Privacy Policy

1. Data Controller

The data controller is:

2. Categories of Personal Data Collected

We collect the following categories of personal data, depending on the type of User and their interaction with the Platform:

2.1. Identification and contact data

Full name, email address, telephone number, address (when provided). For Professionals: tax identification number (NIF), trade name, type of activity, logo.

2.2. Professional data

Service categories, geographic areas of operation, equipment specialisation, languages, availability, portfolio (photographs and videos), professional description, qualifications, rates (hourly, transport, urgency).

2.3. Transaction and billing data

Credit purchase history, subscription data, Stripe identifiers (Stripe Customer ID, Charge ID), amounts, payment dates, payment status. Note: full credit card data is processed directly by Stripe and is never stored on our servers.

2.4. Service-related data

Work Orders (problem description, equipment type, brand, model, service category, requested date, urgency, location), messages exchanged between Customers and Professionals, reviews and ratings, work completion reports, warranty information, parts used.

2.5. Technical and usage data

IP address, browser type and operating system (user-agent), date and time of access, pages visited, last activity (last_seen_at), online status, authentication attempt logs.

2.6. Communication data

Messages in the internal chat system, support requests, email delivery records (status: sent, failed, delivered, opened), notification preferences.

3. Purposes and Legal Bases for Processing

Personal data is processed for the following purposes and on the following legal bases:

4. Recipients and Sub-processors

Personal data may be shared with the following categories of recipients, to the extent strictly necessary for the purposes described:

All sub-processors are bound by data processing agreements and are required to process personal data in accordance with our instructions and the GDPR.

Mobile apps (Google Firebase). The Reparar.com Android apps use three Google Firebase services, provided by Google Ireland Limited as a processor. (i) Cloud Messaging — delivers the push notifications the User turned on: it processes the device's notification identifier, kept while the device is linked to the account (legal basis: performance of a contract, Art. 6(1)(b) GDPR). (ii) Crashlytics — crash reports: the technical record of the error (stack trace), the device model and operating system, the app version and a random installation identifier, kept for 90 days (legal basis: legitimate interest in keeping the apps stable and secure, Art. 6(1)(f)). (iii) Google Analytics for Firebase — usage statistics (screens opened and actions taken, with a random installation identifier and an approximate location — country and region — derived from the connection; no name, email, tax number or account identifiers, and no advertising ID): off by default and turned on only with the User's consent (Art. 6(1)(a)); events are kept for at most 14 months. Consent can be withdrawn at any time with the statistics switch under Profile in the app, without affecting the lawfulness of earlier processing.

5. International Data Transfers

Some of our sub-processors are located outside the European Economic Area (EEA), namely in the United States of America. These transfers are carried out under Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914), ensuring an adequate level of protection for personal data.

The User may obtain additional information about the applicable safeguards by contacting us at [email protected].

6. Data Retention Periods

Personal data is retained for the periods strictly necessary for the purposes for which it was collected:

Once the retention periods have expired, data is deleted or irreversibly anonymised.

7. Data Subject Rights

Under the GDPR, Users have the following rights regarding their personal data:

• Right of access (Art. 15) — to obtain confirmation that their data is being processed and to access it;
• Right to rectification (Art. 16) — to request the correction of inaccurate or incomplete data;
• Right to erasure (Art. 17) — to request the deletion of data, under the applicable legal conditions ("right to be forgotten");
• Right to restriction of processing (Art. 18) — to request the restriction of processing in certain circumstances;
• Right to data portability (Art. 20) — to receive data in a structured, commonly used and machine-readable format;
• Right to object (Art. 21) — to object to processing based on legitimate interest;
• Right to withdraw consent (Art. 7(3)) — to withdraw previously given consent, without affecting the lawfulness of prior processing.

To exercise any of the above rights, the User must send a written request to [email protected], accompanied by a copy of an identification document. We will respond within 30 (thirty) days.

The User also has the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) (Portuguese Data Protection Authority), located at Av. D. Carlos I, 134, 1200-651 Lisbon (www.cnpd.pt).

To delete your account — also without access to the app — see Delete your account.

8. Automated Decisions and Profiling

The Platform uses automated algorithms for matching Work Orders with Professionals, based on service categories, geographic location and availability. This processing does not produce solely automated decisions with significant legal effects or that significantly affect the User.

The ranking of Professionals in search results takes into account factors such as active subscription, average review rating, response rate and geographic proximity.

9. Security Measures

Reparar.com implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration, including:

• Encryption of data in transit (HTTPS/TLS) and at rest;
• Password hashing with secure algorithms;
• Optional two-factor authentication (2FA);
• Protection against CSRF (Cross-Site Request Forgery) attacks;
• Request rate limiting for brute force attack prevention;
• Bot protection via Cloudflare Turnstile;
• Role-based access control (RBAC);
• Continuous monitoring and logging of suspicious activities.

10. Minors

The Platform is not directed at minors under 18 (eighteen) years of age. We do not intentionally collect personal data from minors. If we become aware that data from a minor has been collected without the consent of the holders of parental responsibilities, we will proceed with its immediate deletion.

11. Changes to the Privacy Policy

This Privacy Policy may be updated periodically. Changes will be communicated through the Platform and/or by email, with reasonable advance notice. The date of the last update appears at the beginning of this document.

12. Contact

For any questions about the processing of your personal data or to exercise your rights, please contact us: