Privacy policy
The controller's identification is available on request through the contact form.
Service
TVDEWatch publishes aggregated information about the TVDE vehicle rental market in Portugal.
Contact
Contact the controller only through the contact form on this site.
Purposes
- Publishing aggregated TVDE rental market information.
- Replying to messages sent through the contact form.
- Sending a sign-in link to authorised addresses.
- Counting weekly visitors, kept only as aggregate totals.
- Measuring how the site is used, only after consent, to improve it.
Lawful basis
Legitimate interest, GDPR Article 6(1)(f).
First-party statistics rely on consent, GDPR Article 6(1)(a).
Source of the data
Listing data comes from public Facebook groups. This notice is given under GDPR Article 14, because that data is not collected directly from the person.
Categories
- Price, vehicle model, region, and date. The link to the original post and the notes are shown only to signed-in users and are not published on the open site.
- Operator name only when it is a business. Otherwise the site shows “Private”.
- On the contact form: name, email, and message.
- For sign-in: the email address entered and a strictly necessary session cookie, used only to keep the login.
- With consent: a random pseudonymous identifier, the page path (without search parameters), language, event type, section, a short label, and seconds visible. When signed in, also the account email.
Retention
Rental data is published for at most 12 months. Contact emails are kept for 12 months.
Sign-in links requested on this site expire after 15 minutes. Invitation links created by an administrator can be valid for up to 7 days. Either kind works once, and its record is deleted after it expires. Session records are deleted after 30 days.
Consented analytics events are kept for 13 months.
Recipients and processors
- Email (contact messages and sign-in links) is sent by the mail server that runs on our own server.
- Resend (United States), only as a fallback when local delivery fails. In that case the recipient and the message content pass through Resend, which is a transfer to the United States.
- The VPS hosting provider that serves this site.
Rights
You can request access, rectification, erasure, objection (GDPR Article 21), and restriction. Use the contact form and choose the subject “Data removal”.
Complaint
You may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) at www.cnpd.pt.
Site statistics
With your consent, TVDEWatch collects its own statistics to see which pages are used and to improve the site. No third-party scripts or services are used for this measurement. This is separate from the weekly visitor count, which stores nothing on the device.
The data collected is the time, a random pseudonymous identifier created and stored in the browser only after you accept, the language, the page path (without the query part, so without what you type in the search box or the filters you pick), the event type (page view, click, or time in a section), the section, a short element label (never text typed into forms and never email addresses), and the seconds a section was visible in the foreground. The identifier does not say who you are, but it links visits from the same browser, so this data is pseudonymous rather than anonymous. If you are signed in and have accepted, these events are linked to the account email, taken on the server from the session cookie. The IP address is not stored.
A consent bar asks before anything is sent. Before you accept, and after you decline, no analytics events are sent. You can change that choice at any time with “Analytics preferences” in the footer. The choice is stored only in this browser.
These statistics are kept for 13 months and then deleted. They are stored on our own server in the European Union.
You can ask for access or deletion, and you can withdraw consent at any time, through the contact form (subject “Data removal”) or with “Analytics preferences”. On request we delete every event linked to your account email or to your browser identifier. When an account is deleted, the events linked to that email are deleted too.
Visitor counting
Visitor counting stores nothing on the device: no cookie and no browser identifier. A day is counted with a SHA-256 hash of a daily salt, the IP address, and the browser user agent. The salt is random, changes every day, and is discarded; it is never saved. Only aggregate counts are kept.
Sign-in
Sign-in by link is limited to authorised addresses. The email entered to sign in is used only to send that link, from our own mail server (with Resend, in the United States, as a fallback if local delivery fails). A link requested on this site expires after 15 minutes; an invitation link created by an administrator can last up to 7 days. Each link works once.
After sign-in, the site stores a strictly necessary session cookie, used only to keep the login. It is not used for advertising or visitor counting. It expires after 30 days or when the session ends.