Privacy Policy
Version 1.2, effective 9 October 2026
1. Who we are
Marcar Terapias is an online platform operated by WELCOME OBJECTIVE UNIPESSOAL LDA, a legal entity with registered office at Largo do Eiro 2, 3610-014 Dalvares, Portugal, tax number (NIPC) 517881721, registered at the Commercial Registry of Viseu (hereinafter "we", "Marcar Terapias" or "the Platform").
General inquiries: [email protected]. Privacy and data protection: [email protected].
2. What this policy covers
This Privacy Policy describes how we handle your personal data when you use Marcar Terapias, whether as a person seeking and booking treatments (User) or as a professional, establishment, or spa offering services on the Platform (Provider).
This policy applies the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese Law 58/2019 of 8 August, which implements the GDPR in the Portuguese legal order.
3. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, phone, password | Account creation and authentication | Performance of contract (Art. 6(1)(b) GDPR) |
| Approximate location (city, district) | Show you nearby providers | Performance of contract |
| Bookings (date, therapy, provider, notes) | Manage booking: this data may reveal health information | Explicit consent (Art. 9(2)(a) GDPR) |
| Payment data | Process payment via Stripe; we do not store card numbers | Performance of contract |
| Reviews and public comments | Enable informed decisions by other users | Performance of contract / Consent |
| Tax number (NIF, for invoicing) | Issue invoice with tax identification | Legal obligation (Portuguese VAT Code) |
| Provider data (name, business address, description, photos) | Display Provider on the Platform | Performance of contract |
| Browsing data (logs, IP, device) | Security and service operation | Legitimate interest (Art. 6(1)(f) GDPR) |
| Public business contact data of imported, not-yet-claimed spaces, and interaction with the claim invitation (email open, link clicks, profile views and claim steps) | Build the directory, contact the space owner and improve the claim process. We use a pseudonymous session identifier that is recomputed daily, not a stable cross-day identifier | Legitimate interest (Art. 6(1)(f) GDPR): business contact data only; you may object at any time and have the profile removed |
| Cookies and trackers | See our Cookie Policy | Consent (Lei 41/2004 + Art. 6(1)(a) GDPR) |
| Contact data for marketing | Send commercial communications (newsletter) | Only with your explicit consent, freely revocable |
We record, anonymously, visits to profile pages and clicks on contacts, with date and time, source and page section, to provide statistics to the person responsible for the profile. These records do not contain the visitor's name, e-mail, phone number or IP address. They are kept for 12 months.
We send holders of paid plans a monthly report by e-mail.
4. Sensitive data: health information
Your bookings may reveal information about your health (for example, a post-surgical lymphatic drainage booking or a therapeutic massage for an injury). This information is a special category of data under Article 9 GDPR and we process it based on your explicit consent, which you give by accepting this Privacy Policy and confirming your booking.
You may withdraw consent at any time. If you do, we will not be able to maintain your booking history or provide certain personalised services.
5. Who we share data with
We do not sell your personal data. We share only with the following recipients, to the extent necessary:
- The Provider you contacted: name, contact, message and notes you added.
- Technical service providers (processors under Art. 28 GDPR):
- Supabase GmbH: database and authentication (Germany / EU)
- Vercel Inc.: application hosting (EU / US, SCCs in place)
- Stripe, Inc.: payments (US, covered by Data Privacy Framework + SCCs)
- Mapbox, Inc.: maps and geolocation (US, SCCs in place)
- Google LLC: Google Analytics 4 (only with your consent; US, DPF + SCCs)
- Metricool Soluciones, S.L.: website audience analytics and traffic measurement (only with your marketing consent; Spain, EU)
- Functional Software, Inc. (Sentry): technical error logging and, only with your analytics consent, a recording of the session in which an error occurred (form fields masked; EU servers, Frankfurt)
- Resend, Inc.: transactional e-mail delivery (US / EU, SCCs in place)
- Anthropic, PBC: AI text suggestions and call summaries in the CRM, which may contain Providers' personal data (US, SCCs in place)
- Cloudflare, Inc.: website CDN and security; processes IP addresses (US / EU, DPF + SCCs)
- Google Ireland Limited (Google Workspace): company e-mail (EU / US, DPF + SCCs)
- LARGO, the website design and development brand of the same company (WELCOME OBJECTIVE): when a Provider requests a website through the form at /para-profissionais/websites, the LARGO team uses the name, space, current website and phone number given to prepare the draft and the website proposal. It is not a separate entity.
