Privacy Policy

1. Data controller

The data controller is Nuno Miguel & Carla Susana, Lda, Portuguese tax number 517 451 972, with registered office at Rua Dom Manuel II, 6, 4430-084 Vila Nova de Gaia, Portugal.

Privacy contact: geral@vtrapidus.com. No Data Protection Officer is identified because no DPO has been appointed for this operation.

2. Who is covered

This policy applies to customers, passengers, people submitting requests on behalf of third parties, business contacts, prospective partners and driver applicants when they use the VTRapidus services and channels covered by this website.

3. Data processed in requests and bookings

• name, telephone number, email address and contact preference;
• service type, origin, destination and exact addresses;
• date, time, number of passengers, luggage and vehicle category;
• flight number where applicable;
• notes or instructions necessary for the service;
• booking reference, operational statuses, assigned driver/provider and essential service history;
• calculated price, validated price, payment amounts and payment statuses.

Driver/partner applications

When a person applies to join the network, VTRapidus may process identification and contact data, professional experience, availability, accepted service areas and service types, vehicle information and declarations relating to legal requirements. Additional supporting documents should only be requested where necessary at a later review stage and through the channel designated for that purpose.

4. Technical and security data

Technical data necessary for the operation and protection of the service may be processed, such as session information, event logs, date/time, security data, pseudonymised identifiers or hashes used for abuse limitation, duplicate prevention and technical auditing.

Pseudonymisation does not automatically make such data anonymous.

5. Payment data

Payments are processed through a specialised provider, currently Stripe. VTRapidus may process the booking reference, email address, amounts, status, session/event identifiers and information required for payment reconciliation.

VTRapidus does not need to store in its own system the full card details used in Stripe Checkout.

6. Sensitive data and free-text notes

As a general rule, we do not request health data, racial or ethnic origin, religion, sexual orientation or other special categories of data. The notes field should only be used for operational information that is necessary. If a specific accessibility or assistance requirement requires additional information, we ask that it be limited to what is strictly necessary.

7. Purposes

• receive, review and respond to requests;
• calculate and validate conditions and price;
• form, perform and manage transport/coordination contracts;
• communicate with the customer, passenger, driver and assigned provider;
• process and reconcile payments and refunds;
• issue tax documentation and comply with accounting or legal obligations;
• prevent fraud, abuse, duplication and security incidents;
• defend legal rights and manage complaints;
• measure website usage only where consent has been given for optional tools.

8. Legal bases

Depending on the purpose, processing may be based on pre-contractual steps and performance of the contract, compliance with a legal obligation, appropriately balanced legitimate interests — including security, fraud prevention, defence of rights and operational management — or consent where required by law, as is the case with certain optional analytics technologies.

We do not use consent as an artificial legal basis for processing that is necessary to manage a request or contract.

9. Necessary nature of the data

Fields marked as mandatory are necessary to review or perform the request. If they are not provided, it may not be possible to validate, confirm or provide the service.

10. Recipients and sharing

Data is shared only to the extent necessary. Recipients may include:

• the driver or operator assigned to the service;
• hosting, maintenance, email, security and technical-support providers;
• Stripe and other payment providers actually used;
• accounting, invoicing or professional advisers where necessary;
• authorities or competent bodies where there is a legal obligation or a legitimate need to defend legal rights.

Not all third parties necessarily act as processors: their legal role depends on the purposes and the degree of autonomy with which they process the data.

11. Drivers and operators

The assigned provider receives only the information necessary to prepare and perform the service, such as the passenger's operational identification/contact details, route, addresses, date/time, passengers, luggage and relevant instructions. The provider must not use that data for its own purposes that are incompatible with the service.

12. International transfers

Some global technology providers may process data outside the European Economic Area. Where this occurs, the transfer must rely on a mechanism recognised by the GDPR, such as an adequacy decision, Standard Contractual Clauses or another legally applicable safeguard.

13. Retention

Data is retained only for as long as necessary for the stated purposes and applicable legal periods. The duration varies according to the type of record:

• requests/bookings: for as long as necessary for performance, support, complaints and defence of rights;
• tax/accounting documentation: for the period required by applicable law;
• security and abuse-prevention records: for a period proportionate to the risk and purpose;
• consent and evidence of consent: for as long as necessary to demonstrate the choice and comply with accountability obligations;
• optional analytics data: according to the configuration and limits described in the Cookie Policy.

Retention periods should be reviewed whenever the purpose no longer justifies retention.

14. Data-subject rights

Where legally applicable, you may exercise rights of access, rectification, erasure, restriction, objection and portability, and withdraw consent where consent is the legal basis for processing.

These rights are not absolute; legal limitations may apply, in particular where certain data must be retained to comply with obligations or defend legal rights.

15. How to exercise your rights

Send your request to geral@vtrapidus.com, providing enough information to locate the relevant data. We may request appropriate proof of identity where necessary to prevent disclosure to third parties.

We will respond within the legally applicable time limits. As a general rule, the GDPR provides for a response within one month, without prejudice to permitted extensions in complex cases.

16. Automated decision-making

The website may carry out automatic route and price calculations, but confirmation of the request and price depends on human validation. In the normal flow described, no solely automated decision is made that produces significant legal effects for the customer.

17. Security

We apply technical and organisational measures proportionate to the risk, including access controls, protected sessions, separation of sensitive configurations, permission limits, technical logs and integrity/concurrency mechanisms for operational data.

No system is completely invulnerable; measures are reviewed in light of risk, technology and operational circumstances.

18. Personal-data breaches

Security incidents involving personal data are assessed under the GDPR. Where the legal criteria are met, notifications are made to the supervisory authority and/or affected data subjects within the applicable time limits.

19. Third-party data

Anyone entering another passenger's data must have a lawful basis for providing it and must limit the information to what is necessary for the service. Third-party data should not be entered without necessity or appropriate authority.

20. Cookies and external technologies

Use of Google Analytics, Microsoft Clarity and similar technologies depends on the choices described in the Cookie Policy. External resources, such as web fonts, may involve technical connections to third-party providers even where they are not analytics cookies.

21. Complaint to the CNPD

Without prejudice to other legal remedies, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese Data Protection Authority if you consider that the processing infringes data-protection law.

22. Changes and version

This policy may be updated to reflect legal, technical or operational changes. Material changes will be reflected in a new version/date. The version applicable to a contractual interaction may be recorded together with the relevant reference.

Contact

Nuno Miguel & Carla Susana, Lda
NIF 517 451 972
Rua Dom Manuel II, 6 · 4430-084 Vila Nova de Gaia · Portugal
geral@vtrapidus.com · +351 911 584 065