Privacy Policy | Auto Events

At Auto Events, protecting your personal data is a priority. This policy clearly and transparently explains how we collect, use, store and protect your data when you use our platform, in accordance with the General Data Protection Regulation (GDPR).

Our tips for safe use

Your online security is a priority. To protect your data and avoid risks, we recommend:

Use strong, unique passwords and change them regularly;
Avoid sharing personal information on unsecured public Wi-Fi networks;
Use private browsing on shared computers or networks;
Be cautious of suspicious emails and check the sender before clicking a link, to avoid phishing;
Keep devices and applications updated to benefit from the latest security measures.

Small actions provide valuable protection.

1. Who is the data controller?

Auto Events, owned by Rafael Duarte De Salvi, a self-employed individual with tax identification number (NIF) 310797063 and registered address Rua da República da Bolívia, 18, 1500-061 Lisboa, Portugal, is the controller of personal data processed through www.autoeventos.pt and its associated services (together, the “Platform”).

This policy applies to anyone browsing the Platform, whether a “User” or “Registered User”, acting personally or as a professional or company representative (“Professional User”), in accordance with Regulation (EU) 2016/679 (GDPR), Portuguese Law No. 58/2019 of 8 August and other applicable national legislation.

For questions about processing your personal data, contact:

privacidade@autoeventos.pt;
Our Data Protection Officer (DPO) at epd@autoeventos.pt;
Our Data Protection Officer, Roger Pereira do Santos, at epd@autoeventos.pt.

2. What data do we collect?

We collect different categories depending on your use of the Platform, such as browsing, creating an account or publishing an event. Some data is necessary to provide services; other data is collected with your consent.

2.1 Categories of personal data processed

Identification data:

Surname, first name and nickname;
Identity documents, such as an identity card, passport or tax number, in certain professional cases;
Profile photograph;
Handwritten or digital signature in certain professional cases.

Contact details:

Email address, telephone number and postal address in certain professional cases.

Login details and encrypted password;
IP address, device type, browser and operating system;
Geolocation data, if enabled by the User;
Session data and connection logs.

Browsing and interaction data:

Page views, clicks and event searches;
Listings viewed or published;
Saved filters and saved events.

Evaluation and behavioural data:

Satisfaction survey data;
Professional-specific data when using services as a representative or professional: name and contact details of the legal representative, proof of representation powers where applicable, and information on events published in a professional capacity.

2.2 Automatically collected data

When browsing Auto Events, we automatically collect:

Technical device information, including model, language, timing and technical identifiers;
IP address and estimated geolocation;
Browsing path, clicks and visit duration;
Cookies and trackers, as explained in the Cookie Policy.

2.3 Data from third-party services

If you sign in through Google or Apple, we receive your first name, surname, email, profile picture and technical identifier, depending on the permissions granted. This information is used to create or complete your user profile.

2.4 Communication data

If you communicate through our messaging service, we collect and store the exchanged content;
If you participate in calls or UX tests with our team, with consent, those exchanges may be recorded for training or quality analysis.

2.5 Children’s data

Our services are not intended for children under 16, in accordance with Article 8 GDPR and Portuguese Law No. 58/2019.

We do not knowingly collect personal data from children under 16. If we discover that a child below that age has provided personal data, we will delete it immediately unless verifiable consent has been given by the holder of parental responsibility.

Parents or legal guardians who learn that a child has provided data without their consent should immediately contact privacidade@autoeventos.pt.

3. Processing purposes and legal bases

In accordance with the GDPR and Law No. 58/2019, Auto Events processes personal data for clearly identified, legitimate purposes on appropriate legal bases.

3.1 Processing necessary to perform a contract or take pre-contractual steps

We use personal data to provide the services requested through the Platform, including:

Creating and managing your account;
Publishing or managing automotive events;
Managing searches and favourites;
Customer service, including contacts, complaints and technical incidents;
Transactional communications by email, SMS or telephone connected with your Platform activity.

In some cases, data may be shared with third-party contractual partners strictly to provide these services.

3.2 Processing based on legitimate interests

We may process data for Auto Events’ legitimate interests, provided these do not override your fundamental rights and freedoms. These include:

Fraud prevention and secure Platform use;
Analysing Platform use to improve services, subject to cookie acceptance;
Sending information about services similar to those already used, unless you object.

