Last updated: 20 October 2026
This is a translation for convenience. In case of discrepancy, the Portuguese version prevails.
This Policy explains how we process personal data on ordvia.link, in accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and Portuguese Law no. 58/2019.
1. Data controller
AURA BINÁRIA, UNIPESSOAL LDA, tax no. 519292081, Avenida do Atlântico, escritório 2.01, 1990-019 Lisboa / Portugal.
Privacy contact: privacidade@ordvia.link.
2. What data we process
Visitors
- Technical and browsing data: IP address, browser and device type, pages visited, date and time, collected by the server and by analytics tools (see the Cookie Policy).
- Approximate location: only when you use “Near me” and allow your browser to share it. It is used to show results and is not stored.
Business accounts
- Name, email, phone and password (stored only in hashed form);
- venue data and content you publish (address, opening hours, photos, menus, descriptions);
- verification logs: destination email, date, IP address and number of attempts for codes sent (the code itself is not stored in plain text).
Venue information
Venue pages contain public information about businesses (name, address, business contacts, opening hours), obtained in particular from OpenStreetMap and the Overture Maps Foundation. If this information identifies an individual (e.g. a sole trader), you may exercise the rights below, including correction or objection to its display.
3. Purposes and legal bases
- Providing the guide and showing venue information — legitimate interest in offering a useful public directory (Art. 6(1)(f) GDPR).
- Creating and managing business accounts, verifying venue ownership and sending service messages (e.g. verification codes) — performance of a contract (Art. 6(1)(b)).
- Security and abuse prevention (attempt limits, access logs) — legitimate interest (Art. 6(1)(f)).
- Usage statistics to improve the Platform — legitimate interest (Art. 6(1)(f)) and, where applicable, your consent (Art. 6(1)(a)).
- Legal obligations — Art. 6(1)(c).
4. Who we share data with
We do not sell personal data. We use providers that process data on our behalf, with the safeguards required by the GDPR:
- Website hosting provider;
- Brevo (Sendinblue SAS, France) — verification and service emails;
- Google (Google Tag Manager and Google Analytics) — usage statistics;
- Technical content providers: cdnjs/Cloudflare (libraries), Google Fonts (typefaces) and OpenStreetMap (maps), which receive your IP address when these resources load.
Some providers may process data outside the European Economic Area, notably in the USA. Such transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
5. Retention
- Business accounts: while the account is active and, after closure, for as long as required by law;
- verification and security logs: up to 12 months;
- statistics: according to the analytics configuration (up to 14 months in Google Analytics).
6. Your rights
You may at any time request access to, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time. To exercise these rights, write to privacidade@ordvia.link. We will reply within one month.
You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD).
7. Security
We apply appropriate technical and organisational measures, such as encrypted connections (HTTPS), hashed passwords, attempt limits and restricted access to data.
8. Minors
Business accounts are intended for persons aged 18 or over. We do not knowingly collect data from minors.
9. Changes
This Policy may be updated. The version in force is always the one published on this page.