Privacy Policy
How we handle your personal data
Last updated: September 2026
This is a courtesy translation. The Portuguese version is the legally binding text and prevails in the event of any discrepancy.
BilheteJá processes your personal data in accordance with the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and applicable Portuguese law.
This Policy forms part of the Terms of use / General regulation of the Platform.
1. Data Controller
JUST MARKET, Sociedade Unipessoal, LDA
Company registration no. 518654311
Rua Rodrigues Faria 103, Ed I, 3.36, 1300-501 Lisbon, Portugal
www.bilhete-ja.com
2. Data Collected
BilheteJá collects the following data:
Identification and contact data
- Name (required at registration)
- Email address (required at registration, used to send tickets and the invoice)
- NIF - Portuguese taxpayer number (only when the buyer wants an invoice in their name)
- Phone number (optional)
Transaction data
- Tickets purchased and the corresponding events
- Amounts paid and payment method used
- Payment references (Multibanco, MB WAY)
- Order history
Usage data
- IP address and session data
- Device type and browser
- Pages visited and interactions on the Platform
Verification data (Promoters)
- Tax identification
- IBAN for revenue transfers
- Proof of business activity
3. Purposes and Legal Basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing purchases and issuing tickets | Performance of a contract (art. 6(1)(b)) |
| Sending the ticket or invoice by email | Consent (art. 6(1)(a)) |
| Invoicing and tax obligations | Legal obligation (art. 6(1)(c)) |
| Fraud prevention and security | Legitimate interest (art. 6(1)(f)) |
| Service communications (event alerts) | Performance of a contract (art. 6(1)(b)) |
| Improving the Platform | Legitimate interest (art. 6(1)(f)) |
4. Data Retention
- Account data: while the account is active + 3 years after closure
- Transaction data: 10 years (statutory tax obligation)
- Session data and logs: 90 days
- Data provided on the basis of consent: until consent is withdrawn
Once the retention period ends, data is securely deleted or anonymised for statistical purposes.
5. Data Sharing
BilheteJá does not sell personal data to third parties. Data may be shared with:
- EUPAGO - payment processing (processor)
- InvoiceXpress - issuing invoices and reporting to the Portuguese tax authority (processor)
- Promoters - purchase data needed to validate admission at the event (name, QR code) and to issue refunds if an event is cancelled
- Competent authorities - where required by law or court order
All processors are bound by data processing agreements compliant with the GDPR.
6. Your Rights
Under the GDPR, you have the right to:
- Access - know what data we hold about you
- Rectification - correct inaccurate or incomplete data
- Erasure - request deletion of your data (the "right to be forgotten")
- Restriction - limit processing in certain circumstances
- Portability - receive your data in a structured, machine-readable format
- Objection - object to processing based on legitimate interest
- Withdrawal of consent - withdraw consent at any time, without affecting the lawfulness of earlier processing
To exercise any right, contact us. We respond within 30 days.
You also have the right to lodge a complaint with the CNPD - the Portuguese data protection authority (www.cnpd.pt).
8. Security
BilheteJá applies appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including:
- Encrypted communications (HTTPS/TLS)
- Secure credential storage (hashing)
- Role-based access control
- Access monitoring and audit logs
In the event of a data breach posing a risk to data subjects, we will notify the CNPD within 72 hours and the affected individuals without undue delay.
9. Minors
The Platform is not intended for children under 16. We do not knowingly collect data from minors. If you become aware that a minor has provided data without parental consent, please contact us so we can delete it immediately.
10. Changes to this Policy
This Policy may be updated at any time. Material changes will be announced on the Platform. Continued use after the changes are published constitutes acceptance.