How we process your personal data

1. What data we collect

2. Legal basis for processing (GDPR)

• Contract performance — data necessary to provide the service (account, payments, transactions)
• Legitimate interest — platform security, fraud prevention, reputation
• Consent — marketing communications (can be withdrawn at any time)
• Legal obligation — compliance with tax and regulatory obligations

3. Who we share your data with

• Stripe — payment processing (subject to Stripe's privacy policy)
• Firebase / Google — authentication (subject to Google's privacy policy)
• Microsoft Azure — hosting and content moderation
• Competent authorities — when required by law

We do not sell or transfer your personal data to third parties for marketing purposes.

4. Your rights (GDPR)

Under the GDPR, you have the following rights:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a structured format
• Objection — object to processing based on legitimate interest
• Restriction — request suspension of processing in certain circumstances

To exercise any of these rights, contact contact@bidroom.pt. We respond within 30 days. You also have the right to lodge a complaint with the CNPD (Portuguese Data Protection Authority) at cnpd.pt.

5. Automated decisions (GDPR Art. 22)

BidRoom uses automated processing to calculate each user's reputation score (0–100). This calculation may produce significant effects, including eligibility for Private Rooms and feature restrictions. You have the right to:

• Request human intervention in reviewing the automated decision
• Express your point of view
• Challenge the decision via contact@bidroom.pt

6. Minors

BidRoom.pt is intended exclusively for users aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we detect that a minor has created an account, we will immediately delete all associated data. Parents or guardians who suspect a minor's account should contact contact@bidroom.pt.

7. Data retention

Account data is kept while the account is active. After account deletion, data is erased within 90 days, except data we must retain by law (e.g. tax data, kept for 10 years under Portuguese tax law).

8. International transfers

Your data may be processed outside the EU by our subprocessors (Stripe, Google). These transfers are made on the basis of Standard Contractual Clauses approved by the European Commission, ensuring a level of protection equivalent to that required by the GDPR.