1.Who is the controller
The controller of personal data at agroeurope is:
- Name
- AgroDoolibar (Doolibar Comercial, Lda.)
- NIF
- 517841851
- Address
- Zona Industrial de Macedo de Cavaleiros, Lote 51, 5340-296 Macedo de Cavaleiros
- Registration
- Private limited company, registered in the commercial register under the single registration and legal person number 517 841 851, share capital of 5.000,00 €.
For any matter concerning your data, write to the email above.
This policy applies to those who use the platform (the people who manage accounts and the businesses' contact persons), to those who visit it without an account and to those who write to us.
2.What data we process
We only process the data we need for the platform to work:
- Account
- Business name, NIF, municipality, description (if you write one), contact person, phone, email and password. The password is stored only as a derived code (hash), which does not allow it to be recovered. We also store the dates of registration, email confirmation and verification and, if applicable, any block and its reason. If you cancel the newsletter, we store the date.
- Listings
- Type, product, title, description, quantity, price, production method, product characteristics, municipality, dates, status and, if you give it when marking as sold, the final price.
- Photos
- The ones you add to listings. With JavaScript on, the browser shrinks each photo and saves it again before sending it, which strips its metadata, including the GPS location. Before we store a photo, we also remove on the server the GPS location and the metadata blocks that may contain it (XMP, IPTC and comments), even if it didn't go through the browser; the image orientation is kept, so the photo appears the right way up.
- Messages
- What you write in conversations, when it was sent and read, and whether you shared your contact details.
- Reports and suggestions
- The reason, what you write and, if you're signed in, the account that reported or suggested. Without an account, the name and email you leave (optional) so we can tell you what we decided.
- Contact form
- Name, email, subject and message. If you're signed in, we add the account's identification (name, NIF and email) so we can help you faster.
- Technical data
- The IP address, used for security and to limit the number of requests (for example, sign-in or registration attempts), and the browser's technical signals that the anti-bot check analyses.
- Emails sent
- A record of each email the site sends: recipient, subject, content and sending result.
- Advertising
- For each advertisement and each day, we count how many times it was shown and how many times it was clicked. These are only totals: we don't store the IP address, the account, cookies or any other data about who saw or clicked. For companies that advertise or are in the “Services for producers” directory, we process what they give us for the ad or the profile (name, contact details they want to publish, logo and images).
The mandatory registration fields (business name, NIF, municipality, contact person, phone, email and password) are needed to create and use the account: without them we can't create it. The description is optional. For reports made without an account, the name and email are also optional.
3.What we use them for
- Providing the service: account, listings, public profile, messages, sharing contact details, price statistics and service emails
- Performance of the terms of use contract (point (b)). When the account belongs to a legal person, the contact person's data are processed on the basis of the legitimate interest of the business and our own in communicating with whoever represents it (point (f)).
- Security and abuse prevention: request limits, anti-bot check, reports, moderation, blocks and logging of administration actions
- Legitimate interest in keeping the platform safe and reliable (point (f)).
- Alerts (“Let me know”) and reviews after the deal
- Performance of the terms of use contract: these are functions you request or use in your account (point (b)).
- “This week's prices” newsletter, with an account
- Legitimate interest in giving account holders the market's prices and activity (point (f)). You can object at any time, with the link in each mailing.
- “This week's prices” newsletter, without an account
- Consent (point (a)), given with the email confirmation, which you can withdraw at any time with the link in each mailing.
- Replying to those who contact us
- Legitimate interest in replying (point (f)) or steps taken at your request before entering into a contract (point (b)).
- Complying with legal obligations, such as responding to requests from authorities
- Compliance with a legal obligation (point (c)).
We don't use your data for advertising, we don't sell it and we don't build profiles. The following are automatic: NIF validation, rejection of an already registered NIF or email, the anti-bot check, request limits, rejection of contact details in listing text and the request to confirm a price very far from the reference. Removing listings and blocking accounts is always decided by a person.
4.What is public and what is private
Public
Anyone, including search engines, can see the business's profile (name, municipality and district, description, registration date and Verified badge) and its active listings, with photos. Sold or expired listings remain accessible at their direct address, without contact details and outside search engines, until they are deleted. An account's profile only appears once the email has been confirmed.
If the business bears your name, for example as a sole trader, that name becomes public.
