GDPR Information

1. Scope

This page summarises the principles and rights applied by VTRapidus when processing personal data. A detailed description of processing activities, recipients, purposes and retention criteria is available in the Privacy Policy.

2. Principles

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• integrity and confidentiality;
• accountability.

3. Rights

Where applicable, the data subject may request access, rectification, erasure, restriction, objection and portability, and may withdraw consent where processing is based on consent.

The exercise of a right may be subject to limitations provided by law, in particular where retention obligations or the defence of legal rights apply.

4. Exercising rights and response

Requests should be sent to geral@vtrapidus.com. VTRapidus may request proportionate information to confirm identity and prevent improper disclosure of data.

Requests are handled within the GDPR time limits, generally within one month, without prejudice to any extensions permitted by law.

5. Data protection by design

VTRapidus seeks to apply data minimisation, access controls, separation of sensitive information, session management, security logs and other measures proportionate to the risk. Measures are reviewed as the system and risks evolve.

6. Providers and recipients

Where third parties process data in the context of the operation, their legal role is assessed according to the specific relationship. Operational data is limited to what is necessary, including when a driver or operator is assigned.

7. Consent

Consent is used only where it is the appropriate and legally required basis. It may be withdrawn with the same practical ease with which it was given, without affecting prior lawful processing.

For transport requests, data strictly necessary for review and performance does not depend on a general marketing or cookie authorisation.

8. Incidents

Any incident involving personal data is assessed in terms of risk to data subjects. Where required by law, notifications are made to the supervisory authority and/or communications are made to affected data subjects in accordance with the GDPR.

9. Supervisory authority

The data subject may lodge a complaint with the CNPD — Comissão Nacional de Proteção de Dados, the Portuguese Data Protection Authority, without prejudice to other administrative or judicial rights.

10. Related documents

See also the Privacy Policy, the Terms of Use and the Cookie Policy. Where more detailed information exists for a specific processing activity, the specific information applicable to that processing and mandatory law take precedence.

Contact

Nuno Miguel & Carla Susana, Lda
NIF 517 451 972
Rua Dom Manuel II, 6 · 4430-084 Vila Nova de Gaia · Portugal
geral@vtrapidus.com · +351 911 584 065