Privacy policy

This policy describes how Leilosoc Reviews (reviewsleilosoc.com) processes the personal data of people who write reviews, receive review invitations or visit the platform, in accordance with Regulation (EU) 2016/679 (the “GDPR”).

Data controller

The data controller is Isegoria Capital, S.A., the company operating the Leilosoc® brand. For any question related to privacy and data protection, contact us at avaliacoes@leilosoc.pt.

Data we process

We process the following categories of personal data:

• Identification — the name and email address of the review author or invitation recipient;
• Review content — the rating, title, text and date of experience you choose to publish;
• Invitation data — the purchase reference and the status of the invitation sent after a transaction with Leilosoc;
• Technical data — the IP address, stored exclusively in pseudonymised form (hash), and the browser identifier (user agent);
• Email logs — the history of transactional emails sent (template, subject and delivery status).

Purposes and legal bases

We process your data for the following purposes:

• Publication of reviews — we publish the review you choose to submit, together with your name, based on your consent and on our legitimate interest in providing trustworthy information about Leilosoc (Art. 6(1)(a) and (f) GDPR);
• Post-purchase invitations — we send a review invitation after a purchase, based on our legitimate interest in collecting feedback from real customers (Art. 6(1)(f) GDPR). You may object at any time and will stop receiving invitations;
• Verification and fraud prevention — we use the verified email address, the pseudonymised IP and the user agent to prevent fake, duplicate or automated reviews (legitimate interest);
• Transactional emails — we send only the emails strictly necessary to operate the service — verification codes, publication confirmations and notifications of company replies (legitimate interest).

Data sharing

We do not sell personal data. Data is shared only with service providers acting on our behalf and under our instructions: the email delivery service (Resend) and the platform's hosting, located in the European Union.

Whenever a provider involves transfers of data outside the European Economic Area, we ensure appropriate safeguards under Chapter V of the GDPR, in particular standard contractual clauses approved by the European Commission.

Retention periods

We keep data only for as long as necessary for each purpose:

• Reviews — for as long as they remain published, or until the author requests their deletion or anonymisation;
• Unused invitations — deleted 365 days after creation;
• Verification codes (OTP) — deleted within 24 hours;
• Email logs — kept for 12 months;
• GDPR requests — after completion, we keep only a minimal record, without the plain email address, as proof of compliance.

Your rights

As a data subject, you have the following rights:

• Access and portability — obtain a copy of all the data we hold about you, in a structured, machine-readable format (JSON), through the data export;
• Rectification — correct your data by editing your review at any time;
• Erasure and anonymisation — request the anonymisation of your reviews or the deletion of the data associated with your invitations;
• Objection — object to receiving post-purchase invitations, and stop receiving them.

To exercise any of these rights, use the GDPR request form. Requests are executed automatically and free of charge; in any case, we respond within one month at most.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or with the supervisory authority of your country of residence.

Cookies

The platform uses only strictly necessary cookies: a session cookie for the administration area. We do not use analytics, advertising or tracking cookies, which is why no consent banner is displayed.

Leilosoc Reviews widgets embedded on other websites do not use cookies or any tracking technology.

This policy may be updated to reflect legal or service changes. The date of the latest revision is shown at the top of the page.