Reviews are also public on the profile of whoever was reviewed: the stars, the comment, the date, the product of the deal and the name of the business that gave the review.
Private
The NIF, contact person, phone and email never appear on public pages.
Messages are only seen by the participants in the conversation.
Only with whoever you choose
In a conversation, “Share my contact details” shows the other side the contact person, phone and email. Only what each side has shared appears.
Whoever receives them becomes responsible for them and may only use them to handle that deal.
Our admin team
It sees account and listing data to manage the platform.
It only looks at messages when necessary to review a report, protect security or comply with the law.
5.Alerts, newsletter and reviews
Alerts
We store what you asked for (offer or request, product or category, district and price limits), linked to your account, and when we sent you the last summary. We only use them to send you, at the account's email, at most one summary a day and only when there are new listings. They are kept for as long as they exist: you delete or pause each alert in “My account › Alerts”, and each email has a link to turn them off without signing in. Deleting the account deletes the alerts.
“This week's prices” newsletter
With an account, you receive the newsletter at the account's email from the moment you confirm it. You don't need to ask for it: we say so at registration, next to the “Create account” button. It contains the prices and activity of the market where you have an account, and we send it on the basis of legitimate interest. You can object at any time, with the link in each mailing.
Without an account, we only send after you confirm the request through the link we email you. An unconfirmed request is deleted 7 days later.
We store the email, the categories you chose (if you chose any), the dates of the request, the confirmation and the last mailing, the last issue received and, if the subscription belongs to your account, the link to the account. Cancelling, through the link in every mailing, deletes the address immediately. If you have an account and cancel, we store in the account the date you cancelled, so that we don't subscribe you again. If you subscribe again and confirm, the date is removed. Deleting the account also deletes the subscription linked to it.
The newsletter may have one or two sponsor slots, marked “Sponsored”. They are the same for everyone (they are not chosen from your data). For the advertiser we only count, in daily totals, how many emails went out with the ad and how many clicks there were on the link; we don't know who opened the email or who clicked.
Reviews
After a deal, each party to a conversation can review the other. We store the rating, the comment, the date, the conversation and both businesses. The review is public on the reviewed business's profile (with the reviewer's name) until it is deleted with the conversation (24 months after the listing closes) or with the account of one of the parties. Review reports store who reported and the reason, and are deleted 24 months after being handled.
6.Who helps us
We use these companies, which process data only on our instructions and under processing agreements (Article 28 GDPR):
- Cloudflare, Inc. (United States)
- It hosts the site and stores the database and photos, in data centres in the European Union; it protects connections and runs the anti-bot check (Turnstile), which only runs when you open or start filling in a form that uses it (and immediately on the registration and contact pages). It also keeps, for a few days, the server's technical logs (address requested, time and errors). It also sends the site's emails (Cloudflare Email Service): for that it receives the destination address, subject and content of each email. Our emails contain no images or codes to find out whether they were opened.
- Our mailbox provider
- It receives the messages from the contact form and the replies to the site's emails, which reach the operator's email.
Transfers outside the European Economic Area
Cloudflare is a United States company and its network operates in several countries, so some data may be processed outside the European Economic Area (EEA). These transfers are made with the safeguards provided for in the GDPR: the European Commission's adequacy decision on the EU-US Data Privacy Framework, which Cloudflare has joined, and the standard contractual clauses approved by the Commission. The same applies to the site's emails, which Cloudflare delivers from its network.
We don't use social networks, advertising, third-party analytics tools or fonts from other sites: the site's font is served by the site itself. Official prices come from the European Commission, but we don't send it any personal data.
7.For how long
- Account and active listings
- For as long as the account exists.
- Accounts that never confirmed their email
- Deleted 7 days after registration (the NIF and email become free again).
- When you delete the account
- We immediately delete the business, the listings, the photos, the alerts, the reviews you gave and received and the newsletter subscription made with the account. In conversations, your name becomes “Deleted account”.
- Closed listings (sold, expired, withdrawn or removed), their photos and the conversations about them
- Deleted 24 months after closing (expired ones, 24 months after expiring).
- Log of emails sent, including messages from the contact form
- 12 months.
- Signed-in sessions
- 30 days.
- Links sent by email (confirming the email and recovering the password)
- Deleted 7 days after being used or expiring.
