Privacy Policy
This policy describes the personal data processed by Agiliza in connection with the Agiliza application and the website agiliza.services, the purposes and legal bases of that processing, the recipients of the data, the retention periods applied, and the rights of data subjects under the General Data Protection Regulation (GDPR) and Law 58/2019.
01 Controller
The controller is AGILIZA EXPRESS, UNIPESSOAL, LDA, NIPC 519346459, Avenida Reinaldo dos Santos, 16, 6.º A, 2675-274 Odivelas, Portugal ("Agiliza"). Requests concerning personal data may be addressed to ola@agiliza.services.
02 Data processed
Account data: first and last name, email address, mobile phone number, language preference, and the record of acceptance of the Terms. Optionally, date of birth and NIF; the NIF, where provided, is included on receipts.
Addresses: the service addresses entered by the user, with a label, and the geographic coordinates derived from the postcode.
Location: where the user grants the device permission, the device's location, used solely to display nearby Providers and to pre-fill a postcode. The application may be used without location access by entering a postcode. Location is not collected in the background.
Bookings and payments: the Listing, Provider, date, hours, address, price and status of each Booking, its history and receipt. Payment data is processed by Stripe; Agiliza receives a payment-method token, the card brand and the last four digits only.
Reviews and issue reports: ratings and text submitted by the user, issue reports and any photographs attached to them.
Provider data: legal name, business name, NIF, service categories, base postcode, Listings and their photographs, working hours, service radius, and the verification outcome and payout status reported by Stripe. Identity documents and full bank details are collected by Stripe directly and are not received by Agiliza, which holds only the bank name and the last four digits of the account.
Technical data: the device's push-notification token, application version and operating system, and server logs required to operate and secure the service (requests, timestamps, IP address). The application contains no analytics or advertising software and sets no cookies.
Correspondence: messages sent to Agiliza by email.
03 Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account creation, authentication by one-time code, management of Bookings, payments, refunds and payouts | Performance of a contract (GDPR art. 6(1)(b)) |
| Disclosure of a party's name, address and, within the periods defined in the Terms, phone number to the other party to a Booking | Performance of a contract |
| Receipts, invoices, accounting and tax records | Legal obligation (art. 6(1)(c)) |
| Verification of Providers' identity and payout accounts through Stripe | Legal obligation applicable to the payment institution, and Agiliza's legitimate interest in the integrity of the marketplace (art. 6(1)(f)) |
| Push notifications, SMS or voice codes and emails concerning the user's account and Bookings | Performance of a contract; delivery of push notifications is subject to the device permission |
| Reviews and ratings, handling of issues, prevention of fraud and abuse, rate limiting, security logging | Legitimate interest in a trustworthy and secure service |
| Error and crash reporting, with personal data removed | Legitimate interest in the operation of the service |
| Use of device location | Consent, given through the device permission and withdrawable at any time in the device settings (art. 6(1)(a)) |
Agiliza does not process personal data for advertising, for profiling with marketing purposes or for automated decisions producing legal effects, and sends no marketing communications.
04 Recipients
Other users. The Client and the Provider see each other's first name and initial; the Client additionally sees the Provider's business name and rating. The Provider sees the service address on acceptance and the Client's phone number from acceptance until completion or cancellation; the Client sees the Provider's phone number from 24 hours before the start time until completion or cancellation. Reviews are displayed with the author's first name and initial.
Processors acting on Agiliza's documented instructions:
- Stripe Payments Europe, Ltd. — payments, refunds, Provider verification and payouts (Stripe also acts as an independent controller for its own regulatory obligations);
- Infobip — delivery of SMS and voice authentication codes;
- Resend — email delivery;
- Google (Google Maps Platform; Firebase Cloud Messaging) — static maps, address geocoding and push-notification delivery;
- DigitalOcean — hosting of servers, database and file storage in Frankfurt, Germany;
- Sentry — error reporting, EU region, after removal of personal data;
- Cloudflare — hosting of the website.
Public authorities and other third parties where required by law, to protect the rights or safety of Agiliza or its users, or in connection with a transfer of the business, subject to equivalent safeguards.
Agiliza does not sell personal data.
05 International transfers
Agiliza's servers and database are located in the European Union. Infobip and Sentry process data within the European Union. Certain processors are established, or may process data, outside the European Economic Area (Stripe, Google, Resend, and Cloudflare for the website). Such transfers rely on adequacy decisions of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified, or on the Standard Contractual Clauses.
06 Retention
- Account data: for the duration of the account; removed within 30 days of deletion (profile, addresses, saved payment methods, notifications, device tokens and phone number are removed immediately).
- Booking records: ten years, with the related receipts and payment records.
- Receipts, invoices and payment records: ten years, as required by Portuguese tax and accounting law, including after account deletion.
- Reviews: retained after account deletion with the author's name removed.
- Issue reports and photographs: for the retention period of the related Booking record.
- Security and server logs: up to 30 days.
- Provider verification outcomes: for the duration of the Provider's activity, in addition to any period for which Stripe is required to retain its own records.
07 Rights of the data subject
The user may:
- access and rectify most data in the application (Profile);
- obtain a copy of the data held about them, in a structured format, by written request (portability);
- delete the account in the application, which removes the data described in section 6, other than the records retained under that section;
- object to, or request restriction of, processing based on legitimate interests;
- withdraw the location and notification permissions at any time in the device settings;
- lodge a complaint with the Comissão Nacional de Proteção de Dados (cnpd.pt).
Requests should be sent to ola@agiliza.services and are answered within one month.
08 Security
Data in transit is encrypted (TLS). Servers are located in the European Union with access restricted to personnel operating the service. Payment data and identity documents are processed by Stripe and do not transit Agiliza's systems. Phone numbers are disclosed only within the periods defined in the Terms. Error reports are stripped of personal data before they are sent; server logs, which include IP addresses, are kept for no more than 30 days. Users are responsible for the security of their device and account.
09 Minors
The Platform is intended for persons aged 18 or over. Agiliza does not knowingly process data of minors; an account held by a minor will be deleted on notice.
10 The website
The website agiliza.services is a static site hosted by Cloudflare. It sets no cookies and uses no analytics. Cloudflare may process the visitor's IP address for the purpose of serving and protecting the site, as described in Cloudflare's privacy policy.
11 Amendments
This policy is updated when the service or the applicable law changes. Material changes are notified in the application or by email, and the date above is revised.
12 Contact
ola@agiliza.services · AGILIZA EXPRESS, UNIPESSOAL, LDA, Avenida Reinaldo dos Santos, 16, 6.º A, 2675-274 Odivelas, Portugal.