PORTO MARKETPLACE
Privacy Policy
Last updated: 18 September 2026
This Privacy Policy explains how Porto Marketplace Ltd (“PORTO”, “we”, “us”, or “our”), operating as PORTO Marketplace, collects, uses, stores, shares, and protects personal data when you access or use the PORTO website, applications, marketplace, and related services (the “Platform”).
This Privacy Policy describes the data processing activities applicable to the current PORTO Platform and the services available at the time of publication.
1. Data Controller
Porto Marketplace Ltd
Company number: SC895950
Registered in: Scotland
Registered office:
67/8 Iona Street, Edinburgh, Scotland, EH6 8SR
United Kingdom
Data protection contact:
PORTO is the data controller responsible for personal data processed through the Platform under applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
2. Personal Data We Collect
We collect personal data that is reasonably necessary to operate the Platform, provide marketplace functionality, maintain account security, provide support, and manage subscriptions.
A. Information you provide directly
When you create or use a PORTO account, we may collect:
- Full name
- Email address
- Password credentials, stored using appropriate security measures
- Country and location information
- Profile information you choose to provide
- Website or “About” information where available
- Account preferences and settings
When you create a listing, we may collect information you submit about an aircraft or vessel, including:
- Listing title and description
- Type, category, manufacturer, model and other listing specifications
- Year and other technical information
- Price and related listing information
- Location
- Photographs and videos
- Other information you voluntarily include in the listing
When you communicate with another user through PORTO, we may process:
- Message content
- Information about the participants in the conversation
- Conversation and message timestamps
- Related technical information required to operate and secure messaging
B. Authentication through third parties
PORTO may allow authentication through third-party identity providers such as:
Where you choose a third-party login, we may receive information such as your name, email address, and provider user identifier, depending on the permissions and information made available by that provider.
C. Support requests
When you contact PORTO through the Platform, we may collect:
- Category
- Subject
- Description
- Your name and email address
- Documents or images that you voluntarily attach to a support request
Support attachments are transmitted to PORTO for the purpose of responding to your request and are not intended to be retained indefinitely.
D. Technical and security information
When you use the Platform, we may collect limited technical information necessary for security, reliability, and operation, including where applicable:
- IP address
- Browser type
- Device type
- Operating system
- Approximate location derived from IP address
- Authentication and security logs
- Information relating to requests and errors
PORTO does not use this information to create detailed behavioural profiles for advertising purposes.
E. Subscription and payment information
PORTO uses third-party payment services, including Stripe, to process PORTO membership subscriptions.
PORTO does not store full payment card numbers or full card security codes.
Stripe may provide PORTO with limited subscription and payment information necessary to manage your membership, such as:
- Subscription status
- Payment status
- Stripe customer or subscription identifiers
- Price or plan information
- Payment method type
- Limited card information, such as the last four digits, where provided by Stripe
Your payment card information is handled by Stripe in accordance with Stripe’s own terms and privacy documentation.
3. How We Use Personal Data
We use personal data only where necessary and for purposes including:
- Creating and managing PORTO accounts
- Providing marketplace functionality
- Publishing and managing aircraft and vessel listings
- Allowing users to save listings as favourites
- Enabling user-to-user messaging
- Providing customer and technical support
- Managing PORTO memberships and subscriptions
- Processing subscription payments through Stripe
- Sending account, security, service, and transaction-related communications
- Maintaining Platform security
- Preventing fraud, abuse, spam, and misuse
- Monitoring and troubleshooting Platform reliability
- Complying with legal and regulatory obligations
4. Lawful Bases for Processing
Depending on the circumstances, PORTO relies on the following lawful bases under the UK GDPR:
Performance of a contract
Where processing is necessary to provide the Platform or services requested by you, including:
- Creating and managing your account
- Operating marketplace functionality
- Managing listings
- Enabling messaging
- Managing your PORTO membership
- Processing subscription-related activities
Legitimate interests
Where processing is necessary for PORTO’s legitimate interests and those interests are not overridden by your rights, including:
- Platform security
- Fraud and abuse prevention
- Protecting users and marketplace integrity
- Preventing spam and misuse
- Maintaining and improving Platform reliability
- Responding to technical and security incidents
Legal obligation
Where processing is necessary to comply with applicable legal obligations, including applicable accounting, tax, regulatory, law-enforcement, or other legal requirements.
Consent
Where consent is required by law for a particular processing activity, PORTO will request consent separately and will not rely on continued use of the Platform as consent.
5. Communications
PORTO may send:
- Account and security notifications
- Email verification messages
- Password-reset messages
- Service-related communications
- Notifications relating to messages or Platform activity
- Support-related responses
- Subscription and billing-related communications
These communications are generally necessary to provide the Platform or maintain account security.
