In compliance with Regulation (EU) 2016/679 of April 27, 2016 (GDPR), and Law No. 58/2019 of August 8, users of the CLUB33BLACK Platform are hereby informed regarding the processing of their personal data.
The purpose of this Policy is to provide information regarding the processing of personal data resulting from access to and use of the Platform, including browsing, membership enrollment, use of artificial intelligence systems, and participation in the message board, as well as the rights of users and how to exercise them.
Note on the legal basis for AI systems. In this version, processing via artificial intelligence is based on the performance of the contract, rather than on consent as stated in the previous draft. The reason is practical: product identification and pairing systems constitute the core of the contracted service; therefore, if the legal basis were consent and that consent were withdrawn, the user would be left without the service for which they have paid. This point must be confirmed by the attorney, as it determines the entire structure of the document.
| Purpose | Legal Basis | Data Processed | Retention Period |
|---|---|---|---|
| Account Registration and Management | Contract Performance (Art. 6.1.b) | Identifiers, contact information, credentials, display name, profile photo | For the duration of the relationship and applicable statute of limitations periods |
| Verification of Legal Age | Legal Obligation (Art. 6.1.c) | Affidavit, date, and language of the declaration | For the duration of the relationship and the applicable statute of limitations periods |
| Membership management and billing | Performance of a contract and legal obligation (Art. 6.1.b and 6.1.c) | Payment data (via payment gateway), billing information | 10 years, in accordance with Portuguese tax and accounting regulations |
| Private collection management | Contract performance (Art. 6.1.b) | Item details, images provided, personal notes | For as long as the account exists |
| Product identification using AI | Contract performance (Art. 6.1.b) | Images provided by the user | For as long as the account exists or until the item is deleted |
| AI-powered pairing recommendations | Performance of the contract (Art. 6.1.b) | Consumption preferences, collection content, usage history | For as long as the account exists |
| Message board and community features | Performance of the contract (Art. 6.1.b) | Display name, posts, comments, reactions | For as long as the account exists; after deletion, the content is anonymized |
| Content moderation and complaint handling | Legal obligation and legitimate interest (Art. 6.1.c and 6.1.f) | Reported content, reason, identity of reporter and author | Timeframes set forth in Regulation (EU) 2022/2065 |
| Show nearby locations | Consent (Art. 6.1.a) | Approximate device location | Not stored; used only during the session |
| Commercial communications | Consent (Art. 6.1.a) | Contact information, preferences | Until consent is withdrawn |
| Compliance with legal obligations | Legal obligation (Art. 6.1.c) | Billing, transaction records | Applicable tax and commercial deadlines |
| Security and technical logging | Legitimate interest (Art. 6.1.f) | Access logs, application errors, IP address | The period strictly necessary for its purpose |
The Platform’s artificial intelligence systems analyze preferences, collection content, and interaction history to generate personalized recommendations. This processing constitutes a form of profiling within the meaning of Article 4.4 of the GDPR.
The recommendations generated are for informational purposes only and do not produce legal effects or significantly affect the user within the meaning of Article 22 of the GDPR; therefore, they do not constitute automated decisions with legal effects.
Notwithstanding the foregoing, and as an additional safeguard in line with the principles of human oversight set forth in Regulation (EU) 2024/1689, the user may request a human review of a recommendation, as well as information regarding the logic applied, by contacting contacto@club33black.com.
In accordance with Regulation (EU) 2024/1689, these systems are classified as low-risk and are subject to the transparency obligations set forth in Article 50 thereof. Users are expressly informed, at the time of interaction, that the result has been generated using artificial intelligence.
The data may be disclosed to the following recipients, to the extent necessary for the provision of the service:
Likewise, the data may be disclosed to professional advisors (legal, tax, and accounting) when necessary, and to public authorities when there is a legal obligation to do so.
A corresponding contract in accordance with Article 28 of the GDPR has been entered into, or will be entered into prior to the commencement of service provision, with all data processors.