3.3 Processing based on a legal obligation

Data may be processed to comply with legal obligations, including responding to public or judicial authorities, combating money laundering and terrorist financing, and retaining tax or accounting records.

3.4 Processing based on your consent

Some processing relies on explicit consent under Article 6(1)(a) GDPR. Consent is obtained clearly, freely, specifically and on an informed basis, for example through a checkbox not selected by default. You may withdraw it at any time without giving a reason.

Only with your consent may we process data for:

Themed newsletters, personalised promotional offers or event invitations;
Personalising content displayed on the Platform;
Commercial prospecting by Auto Events or selected partners;
Advertising campaigns promoting events or services of Auto Events or its partners;
Invitations to satisfaction surveys or UX tests;
Targeted content and advertising based on browsing behaviour, subject to cookie acceptance;
Geolocation to personalise services, if permitted through your browser or application;
Behavioural analysis to improve marketing targeting, subject to consent.

Communications may be sent by email, SMS, push notification or your personal area, depending on the channels authorised.

Marketing may be personalised using declared preferences, interaction history such as clicks and viewed or saved events, browsing data collected with consent through cookies, and geolocation data with permission.

4. What are the legal bases for processing?

We process data on the following bases:

Performance of a contract, the accepted T&Cs: Article 6(1)(b) GDPR;
Explicit consent, for example newsletters: Article 6(1)(a) GDPR;
Legal obligation: Article 6(1)(c) GDPR;
Legitimate interests in Platform security: Article 6(1)(f) GDPR.

5. How long do we retain your data?

Retention depends on the purpose of processing, in accordance with the GDPR and Portuguese law.

5.1 During the contractual relationship

We retain data while you actively use our services: while a registered account remains active, or throughout the contractual service period for individual or professional customers.

If there is no marketing interaction for three years, the relevant data is deleted or anonymised.

5.2 Until consent is withdrawn or objections are justified

Where processing relies on consent, data is retained until consent is withdrawn. If you object to processing based on legitimate interests, we stop unless compelling grounds justify continuing.

5.3 After account deletion

Once an account is deleted, data is blocked and then permanently deleted within a maximum of 90 days. This period may be extended to meet legal obligations, such as tax requirements or litigation.

5.4 Retention for security or fraud prevention

To ensure security or prevent abuse, we may retain data such as telephone number, IP address or listing history for a maximum of:

Two years for individual users;
Four years for business users.

This limited retention relies on a demonstrated legitimate interest validated through a balancing test and uses only the strictly necessary minimum data.

5.5 Retention for legal obligations

Certain data may be retained to meet tax, accounting, judicial or regulatory obligations for the applicable statutory periods, in principle up to six years.

5.6 Cookies and browsing data

Cookie data is retained throughout the cookie’s lifespan or until manually deleted. For questions about retention, contact cookies@autoeventos.pt. Our Cookie Policy is available at any time.

6. What are your rights?

As a data subject, you may exercise the following rights at any time and free of charge under the GDPR and Portuguese law.

6.1 Recognised rights

Access: confirmation of processing and access to information about your data;
Rectification: correction or completion of inaccurate or incomplete data;
Erasure: deletion unless a legal retention obligation applies;
Restriction: temporary limitation of processing where accuracy or lawfulness is contested;
Objection: objection to legitimate-interest processing unless compelling grounds apply, and objection to direct marketing;
Portability: receiving or transmitting data in a structured, commonly used, machine-readable format;
Withdrawal of consent at any time without affecting the lawfulness of earlier processing;
Not being subject to an automated decision producing legal or similarly significant effects.

6.2 How to exercise your rights

You can exercise your rights through your personal area, the unsubscribe link in each message, the Platform’s contact section, privacidade@autoeventos.pt or the Data Protection Officer at epd@autoeventos.pt.

We aim to respond within a maximum of one month. This may be extended for complex or multiple requests, with prior notification.

6.3 Complaints to the supervisory authority

If you believe your rights are not respected, you may complain to:

CNPD — Comissão Nacional de Proteção de Dados;
Website: https://www.cnpd.pt;
Address: Av. Dom Carlos I 134 1, 1200-651 Lisboa.

Before submitting a complaint, we invite you to contact us to resolve difficulties concerning your personal data directly.

7. Who has access to your data?

Data may be disclosed to third parties in the following circumstances, strictly in accordance with the GDPR and applicable Portuguese legislation.

