InvestGroep Automotive, Lda. · Rascunho · 2026-11-05

Privacy policy

1. Data controller

InvestGroep Automotive, Lda. is the entity responsible for processing the data used on B2BCars. For privacy questions, use the privacy form. The entity's identification details still missing are on the legal identification page.

2. Data processed

• Professional account: name, email, company, NIF and, if provided, phone.
• Authentication: cryptographic hash of the password, account identifier and session data. The password is not stored in plain text.
• Verification: commercial registration document or Certidão Permanente access code, file name and type, submission and review dates, decision, remarks and internal identification of the reviewer.
• Contact form: name, reply email, subject, optional vehicle reference, message, date and request status. A pseudonymised session identifier and the email are used to limit abusive submissions.
• Technical data: request information and technical logs needed for operation, diagnostics and security. Infrastructure providers may process connection data, including IP address.

No personal identity documents or bank details are requested to verify an account. Avoid including unnecessary personal information in the proof.

3. Proposed purposes and legal bases

The data is used to create and manage professional accounts, verify the company and authority to represent it, control access to prices, reply to requests and protect the service.

• Pre-contractual steps and performance of contract: where necessary to reply to the person concerned and provide the agreed services.
• Legitimate interests: management of the professional relationship, verification of representatives and fraud prevention, subject to a necessity assessment and balancing against data subjects' rights.
• Legal obligations: only where a specific applicable obligation exists, to be identified in the final version.

The legal bases for each purpose and the need for the documents must be confirmed in the final review. Merely making this policy available does not constitute consent. No generic, mandatory consent is requested for all processing.

4. Recipients and external services

• Authorised team of InvestGroep Automotive, Lda.: manages the accounts and the commercial relationship. Only approved administrators can download proof documents.
• Replit: provides the hosting infrastructure and the App Storage used for private files. Storage is based on Google Cloud technology. The processing terms, sub-processors, locations and applicable safeguards must be verified contractually before launch.
• External catalogue photos: images are loaded directly from the addresses supplied with the stock, including Microsoft Azure Blob Storage infrastructure. When loading images, the browser sends technical data, such as IP and request information, to the image server. This is not a transfer of the company proof.
• Stockcoach and Indicata: are intended sources of commercial vehicle information and valuations. In the current file-import flow, registering an account does not automatically send your data or proof to these sources.
• Contacts: the form stores the message in the application database, in an inbox accessible only to approved administrators. There is no automatic email forwarding. If the team replies through its email program, further processing depends on the provider used by the seller.

Para revisão do proprietário: quando uma conta é criada e quando o comprovativo da empresa é submetido, a aplicação envia por email à equipa os dados do registo e, no caso de um documento, o próprio ficheiro em anexo, através do serviço de email Resend. Confirme a redação, o prestador, a base jurídica e o prazo de conservação destas cópias na caixa de correio antes de recolher dados reais.

Por confirmar: serviço de email do vendedor, outros prestadores usados fora desta aplicação e eventuais destinatários adicionais. A aplicação não tem integração própria de pagamentos ou marketing. A análise de audiência anónima do formulário de contacto só funciona com consentimento (ver política de cookies).

5. Storage, security and transfers

Contact messages are stored in the application database, not on public pages. Only approved administrators can view them and delete them from the current inbox. The retention period and handling of backups still have to be defined; there is no automatic deletion by age.

Proof documents are kept in private storage, outside the website's public folder. Downloading requires an approved administrator session. Metadata and Certidão Permanente access codes are stored in the application database.

The infrastructure may involve processing outside the European Economic Area. The actual location and, where necessary, the safeguards for international transfers, including processing agreements and valid transfer mechanisms, must be confirmed. It is not claimed that all data remains in Portugal or the European Union.

Production persistence, the backup policy and related access still have to be defined and tested. This page does not certify that these measures are complete.

6. Retention and deletion

Data should be kept only for as long as necessary for the documented purposes and the legal obligations actually applicable. No tax or document retention period is proposed without validation.

The application currently does not perform automatic deletion by age. Replacing a document and deleting an account include an attempt to remove the associated private file; technical failures require follow-up. Review records and backups need their own policy.

To be confirmed before collecting real data: periods for pending accounts, refused requests, proof after review, Certidão Permanente codes, inactive accounts, technical logs and backups; grounds and process for each period.

7. Data subject rights

Depending on the legal basis and legal conditions, you may request access, rectification, erasure, restriction, portability or object to processing. Where processing is based on consent, you may withdraw it without affecting the lawfulness of prior processing.

Send the request via the privacy form. Identity may be confirmed proportionately. As a rule, a reply should be given within one month; any legally permitted extension will be communicated and justified.

You may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), without prejudice to recourse to the competent authority or the courts.

8. Manual verification, minors and changes

Commercial approval is made by a person, not by an automated eligibility decision. The service is intended for representatives with capacity and authority to act on behalf of companies, not for children.

Material changes to this policy should be communicated appropriately before new processing. The method and timing of that communication must be defined in the final version.