Privacy Policy

The controller of your personal data is FALÉSIA DA MAGNÓLIA - UNIPESSOAL LDA, a company registered in Portugal with NIPC 517885042. Our registered office is at Lisbon, Portugal. We operate through GetVoolo (getvoolo.com) and the GetVoolo Driver app.

For anything about your personal data, write to developer@getvoolo.com. TODO: state whether a Data Protection Officer is appointed (see lib/legal/company.ts)

GetVoolo is a marketplace for airport transfers in Lisbon. Passengers describe a journey. Licensed local drivers offer to carry it out.

We hold data about four groups of people: passengers, drivers, people who join our waitlist, and anyone visiting the site. Each section below says what we collect, why, the legal basis, and how long we keep it.

We do not sell personal data. We do not use it for advertising. We do not make decisions about you by automated means that have legal or similarly significant effects — which driver carries a trip is the passenger's choice, and admitting a driver onto the platform is decided by a person reviewing their documents.

Who sees your contact details. While your request is open for offers, drivers see the trip — addresses, time, passengers, luggage, vehicle class. They do not see your name, email, phone or tax number; the database refuses those to them. Once you choose a driver, that driver can see your name, phone and email so they can reach you on the day. That lasts while the trip is under way and for 48 hours after it ends, so a lost bag can still be returned. They never see your tax number. You can see your driver's phone on the same terms.

Paid passenger transport in Portugal is licensed, so before a driver can bid we must verify documents we would otherwise never ask for.

Before the site offered a full booking flow, visitors could leave their email address with a priced trip so we could tell them when they could book it. If you did that, we still hold your email with the pickup and drop-off you had entered, for at most 1 year, and you can ask us to delete it at any time. Legal basis: your consent (6(1)(a)), which you can withdraw by writing to developer@getvoolo.com.

We use the following providers. Each acts on our instructions under a data processing agreement, and receives only what it needs for its task.

Within GetVoolo, authorised administrators can see bookings and driver documents to run the service. Every administrative action on accounts, bookings and money is logged. We disclose data to public authorities only where the law requires it.

Some providers above are based in the United States, or can access data from there. When that happens, we rely on one of two safeguards: the provider's certification under the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses. TODO: confirm the transfer mechanism for each non-EU provider (Stripe, Mapbox, Expo, AeroDataBox, Sentry, Google)

These periods are enforced by an automatic nightly clean-up, not only promised here.

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify anything inaccurate — most of it you can edit yourself in your account;
• erasure — you can delete your account yourself in your account settings; we then remove your personal data except what the law requires us to keep, which is anonymised (see § 9). How to delete your account;
• restrict processing while a complaint is being looked at;
• portability — a copy of the data you gave us, in a machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, for push notifications or the waitlist, without affecting what happened before.

How: write to developer@getvoolo.com from the email address on your account, or tell us which booking or waitlist entry it is about. Say which right you want to use. We may ask you to confirm your identity. We answer within one month. If a request is complex we may extend that by up to two more months, and we will tell you why.

If you are unhappy with our answer, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or to the authority where you live or work.

Accounts are for adults. Children may travel as passengers on a booking made by an adult, who provides only the number of child seats needed. TODO: confirm the minimum age for an account (16 is the Portuguese age of digital consent)

Access is enforced in the database itself, not only on the screen. In practice, that means:

• a passenger can read only their own bookings;
• a driver sees open trips without passenger contact details, and gets contact details only for the trip they were chosen for;
• driver documents sit in a private store, reachable only through short-lived links issued to administrators;
• confidential driver fields — tax numbers, licence numbers, payment account identifiers — are held apart from the profile passengers can see.

The administration console requires two-factor authentication.

When we change what we collect or why, we update this page and the date at the top, and we tell account holders by email about changes that affect them. See also our cookie policy and terms of service.