7.1 Processors and technical service providers

We use third-party processors acting on our behalf and only under our instructions, including cloud providers such as Hostinger and analytics or advertising tools such as Google Analytics and advertising cookie partners.

Providers may be inside or outside the European Economic Area (EEA). Standard contractual clauses and additional safeguards are implemented in all cases to protect your data.

7.2 Sharing with third parties to provide services

Data may be shared with event organisers when you register or interact with a listing;
Business users’ data may be shared with third-party portals if publication across several platforms is requested;
Data may be passed to partner agencies if sales or organisational support is requested.

7.3 Disclosure with consent

With explicit consent, we may share contact details with commercial partners for offers such as insurance, automotive services or energy, and, where applicable, share data with other entities in the same group for commercial communications or enhanced services.

7.4 Authorities and legal obligations

We may disclose data to public authorities, law enforcement bodies or courts where legally required, during an investigation or following an official request.

7.5 Transparency and public information

When you publish an event, some information may be publicly visible, such as your nickname, listing content and location. You can control these settings in your personal area.

7.6 Mergers and acquisitions

In an acquisition, merger or restructuring, data may be transferred to the new operator in accordance with applicable law.

7.7 Limited internal access

Only authorised Auto Events staff in marketing, support or CRM may access data within their duties and under strict confidentiality commitments.

7.8 No resale without consent

Data is never resold or transferred to third parties for commercial purposes without explicit consent.

We ensure that all third parties with access comply with strict confidentiality and security commitments and use data only for the intended purposes and in accordance with our data protection policy.

8. Data security

Auto Events implements the technical and organisational measures necessary to secure personal data under Article 32 GDPR.

8.1 Technical and organisational measures

Our protocols protect against unauthorised or unlawful access, accidental loss or destruction, and unintended alteration or disclosure.

Measures include:

Storage on secure servers meeting international standards, including ISO 27001;
Pseudonymisation and access logging;
Continuous monitoring and regular system testing;
Strict access restrictions for authorised staff.

8.2 Vigilance and shared responsibility

Despite our efforts, internet transmission can never be completely secure, and absolute security of data transmitted through the Platform cannot be guaranteed.

We recommend choosing a strong, unique password and keeping it confidential, never sharing credentials, and signing out after every session.

If a security incident, breach or leak affects your data, you will be informed as quickly as possible in accordance with legal obligations. Security questions may be sent to privacidade@autoeventos.pt.

9. Data transfers outside the European Union

Auto Events primarily processes data within the EEA. Some service providers may be located or process data outside it. International transfers are carried out in strict compliance with the GDPR.

9.1 Safeguards in place

Transfers outside the EU must ensure protection equivalent to that within the EEA through:

Transfer to a country covered by a European Commission adequacy decision;
European Commission-approved standard contractual clauses;
Additional technical or organisational safeguards, such as encryption, pseudonymisation or data isolation.

9.2 International providers

Some technical or analytics providers may process data from countries outside the EU, such as the United States or Brazil. We require compliance with contractual and legal commitments to ensure GDPR compliance.

9.3 Obtaining information

You may request a copy of the safeguards for transfers outside the EU at privacidade@autoeventos.pt.

We undertake to maintain personal data security, confidentiality and integrity at all times, including international transfers. You may request a copy of the standard contractual clauses governing transfers outside the EEA at the same address.

10. Tips for protecting your personal data

Use strong, unique passwords and change them regularly;
Avoid sharing personal information on unsecured public Wi-Fi;
Use private browsing on shared computers or networks;
Watch for phishing: do not click suspicious links and verify senders;
Update software and applications regularly for the latest protection.

11. Policy updates

This policy may be updated periodically. Material changes will be notified by a prominent notice on the Platform, a direct message through our services or email, as appropriate.

Please consult it regularly. If you disagree with changes, you may delete your account in your personal area settings.

We may also contact you by email or in-app notification to validate your account or send transactional messages essential to our services. These communications are necessary to provide the service and cannot be disabled.

12. Mandatory and up-to-date information

Some information is mandatory to use our services. Required fields must be completed. By submitting a form, you declare the information accurate and truthful.

You are responsible for keeping your data current. Please notify changes promptly:

In your personal area, update your first name, surname, telephone number, club name, club telephone, club representative, website and social networks;
Alternatively, email privacidade@autoeventos.pt.

We recommend the personal area for faster, independent data management.