PORTO does not currently use advanced behavioural advertising or profiling as part of the Platform.
6. Sharing Personal Data
PORTO may share personal data only where reasonably necessary for the operation, security, support, or legal administration of the Platform.
A. Service providers
Depending on the feature used, PORTO may use service providers for:
- Cloud hosting and infrastructure
- Email delivery
- Secure media storage
- Geolocation and address services
- Authentication
- Error monitoring and operational services
Current providers may include services such as Resend, Cloudinary, Mapbox, Cloudflare Turnstile, Google, and Facebook, depending on the feature used.
B. Payment provider
PORTO uses Stripe for membership subscription and payment processing.
Stripe processes payment information in accordance with its own privacy documentation and applicable law.
C. Legal and regulatory recipients
PORTO may disclose personal data where necessary:
- To comply with applicable law
- To respond to valid legal requests
- To protect the rights, safety, and property of PORTO or its users
- To investigate fraud, abuse, or unlawful activity
- To regulators, courts, law-enforcement authorities, or other competent authorities where legally required
PORTO does not sell personal data.
7. Cookies and Similar Technologies
PORTO currently uses cookies and similar technologies only where necessary for:
- User authentication and session management
- Platform security
- Essential functionality
PORTO does not currently use advertising cookies as part of the current Platform.
Where non-essential cookies or similar technologies are introduced and consent is legally required, PORTO will request consent before using them.
Further information is available in the Cookie Policy.
8. Data Retention
PORTO retains personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.
Retention periods depend on the type and purpose of the information and may include:
- Account information: while the account remains active and for a reasonable period afterwards where necessary for legal, security, fraud-prevention, or dispute purposes
- Listing information: while required to operate the marketplace and for a reasonable period afterwards where necessary for legal, security, fraud-prevention, or dispute purposes
- Messages: for as long as reasonably necessary to operate messaging, protect users, investigate abuse, and resolve disputes
- Subscription and accounting information: for the period required by applicable legal, accounting, tax, and financial obligations
- Support requests and attachments: for as long as reasonably necessary to respond to the request, maintain support records, resolve disputes, or meet legal obligations
- Security and technical logs: for a limited period appropriate to security, fraud prevention, and operational requirements
When personal data is no longer required, PORTO may delete it, anonymise it, or otherwise securely dispose of it where appropriate.
9. Data Security
PORTO uses reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.
These measures may include:
- Access controls
- Authentication and authorisation controls
- Encryption in transit where appropriate
- Secure handling of credentials
- Restricted access to personal data
- Security monitoring and abuse prevention measures
No internet-based system can be guaranteed to be completely secure.
10. Your Rights
Depending on the circumstances and applicable law, you may have rights including:
- The right to access your personal data
- The right to correct inaccurate or incomplete personal data
- The right to request deletion of your personal data
- The right to restrict processing
- The right to object to certain processing
- The right to data portability
- The right to withdraw consent where processing is based on consent
Where PORTO processes personal data based on legitimate interests, you may have a right to object to that processing in accordance with applicable law.
To exercise your rights, contact:
You also have the right to complain to the UK Information Commissioner’s Office (ICO) if you believe your personal data has been processed unlawfully or your data protection rights have not been respected.
11. International Data Transfers
Because PORTO uses international technology and service providers, personal data may be processed outside the United Kingdom.
Where personal data is transferred outside the UK, PORTO will use an appropriate lawful mechanism under applicable UK data protection law, which may include:
- A UK adequacy regulation where applicable
- The UK International Data Transfer Agreement (IDTA)
- The UK Addendum to the EU Standard Contractual Clauses
- Another lawful transfer mechanism recognised under applicable law
The specific safeguards applicable to a transfer depend on the service provider and destination involved.
12. Children's Privacy
The PORTO marketplace is not intended for children.
Users must be at least 18 years old to buy or sell through the Platform.
PORTO does not knowingly seek to collect personal data from children for marketplace activities.
13. Third-Party Websites and Services
The Platform may contain links to third-party websites or services, including social-media and payment services.
Those third parties operate under their own privacy policies and terms. PORTO is not responsible for the privacy practices of third-party services that PORTO does not control.
14. Changes to This Privacy Policy
PORTO may update this Privacy Policy from time to time to reflect changes in the Platform, legal requirements, technology, or processing activities.
The latest version will be published on the Platform together with its effective or update date.
Where required by law, PORTO will provide additional notice of material changes.
15. Contact
For privacy or data-protection questions, requests, or complaints, contact:
Porto Marketplace Ltd
Company number: SC895950
Registered in: Scotland
Registered office:
67/8 Iona Street, Edinburgh, Scotland, EH6 8SR
United Kingdom