- Public authorities: only upon legal request or reasoned court order.
- Legal obligations: tax authority, accountant, lawyer, in fulfilment of legal obligations (e.g., SAF-T, VAT).
All processors are bound by data processing agreements (DPA), as a rule each provider's standard terms, under Article 28 GDPR.
6. International transfers
Some of our processors (Stripe, Mapbox, Vercel, Google, Resend, Anthropic, Cloudflare) may process data in the United States. These transfers are carried out under the EU–US Data Privacy Framework (for certified recipients) or Standard Contractual Clauses (SCCs) approved by the European Commission, accompanied by a Transfer Impact Assessment (TIA).
You may request a copy of these safeguards at [email protected].
7. How long we keep your data
| Data type | Retention period |
|---|---|
| User account | While account is active + 1 year after closure |
| Booking history | 5 years (legal minimum if linked to invoice, Portuguese VAT Code, Art. 52) |
| Billing data | 10 years (General Tax Law, Art. 123) |
| Technical / security logs | 6 months |
| Consent records (cookie, marketing) | Until withdrawal + 1 year (proof of consent, Art. 7 GDPR) |
| Public reviews | While account exists or until deleted on request |
When the retention period expires, data is deleted or irreversibly anonymised.
8. Your rights
Under the GDPR, you have the right to:
- Access your personal data (Art. 15)
- Rectify incorrect or incomplete data (Art. 16)
- Erase your data ("right to be forgotten", Art. 17), subject to legal exceptions (tax obligations, defence of rights in legal proceedings)
- Restrict processing (Art. 18)
- Port your data to another platform in a structured format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
To exercise any of these rights, contact us at [email protected]. We will respond within 1 month (extendable by 2 months in complex cases, with prior notice).
If you believe that the processing of your data violates your rights, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 7.º, 1200-651 Lisboa, www.cnpd.pt.
9. Cookies
We use strictly necessary cookies for the Platform to function without requiring consent. Functional, analytics and marketing cookies are only activated with your explicit consent, via our cookie preferences panel (Lei 41/2004, Art. 5(3)).
To count distinct visitors anonymously, without cookies, we derive a code from your IP address and browser using a one-way hash whose salt changes every day. Your IP address and browser are never stored in clear, the code cannot identify you or link your visits across days, and it is used only to count distinct visitors.
You can change your preferences at any time via the "Manage cookies" button in the Platform footer. For more details, see our Cookie Policy.
10. Minors
Marcar Terapias is intended for persons aged 18 or over. We do not knowingly collect data from minors under 18. If we become aware that we have collected data from a minor without the consent of their legal guardians, we will delete it immediately (Law 58/2019, Art. 16).
11. Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS 1.2+) and at rest, least-privilege access controls (Row-Level Security), audit logs, and backups.
No system is 100% secure. In the event of a data breach that may pose a high risk to your rights, we will notify you without undue delay, in accordance with Article 34 GDPR.
12. Changes to this policy
We may update this Privacy Policy. Material changes will be communicated by email and published on the Platform with reasonable advance notice. Where the legal basis is consent, we will request renewed consent.
13. Contact
- Privacy inquiries: [email protected]
- Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 7.º, 1200-651 Lisboa, www.cnpd.pt
Icons used on this platform were created by Freepik and other creators, available at Flaticon.