Privacy policy

The controller of your personal data is Eatz, Lda, tax number 519611152, Rua Luís de Camões, 161, 1.º Esq., 4470-190 Maia, Portugal. For any privacy question write to [email protected].

This policy applies to every Parkz website. For users in Brazil, the LGPD page adds the rules of the Brazilian General Data Protection Law.

• Booking data: name, e-mail, phone, country, number plate, vehicle model, flight number, number of passengers, dates and chosen car park.
• Tax data: tax number when you ask for an invoice (or CPF, in Brazil only and if you provide it).
• Payment: Stripe handles your card details; we only receive the payment status, card brand and last digits.
• Account: name, e-mail, hashed password and, if you turn it on, two-factor authentication.
• Communications: messages you send us and your consent to receive offers.
• Technical data: IP address, browser type and requested pages, in server logs, for security. The visit statistics we keep are aggregated (page, day, traffic source) and identify nobody.

We do not collect special categories of data or make solely automated decisions with legal effects on you. Stripe may automatically assess the fraud risk of a payment.

• Making and managing your booking, sending the confirmation and supporting you: performance of a contract (GDPR article 6(1)(b)).
• Recording requests for car parks without online booking, replying to you and showing car parks the demand: steps taken at your request before a contract, and our legitimate interest in growing the partner network.
• Invoicing and tax and accounting obligations: legal obligation (article 6(1)(c)).
• Security, fraud prevention and legal claims: legitimate interest (article 6(1)(f)).
• Aggregated statistics to improve the site and show car parks the demand they get: legitimate interest, without identifying visitors.
• Offers by e-mail: only with your consent (article 6(1)(a)), which you can withdraw from any e-mail or by writing to us.
• Optional cookies: only with your consent, as set out in the cookie policy.

• The operator of the car park you booked, who receives your name, contact details, plate, flight and dates to provide the service and is a controller for its own use of them.
• Stripe Payments Europe, Ltd., to process payments and prevent fraud.
• Hosting and infrastructure providers, which store the site and database only on our instructions.
• E-mail delivery and customer support tools, which process data only on our instructions (processors).
• Maps: map images are loaded from OpenStreetMap's servers (OpenStreetMap Foundation); your browser sends them your IP address to fetch them.
• Authorities, where the law requires it.

We do not sell your personal data.

Some providers (such as Stripe) may process data outside the European Economic Area, in particular in the United States. In those cases we rely on the safeguards in the GDPR: adequacy decisions (including the EU-U.S. Data Privacy Framework) or the European Commission's standard contractual clauses. Bookings at car parks in Brazil involve sending your data to the Brazilian operator, which is necessary to perform the contract you asked for.

• Bookings and invoices: for the legal retention period of tax and accounting records (up to 10 years).
• Requests for car parks without online booking: 24 months.
• Account: while it is active; we delete the data when you delete it, except what the law requires us to keep.
• Marketing consent: until you withdraw it.
• Server logs: up to 12 months.

At any time and free of charge, you can:

• access your data and get a copy;
• correct inaccurate data;
• ask for erasure or restriction of processing;
• receive your data in a structured format (portability);
• object to processing based on legitimate interest and, always, to marketing;
• withdraw consent, without affecting processing already carried out.

Write to [email protected]. We reply within one month, which may be extended in the cases provided for in the GDPR. We may ask you to confirm your identity.

You may also complain to a supervisory authority: the CNPD in Portugal, the AEPD in Spain, or the authority where you live. In Brazil, the ANPD.

The site uses an encrypted connection (HTTPS), passwords are stored hashed, access to data is limited to those who need it and payments are processed by a PCI DSS certified provider. If a data breach is likely to put your rights at risk, we notify the supervisory authority and, where the law requires, you too.

The site is not aimed at children under 16 and bookings require you to be 18. If you know a child has given us personal data, let us know so we can delete it.

We may update this policy. The date of the latest version is shown at the top and, if changes are significant, we will e-mail customers who have an account.