Privacy policy
Last updated: 4 Oct 2026
This policy explains what personal data TaxiwayMarket processes, why, who it is shared with, how long it is kept and what your rights are under the General Data Protection Regulation (GDPR).
1. Data controller
[To be defined: name or company name, address, tax number and registration of the controller]
Email: [email protected]
For any question about your data, use the contact form or the email above.
2. What we process
- Account: name, email, phone (if you add one) and your password, stored only in hashed form.
- Listings: what you publish (aircraft or item details, price, location, description and photos), the contact name and, if you choose, your phone. Photos are processed to remove metadata, including GPS location. Your email is never shown on the site.
- Messages to sellers: name, email, phone (optional) and message of the person contacting a seller, and the sending IP address.
- Contact form: name, email, topic, message and IP address.
- Payments: email, amount, date and payment reference. Card details are handled by Stripe and never reach our servers.
- Technical data: the strictly necessary cookies listed in section 6, and web server logs (page, date and browser, without IP address).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating and running your account and publishing your listings | Contract (6(1)(b)) |
| Delivering a buyer's message to the seller | Contract (6(1)(b)) |
| Service emails: message alerts, password resets | Contract (6(1)(b)) |
| Answering requests sent through the contact form | Legitimate interest (6(1)(f)) |
| Processing payments and meeting tax obligations | Contract and legal obligation (6(1)(b), (c)) |
| Security and preventing fraud and abuse (IP address, rate limits) | Legitimate interest (6(1)(f)) |
We do not advertise, sell data, build profiles, or use analytics or marketing cookies.
4. Who can access the data
Listings are public: anyone, including search engines, can see what you publish. Other data is only accessible to the controller and to these processors acting on our behalf:
- Cloudflare: content delivery, security and email routing;
- Stripe: payment processing;
- Google: sending the site's emails.
The site is hosted on our own server in Portugal. Some of these processors may handle data in the United States under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
5. How long we keep data
| Data | Period |
|---|---|
| Account | While the account exists. You can delete it at any time. |
| Draft, expired, sold or withdrawn listings | Deleted with their photos 365 days after the last change |
| Messages to sellers | 365 days |
| Contact form messages | 730 days |
| IP addresses on messages | 90 days |
| Payment records | 10 years, as tax law requires, even after the account is deleted |
| Web server logs | 30 days |
Deletion runs automatically every day. Server backups are replaced periodically.
6. Cookies and storage on your device
| Name | Purpose | Lifetime |
|---|---|---|
| hl_session | Keeps you signed in | 30 days |
| hl_csrf | Protects forms against forged requests | 1 year |
| hl_flash | Shows a confirmation message after an action | 1 minute |
| hl.saved (local storage) | The listings you saved, kept only in your browser | Until you clear it |
All of them are strictly necessary for the site to work, so we do not ask for consent for them.
7. Your rights
You can ask for access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. You can correct your data and delete your account directly on the site; for anything else, contact us. We reply within one month.
You also have the right to lodge a complaint with the Portuguese data protection authority, CNPD (www.cnpd.pt), or the authority in your country.
8. Security
The site uses encrypted connections (HTTPS), passwords are stored hashed, server access is restricted and there are limits against abusive attempts. If a data breach poses a risk, we will notify the CNPD and, where required, the people affected, within the legal deadlines.
9. Children
TaxiwayMarket is not intended for anyone under 16.
10. Changes
If this policy changes in a meaningful way, we will say so on the site. The date of the last update is at the top.