- Request limit counters (with the IP address and, for sign-in and recovery attempts and report confirmations, the email entered)
- 2 days.
- Reports (with the reporter's contact, if they left one)
- Deleted 24 months after being handled, unless a dispute is pending.
- Log of administration decisions
- 36 months.
- Product suggestions
- Deleted 12 months after being created.
- Alerts
- For as long as they exist (until you delete them or delete the account).
- Newsletter subscription
- Until you cancel (deleted immediately). Unconfirmed: deleted 7 days after the request.
- Date you cancelled the newsletter (with an account)
- For as long as the account exists, so that we don't subscribe you again.
- Reviews
- With the conversation: deleted 24 months after the listing closes, or with the account of one of the parties.
- Review reports
- Deleted 24 months after being handled.
- Server technical logs at Cloudflare (address requested, time, errors)
- Up to 7 days.
When you delete the account, the conversations about your listings disappear with them. The messages you sent about other businesses' listings remain visible to them, under the name “Deleted account”, until they are deleted after the retention period for closed listings.
Open reports are kept until they are handled. Emails received through the contact form are also kept in the operator's mailbox for as long as needed to deal with the matter.
In case of failure, the database keeps a technical recovery history for up to 30 days: anything we delete is also removed from that history within that period. Aggregated, anonymous data, such as average prices per product and per day, identify nobody and may be kept indefinitely.
8.Your rights
Regarding your personal data, you have the right to:
- Access: know what data we hold and receive a copy.
- Rectification: correct wrong data. You can change most of it yourself, in account details.
- Erasure: you can delete the account yourself, in your account, or ask us to delete specific data.
- Restriction: ask us to restrict processing while an issue is being checked.
- Objection: object to processing based on legitimate interest, on grounds relating to your situation. You can object to the newsletter at any time, without giving reasons, with the link in each mailing.
- Portability: receive the data you gave us in a structured, commonly used format, and pass it on to another controller.
To exercise these rights, write to contacto@comercionacional.pt or use the contact page with the subject “Data protection”. It's free of charge. We reply within one month, which may be extended by two more for complex requests (we'll let you know if so). To protect your account, we may ask you to write from the account's email or to confirm your identity.
If you think we haven't handled your data properly, you can lodge a complaint with the National Data Protection Commission (CNPD), at www.cnpd.pt (opens in a new window).
9.Cookies
We only use three cookies, all essential for the site to work:
sessao- Keeps you signed in. It lasts 30 days, or until you sign out.
csrf- Protects forms against requests forged by other sites. It lasts 1 year.
flash- Shows a message after an action (for example, “Listing published”). It lasts 2 minutes.
Because they are strictly necessary, they don't require consent (Article 5(2) of Law no. 41/2004, of 18 August), so we don't show a cookie notice. We don't use advertising or analytics cookies.
For the price list (the advertising tier depends on visits), the site counts, in daily totals, the pages opened and the visits (the first page opened, coming from outside the site). It doesn't store the IP address, doesn't use cookies or other tracking means and doesn't know who visited: only the daily number is kept. Bots don't count.
The site shows advertising from companies in the sector, always marked “Sponsored” (or “Supported by”). It is served by the site itself: we don't use external ad networks, or cookies or other tracking means for advertising. When you click on an ad, you go through our /pub/… address, which only adds a click to the daily total, and on to the advertiser's site, which has its own privacy rules.
On forms with an anti-bot check, Cloudflare may store in the browser technical data needed for that check, for security purposes only. On a listing page, the check only runs when you open the report form or start writing the message: anyone who only reads the listing doesn't load it.
10.Minimum age
The platform is intended for professionals and may only be used by people aged 18 or over. We do not knowingly collect data from minors; if we find out that has happened, we delete the account.
11.Security
Connections to the site are encrypted (HTTPS). Passwords are stored with PBKDF2-SHA256 and salt, never in plain text, and sessions only as a derived code. Forms are protected against forged requests, there are request limits and an anti-bot check, and administration access is restricted.
No system is infallible. If there is a data breach that may affect you, we will inform you and the CNPD, as required by law.
12.Changes
We may update this policy when the site or the law changes. The date of the last update is at the top of this page. If the change is significant, we'll let you know by email or on the platform before it takes effect.