Warning regarding images. The photographs that the user uploads to the scanner and to the records of their collection are transmitted to an artificial intelligence provider located outside the European Economic Area for analysis. It is recommended not to include in these images any personal data—whether your own or that of third parties—that is not necessary for identifying the product.
| Provider | Purpose | Location |
|---|---|---|
| Base44 (Base44 Ltd.) | Hosting, database management, function execution, file storage, and email delivery | United States |
| Stripe | Payment processing and subscription management | European Union and United States |
| Anthropic | Generation of recommendations using the Claude model | United States |
| Analysis of submitted images for product identification using the Gemini model | United States | |
| CARTO / OpenStreetMap | Display of location maps | European Union |
The Platform’s hosting and infrastructure provider (Base44) generally stores and processes data on servers located in the United States. Likewise, files and images provided by the user are stored in the United States, and the artificial intelligence providers (Anthropic and Google) process the data submitted for image analysis and the generation of recommendations also in the United States. Consequently, the use of the Platform involves an international transfer of data outside the European Economic Area.
These transfers are covered by the mechanisms set forth in Chapter V of the GDPR: as applicable, the importer’s adherence to the EU–U.S. Data Privacy Framework or the adoption of the Standard Contractual Clauses approved by the European Commission, accompanied by additional technical, organizational, and contractual measures that ensure a level of protection equivalent to that required by the GDPR. A Data Processor Agreement in accordance with Article 28 of the GDPR is in place with the infrastructure provider.
The user may request additional information regarding the safeguards in place, as well as a copy of them, at the address indicated in section 1.
Users may exercise the following rights at any time by contacting contacto@club33black.com:
Fábulas Boémias Unipessoal Lda may request documentation to verify the identity of the requesting individual when there are reasonable doubts. The exercise of these rights is free of charge, except in the case of manifestly unfounded or excessive requests, and a response will be provided within a maximum of one month, extendable by an additional two months in particularly complex cases.
Users have the right to file a complaint with the National Data Protection Commission (CNPD, cnpd.pt) if they believe that the processing of their data does not comply with current regulations. Residents of Spain may also contact the supervisory authority in their place of habitual residence.
In general, data is provided directly by the user during the registration process, when signing up for membership, and while using the Platform. Additionally, data may be received from the payment gateway in connection with transactions. If data is collected from other sources, its origin will be specifically disclosed in accordance with Article 14 of the GDPR.
Appropriate technical and organizational measures are implemented to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, including encryption in transit, role-based access control, pseudonymization where possible, and periodic evaluation of the effectiveness of these measures. The infrastructure provider holds recognized certifications in information security (SOC 2 Type II and ISO/IEC 27001).
In the event of a personal data breach that poses a risk to the rights and freedoms of users, the CNPD will be notified within a maximum of 72 hours and, where appropriate, the affected individuals will be notified, in accordance with Articles 33 and 34 of the GDPR.
Users may delete their account at any time from their profile. The procedure is as follows:
If the user wishes to return to the club at a later time, they must create a new account. Previous data cannot be recovered.
The Platform is not intended for minors. Access is restricted to individuals who are of the legal age required in their country of residence for the consumption of tobacco and alcoholic beverages; under no circumstances is access permitted to individuals under the age of 18.
Verification is conducted through a mandatory sworn statement at the time of registration, a record of which is retained along with the date. If it comes to our attention that information has been collected from a minor, we will proceed to delete such information and cancel the corresponding account.
This Policy may be modified to adapt to new legislation, case law, or changes in data processing practices. Any amendments will be reflected by updating the date indicated at the end of the document. Substantial changes will be communicated to registered users via email or through a prominent notice on the Platform prior to their effective date. When a change affects processing based on consent, new consent will be obtained.
Last updated: August 8, 2026.
We use necessary technical cookies for the app to work. You may accept optional cookies (achievements and animations) or only the essential ones. Cookie policy