Privacy policy

1. Who is responsible

The controller of your data is avokaza (Lisbon, Portugal). The company is being registered; its name, tax number and address will be published here before any paid visit takes place. For anything about your data write to [email protected].

2. What we collect

• What you type or tap in our forms: your name, phone number, the messenger you prefer, email if you give one, your area and postcode, and your answers about your household or your work: days, visits per week, visit size, children at home, when you would like to start, the cook profile you asked about and the price estimate you were shown, how much extra travel you would pay for, cuisines, languages, travel distance and how you travel, pay, shopping, experience and your own description, diet needs; for cooks also whether you are allowed to work in Portugal, whether you can issue receipts, whether you agree to the identity and criminal record check, and whether you are retired. We ask about retirement and receipts only to explain the tax and Social Security rules that apply to you; they are never used to decide who works with us.
• Approximate location, only if you tap “Use my location”. We round it to about 1 km before it leaves your phone.
• Cooks: a photo and a description, only if you add them. We do not ask for identity documents or criminal record certificates on the website. When we check them before a first visit, we record that the check was done and when, and do not keep copies longer than needed for the check.
• How the site is used: pages visited, buttons and form steps, the ad campaign that brought you (utm tags and, if you came from a Facebook or Instagram ad, the click id Meta adds to the link), the page you came from, a random session number stored in your browser, and the country, as reported by Cloudflare. We do not store your IP address.

Diet needs such as “gluten-free” can reveal something about health. You choose whether to tell us, and we use it only to match you with a suitable cook (your explicit consent, GDPR Art. 9(2)(a), given by ticking it next to a note that says exactly this), which you can withdraw at any time.

3. Why, and on what legal basis

• To contact you and match families with cooks: steps taken at your request before a contract (GDPR Art. 6(1)(b)).
• To understand which pages and ads work and improve the service, with our own statistics: our legitimate interest (Art. 6(1)(f)). You can object at any time.
• Ad measurement by Meta (Facebook, Instagram): only with your consent, given by clicking “Accept” on the cookie bar (Art. 6(1)(a)).
• Identity and criminal record check before a cook's first visit: steps taken at the cook's request before a contract (Art. 6(1)(b)), processed only as GDPR Art. 10 allows under Portuguese law: the certificate is issued to the cook for this stated purpose (Lei n.º 37/2015), and work in homes with children requires it (Lei n.º 113/2009). We only look at the certificate the cook shows us, record that the check was done and when, and do not keep copies longer than the check needs.
• Once visits start: legal obligations such as invoices and tax records (Art. 6(1)(c)).

4. Who sees your data

• The small avokaza team, and nobody else inside avokaza.
• Hetzner Online GmbH, which runs our server in Nuremberg, Germany (EU).
• Cloudflare, which protects the website and delivers its pages. It processes your IP address to do so and may do this outside the EU under the EU's standard contractual clauses and the EU-US Data Privacy Framework.
• Google Fonts: the website's fonts are loaded from Google's servers, which see your IP address.
• Meta, only if you accepted cookies.
• Your messenger (WhatsApp, Telegram, Viber, Signal), under its own terms, when we write to you there.
• Families and cooks: families see a cook's profile (first name and initial, photo, dishes, areas) only after the cook approves it; a cook sees a family's first name, area and visit details only once they are matched.

We never sell your data or give it to anyone for their own marketing.

5. How long we keep it

Registrations: until you ask us to delete them, and at most 12 months after our last contact if we do not start working together. Once visits start: while you use avokaza and for 12 months after your last visit, or longer only where the law requires it (for example invoices and tax records). Photos and descriptions: until you withdraw permission or your registration ends. Usage statistics (pages, buttons, form steps): 24 months. They contain no names or phone numbers, but they share a random session number with your registration, so we treat them as personal data and delete them with it on request.

6. Your rights

You can ask to see your data, correct it, delete it, limit its use, object to its use, receive it in a portable file, and withdraw any consent at any time, without affecting what was done before. Write to [email protected]; we answer within one month. You can also complain to the Portuguese data protection authority, CNPD (cnpd.pt).

7. Browser storage and cookies

We keep a few small items in your browser: a random session number, the campaign that brought you, your cookie choice, and, only if sending failed (for example with no signal), a copy of the form you sent, kept until it reaches our server on your next visit and then deleted. Meta's cookies are set only if you click “Accept”. You can clear all of this in your browser settings at any time.

8. Security

The website uses an encrypted connection (HTTPS). Registrations are stored on our server in the EU and only the avokaza team can open them, with a secret key.

9. Changes

If we change this policy in a way that matters to you, we tell you before the change applies. The version date is at the top of the page.