Privacy Policy

The @Baixa Coimbra platform, managed by the Municipality of Coimbra, is committed to protecting the privacy of its users. This privacy policy describes how we collect, use, store and protect personal data, in accordance with the General Data Protection Regulation (GDPR) and Law No. 58/2019.

Introduction

This policy applies to all personal data collected through our platform and mobile application. By using the platform, the user agrees to the collection and use of information as stipulated in this policy.

Personal Data Collection

Types of Data Collected

@Baixa Coimbra may collect the following personal data:

Identification Data: Name, surname, email address, telephone;
Account Data: Username, password;
Payment Data: Banking information (e.g.: IBAN), Data related to payment methods;
Navigation Data: IP address, cookies, geolocation;
Communication Data: Messages sent through customer support, Notes, reviews and questions left about products;
Satisfaction Data: Responses to satisfaction surveys.

Collection Methods

Data collection occurs in the following situations:

Platform Registration: During the account creation process, Users provide necessary personal information;
Navigation and Use of Features: Through cookies and other technologies, the Marketplace collects data about Users’ browsing behavior, including pages visited and time spent in each section;
Interaction with Customer Service: Information is collected during interactions with customer support, including calls, emails and chats;
Survey Responses and Feedback: User satisfaction data is collected through questionnaires and feedback forms sent after purchases or interactions.

Purposes of Data Collection

@Baixa Coimbra uses personal data for:

Contract Execution and Management: Management of purchase and sale contracts or service provision;
Order Processing: Management and processing of purchase orders;
Customer Communication: Clarification of doubts and effective communication with users;
Processing Information Requests: Handling requests for additional information;
Processing Complaints: Management of complaints, including regulatory processes, pre-litigation processes or exercise of rights in judicial proceedings;
Statistical Analysis Activities: Conducting statistical analyses to improve the services offered;
System Development: Verification, maintenance and development of systems and statistical analyses.
Direct Marketing Communications: Sending marketing communications, if you have consented to the processing of your personal data for this purpose;
Fraud Prevention and Combat: Implementation of measures to prevent and combat fraud;
Requesting Comments: Requesting feedback on purchased products or services;
Conducting Satisfaction Surveys: Conducting surveys to assess customer satisfaction;
Event and Campaign Management: Management and participation in events, contests and promotional campaigns.

Who has access to the data

The @Baixa Coimbra Platform Management Team takes all precautions to preserve the security of personal data against any loss, unauthorized access, modification, intrusion, alteration, disclosure or destruction of the data it holds.

Access to Information:

The Platform Management Team: The @Baixa Coimbra platform management team has access to information from both merchants and buyers, strictly for platform management and operation purposes;
Sellers: Sellers have access to buyer information, but only to the extent necessary to process orders and provide services. This access is strictly controlled, and sellers are not authorized to use personal data for any purpose other than fulfilling their contractual obligations.

The @Baixa Coimbra platform Management Team cannot be held responsible for risks associated with Internet operation, which it does not control. We invite users to be particularly aware of the risks in terms of data loss or breach of confidentiality of transmitted data. The same applies in case of force majeure or any event beyond the control and responsibility of the Platform Management Team.

Permission Management

Permissions can be managed directly in the device settings or in the application.

User Rights

In accordance with the General Data Protection Regulation (GDPR), users have the following rights:

Right of Access: This right allows users to consult information about processing operations that concern them, such as the type of data and the source of collection. It also enables requesting a copy of all information related to the user, regardless of the legal basis that supports the processing;
Right of Rectification: If there is any error in the data provided or if it is necessary to supplement the information, users have the right to update their data, regardless of the legal basis for processing;
Right to Withdraw Consent: If they have given their consent for the processing of personal data, users have the right to withdraw that consent at any time;
Right to Restrict Processing: Users may request the limitation of processing of their personal data;
Right to Portability: This right allows users to request that their data be made available, when processed based on consent or in a contractual relationship. In this case, the responsible entity must provide the data in a format that is technically usable;
Right to Object: Users have the right to object to the processing of their data, especially when processing is based on the “legitimate interest” of the controller, provided that this interest is not considered “compelling”;
Right to Erasure: If data is processed based on consent or legitimate interest (not compelling), users may request early deletion of their data. For this, it is sufficient to express the intention to withdraw consent or to object to processing;
Right of Disposition After Death: Users have the right to define directives about the conservation, deletion or communication of their personal data that apply after their death.

Users can exercise the above-mentioned rights through the Electronic Form available for this purpose.

Data Retention

Users’ personal data is retained according to the following guidelines:

Payment Data: Stored for a period of up to 3 years after the transaction date;
Contractual Relationship: Data is retained during the period equivalent to the duration of the contractual relationship between the parties. If there is inactivity exceeding 3 years since the last contact with the Customer, the data will be deleted;
Exercise of Rights: Data related to requests for exercising rights is retained for 5 years after the response to the request, after which it will be deleted;
Fraud Combat: Data is retained for 7 years from the date of response to the request, then archived for an additional period of 7 years;
Reporting Illegal Products: Data related to reports is kept for 3 years from the date of the report, after which it will be deleted;

Personal Data Security

We implement appropriate technical and organizational measures to protect personal data. However, users should be aware that no data transmission over the Internet is completely secure.

Changes to the Privacy Policy

We reserve the right to update this policy, recommending that users regularly consult the document for possible updates.

Date of last change: 24/06/2025