Privacy Policy
Last updated: 9 November 2026
This is a translation for convenience. The Portuguese version prevails in case of doubt.
Scope
This policy explains which personal data F3ST processes, why, on what legal basis and for how long, and which rights the people concerned have. It covers this website, the backoffice, the point-of-sale app and the F3ST API.
1. Controller
Sérgio Tiago Gomes Serra, sole trader, tax ID 244831726, Avenida do Atlântico, n.º 644, 4900-348 Viana do Castelo, Portugal. Privacy contact: geral@f3st.pt. No data protection officer has been appointed, as the law does not require one.
2. Two different roles
F3ST is the controller of the data of visitors to this website and of the data of the organizations and team members who use the platform.
At events, the seller is the organizer. The data of the people who consume and pay at an event is collected by the organizer, who is its controller; F3ST processes it on the organizer's behalf as a processor, under Article 28 GDPR and the data processing agreement included in the Terms of Service. Anyone who attended an event should exercise their rights with the organizer; F3ST helps the organizer respond.
3. Which data is processed
3.1 Visitors to this website
- Language cookie (f3st_locale): remembers the chosen language for one year. It is strictly functional and needs no consent.
- Light or dark theme: kept in the browser's local storage, only once you change it. It never leaves your device.
- Technical logs from Cloudflare, which serves the site: IP address, time, page requested and browser type, for security and abuse detection.
- Visit statistics from Cloudflare Web Analytics: visits, page views, country and device type, in aggregate, without cookies or identifiers of who visits.
This website uses no analytics, advertising or third-party cookies, and no tools that follow visitors across sites.
If you write to our contact email, we process what you send us to reply and, where relevant, prepare a proposal.
3.2 Organizations and team members
- Organization: name, tax ID, address, phone, logo, agreed fee, account status and, if connected, the payment account identifier and the invoicing software access key, stored encrypted.
- Members: name, email, language, login credentials (managed by the Keycloak authentication server, with hashed passwords) and the permissions granted by the organization.
- Activity record: who made each sale, card hand-out, payment or void, and when. Sales are never changed or deleted: this is what keeps organizers' accounts right.
3.3 People attending events (on behalf of the organizer)
- Consumption per card: the products, amounts and times recorded on each NFC card. The card has a number and is not linked to any identity, unless the person asks for an invoice with their tax ID.
- Tax ID and email, only when the person gives them at payment to receive the invoice. They are stored with the invoice issued.
F3ST does not collect payment data (bank cards).
4. Purposes and legal bases
| Purpose | Legal basis (GDPR, Art. 6) |
|---|---|
| Providing the service to organizations: accounts, teams, events, sales, dashboard | Performance of a contract, 6(1)(b) |
| Issuing and sending invoices and keeping sales records | Legal obligation (Portuguese VAT and tax law), 6(1)(c) |
| Charging our fee to organizations | Performance of a contract and legal obligation |
| Security, technical logs, fraud and abuse prevention | Legitimate interest, 6(1)(f) |
| Replying to enquiries and preparing proposals | Steps prior to a contract, 6(1)(b) |
| Measuring visits to the site, in aggregate | Legitimate interest, 6(1)(f) |
| Remembering the chosen language and theme | Functionality requested by the user (Portuguese Law 41/2004, Art. 5) |
5. Who has access to the data
Data is processed by us and by the providers below, acting as processors under contract. All data is stored in the European Union. Some providers are headquartered in the United States; in those cases the European Commission's standard contractual clauses apply and, where certified, the EU-US Data Privacy Framework.
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud (Cloud Run) | Running the API and the authentication server | European Union |
| Neon | Database; product photos and logos | European Union |
| Cloudflare | Serving this website and the backoffice; attack protection; visit statistics; sending platform emails (member invitations) | European Union |
| Grafana Cloud | Technical logs and monitoring | European Union |
| InvoiceXpress (Rupeal, Lda.) | Issuing and emailing invoices, in each organizer's account | Portugal |
If an organizer connects a payment account, that payment service provider processes payment data as an independent controller, under its own policy.
Otherwise we only share data when the law requires it, for example with the tax authority or under a court order.
6. For how long
- Organization and member data: while the account is active and for 90 days after it ends, to allow export. It is then deleted or anonymised.
- Sales, tabs, invoices and the tax ID and email attached to them: 10 years, as required by Portuguese tax law (Article 52 of the VAT Code).
- Technical logs with IP addresses: up to 30 days.
- Contact emails: for the duration of the conversation and up to one year after, unless a contract follows.
7. Your rights
You may request access to your data, its rectification or erasure, restriction of processing, portability, and object to processing based on legitimate interest. Write to the email in section 1. We reply within one month. If the data concerns an event you attended, we forward the request to the organizer or tell you how to reach them.
You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
8. Security
Connections are encrypted (HTTPS). Passwords are never stored in clear text. Invoicing software access keys are encrypted in the database. Access to each organization's data is limited by the permissions the organization itself grants its members. Sales are recorded in an append-only way.
9. Minors
F3ST is not aimed at minors and does not knowingly collect their data. Organizations are responsible for what they sell and to whom.
10. Changes
When this policy changes, the date at the top is updated. Material changes are communicated to organizations by email.