Privacy policy

Version of 18.10.2026. In case of divergence the Portuguese version prevails.

1. CONTROLLER

The entity identified in the Legal notice ("GRANT AUTO"). Privacy contact: [email protected]. Data protection officer: not appointed, as it is not legally required.

2. WHAT DATA, FOR WHAT PURPOSE AND ON WHAT LEGAL BASIS (Art. 6(1) GDPR)

2.1. Account: name, e-mail, telephone, favourites, language. Access by a code sent by e-mail. Basis: contract. Retention: while the account exists and 12 months afterwards.

2.2. Contact with dealers: name, e-mail, telephone, message, vehicle. We send the request to the dealer, which then processes the data as an independent controller. Basis: pre-contractual steps at your request. To invoice the commission, we exchange with the dealer only the minimum information on whether the contact resulted in a sale (identifier, vehicle, date) — basis: legitimate interest. When you click "Show phone number" or "WhatsApp" or send the form, we record the contact with a visit reference (ref), which accompanies the request so that the dealer knows the contact came from the Portal. Calls to the dealers' GRANT AUTO numbers: see clause 10. Retention: 12 months.

2.3. GRANT Check-Up: Customer data (identification, contacts, tax number, language, vehicle; payment data processed by the payment provider) and seller data (name, contact, location, registration number, VIN, photographs and videos of the vehicle). Purpose: scheduling and carrying out the check, preparing the Report (including with AI tools), invoicing, handling complaints. Basis: contract (Customer); legitimate interest of the Customer and of GRANT AUTO (seller); legal obligation (invoicing). The seller is informed at the first contact (Art. 14 GDPR). Technicians are our processors. Retention: Reports, 3 years; invoicing documents, for the statutory retention period for tax documents (10 years).

2.4. Requests to partners (financing, insurance, warranty, rental, sale of your vehicle): identification, contacts, vehicle and whatever you write in the form. We send the request to the entity indicated in the form, which processes it as an independent controller. Basis: pre-contractual steps at your request. We do not collect income documents, do not calculate instalments or premiums and do not take credit decisions. Retention: 6 months.

2.5. Vehicle data look-ups: registration number or VIN and the requested results. Basis: performance of the requested service. Results that include data of the vehicle owner are only provided where the law allows it. Retention: 6 months.

2.6. Applications from dealers and technicians: identification, contacts, professional data. Basis: pre-contractual steps. Retention: 12 months if no contract is concluded.

2.7. Messages (WhatsApp, Telegram, e-mail, telephone): to reply and provide the services. The providers of these applications process data under their own policies.

2.8. Marketing: only with consent (separate box) or, for customers and similar services, with the possibility to object at collection and in every message (Art. 13-A of Law No. 41/2004). Retention: until you withdraw consent or object; you can unsubscribe in every message or through the privacy contact.

2.9. Artificial-intelligence tools: we use AI to organise, translate and check reports and Portal content; if we make a conversational assistant available, the conversations and the session identifier are processed to reply and to improve the security of the service, and you are talking to a machine. Provider: Anthropic (USA). Retention: 12 months.

2.10. Reviews: name or pseudonym, text, rating, date and the reference of the order or contact that gave rise to the invitation. Purpose: publishing the review and verifying that it comes from a real customer. Basis: consent (publication); legitimate interest and legal obligation (verification). Retention: while the review is published; the author may request removal.

2.11. Security and reports: technical logs (IP, date, device), report data. Basis: legitimate interest; Regulation (EU) 2022/2065. Retention: 12 months.

2.12. Partner dealers and contracted Technicians: identification of the dealer (company name, NIF/NIPC, address, contacts), data of the users of the dealer cabinet (name, e-mail, telephone, role), data of the listed vehicles (registration number, VIN, photographs, price) and commission invoicing data; data of the Technicians (identification, contacts, NIF, registered activity, insurance, equipment, languages, experience, presentation) and their public profile (name, experience, languages, equipment, reviews). Purpose: performing the partnership agreement, publishing the listings and public profiles, enabling contacts, preventing fraud, complying with the trader-identification duties (Regulation (EU) 2022/2065). Basis: contract; legal obligation; legitimate interest (fraud prevention). The dealer's trade name, legal identity and contacts are visible to the public in the listing. Retention: for the duration of the contract and 12 months afterwards; trader-identification data, 6 months after the end of the contractual relationship; invoicing documents, 10 years.

