required by Portuguese tax and commercial legislation.
• Referral programme data (name, mobile number and code) — 2 years after the code was created or, if later, after the last import request that used it; then deleted automatically and the code stops working. If a reward was paid to you, the payment record is kept for 10 years, like the tax documents above. The code a buyer entered in their request stays with that request, for the periods that apply to requests.
• Unsuccessful scout application data — up to 12 months, then deleted.
• Records of marketing consent and objection — for as long as needed as proof of GDPR compliance.
• Communications (emails, notifications) — up to 2 years.

You may request deletion of your account at any time via vetzzo@proton.me, without prejudice to the legal retention periods above.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure, including password hashing, access controls, secure connections (HTTPS) and the selection of processors offering security guarantees. In the event of a data breach posing a risk to your rights, we will comply with the notification duties under Articles 33 and 34 of the GDPR.

Under the GDPR, you have the following rights:

• Access — obtain confirmation and a copy of the data we process about you (art. 15).
• Rectification — correct inaccurate or incomplete data (art. 16).
• Erasure — request deletion of your data, unless a legal retention obligation applies (art. 17).
• Restriction — restrict processing in certain circumstances (art. 18).
• Portability — receive your data in a structured, commonly used format (art. 20).
• Objection — object to processing based on legitimate interest and, at any time, to processing for marketing purposes (art. 21).
• Withdrawal of consent — at any time, where processing is based on your consent.

To exercise these rights, contact us at vetzzo@proton.me. We will respond within the legal period of one month.

You also have the right to lodge a complaint with the supervisory authority, the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt.

The Platform is intended exclusively for people aged 18 or over. We do not knowingly collect data from minors. If we become aware that we have collected data from a minor without a valid basis, we will delete it.

We may update this policy whenever necessary. Material changes will be communicated to registered users by email, and the last-updated date at the top of this page will be revised. The version in force at the time of each processing operation applies.

For any matter related to the privacy and protection of your personal data: vetzzo@proton.me — Vetzzo, Armamar, Douro, Portugal.