2.13. Cookies and similar technologies: see the Cookie policy.

2.14. Complaints and exercise of rights: data of the complaint or request and of the reply. Basis: legal obligation. Retention: 3 years.

To protect forms and sign-in requests against bots and abuse, we use Cloudflare Turnstile, which may perform invisible checks in your browser. See the Cloudflare Turnstile Privacy Addendum for information about how this service processes data.

3. WITH WHOM WE SHARE

Processors (Art. 28 GDPR): hosting (DigitalOcean), transactional e-mail (Resend, Postmark), AI (Anthropic), telephony and call recording (Twilio), call transcription (ElevenLabs), anti-bot protection (Cloudflare), invoicing and accounting providers, where applicable, GRANT Check-Up technicians. Independent controllers: dealers; partners indicated in the forms; payment provider (Stripe). Authorities, where the law requires. We do not sell personal data.

4. AUTOMATED DECISIONS

We do not take decisions based solely on automated processing with legal or similar effects (Art. 22 GDPR). Moderation of listings and reviews supported by automated tools is always subject to human review on request (Terms and conditions, clause 7).

5. TRANSFERS OUTSIDE THE EEA

Some providers (Stripe, Anthropic, Cloudflare, Resend, Postmark, Twilio, ElevenLabs) may process data in the United States of America, under the EU-US adequacy decision (Data Privacy Framework) or standard contractual clauses (Articles 45 and 46 GDPR).

6. YOUR RIGHTS

6.1. You may, at any time and free of charge: access your data; request rectification; request erasure; request restriction of processing; object to processing based on legitimate interest and, always, to direct marketing; request portability; withdraw consent, without affecting the lawfulness of the previous processing.

6.2. How to exercise them: [email protected]. We reply within one month, extendable under the law. We may ask for additional information to confirm your identity.

6.3. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD) — www.cnpd.pt — Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa.

7. MANDATORY DATA

Fields marked as mandatory are necessary to provide the requested service; without them we cannot provide it. The others are optional.

8. MINORS

The Portal is intended for persons aged 18 or over. We do not knowingly collect data of minors.

9. SECURITY

We apply appropriate technical and organisational measures (encrypted connections, access control, access logging, backups). In the event of a data breach involving a high risk, we inform the data subjects and the CNPD as required by law.

10. CALLS TO THE DEALERS' GRANT AUTO NUMBERS

10.1. The dealers' telephone numbers shown on the Portal are GRANT AUTO forwarding numbers ("tracking numbers"). When you call, you first hear a notice that the call is recorded; if you continue, the call is forwarded to the dealer and recorded. Return calls that the dealer makes to you through this number are likewise announced and recorded.

10.2. Data: your number, date, time and duration, the recording, the transcript and an automatic summary of the conversation (what was agreed, next steps, service rating), linked to the vehicle and to the visit reference (clause 2.2). Purposes: forwarding your request to the dealer and creating the corresponding contact record (name, if you give it, number, vehicle, summary), following up what was agreed (visit, offer, contact), assessing the quality of the dealers' service and proving the origin of the contact to the dealer.

10.3. Basis: legitimate interest of GRANT AUTO and of the dealer (attribution and follow-up of contacts, quality of service); by continuing the call after the notice, you accept the recording. If you do not wish to be recorded, you can hang up and contact the dealer through the listing form or by message.

10.4. Retention: the recording is deleted 90 days after the call; the transcript and the summary are kept for 12 months, like the other dealer-contact data. The dealer has access to the recording and the summary of the call addressed to it. You may request a copy or the early deletion of the recording through the privacy contact.

10.5. If the dealer does not answer, you can leave a voice message, processed in the same way, and receive a WhatsApp message with the link to the vehicle and the indication that the dealer will call you back.

10.6. Processors for these operations: telephony and recording (Twilio), transcription (ElevenLabs), summary (Anthropic) — see clauses 3 and 5.

11. CHANGES

We publish any change here, with the date. Significant changes are communicated by e-mail to registered users.

12. FINAL PROVISIONS

This Policy is available in Portuguese, English, Ukrainian and Russian; the translations are made with the support of automated tools and, in case of divergence, the Portuguese version prevails.