01 Introduction
PRESTIGEMOVE ("we," "us," "our") is committed to protecting the privacy and personal data of its clients, visitors, and other individuals who interact with our website and services. This Privacy Policy explains what personal data we collect, how we use it, how we keep it secure, and the rights you have under the EU General Data Protection Regulation (GDPR) and Portuguese Law No. 58/2019.
By using our website or making a booking with us, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of it, please refrain from providing us with personal information or using our services.
02 Data Controller
For the purposes of GDPR, the data controller responsible for your personal data is:
4430-239 Vila Nova de Gaia, Portugal
You may contact us at any time using the details above for matters relating to your personal data.
03 What Personal Data We Collect
We collect only the personal data that is necessary to deliver the service you have requested, comply with our legal obligations, or pursue our legitimate business interests. Depending on how you interact with us, this may include:
- Full name, salutation, and where applicable, company name
- Telephone number, including international dialling code
- Email address
- Pickup and dropoff addresses, intermediate stops, dates and times of travel
- Flight or train number, where relevant
- Number of passengers and luggage
- Special requirements (child seat, accessibility needs, in-vehicle refreshments)
- Free-text booking notes (we ask that you do not include sensitive personal data in this field)
- Payment information, which is processed by Stripe and is not stored on our servers
- IP address, browser type, operating system, and approximate location when you visit our website
- Cookie and similar tracking data — see our Cookies Policy
We do not knowingly collect data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health information, sexual orientation, or biometric data. If such data is provided to us unsolicited (for example, in a booking note disclosing a medical condition), it will be used solely to deliver the service requested and deleted at the earliest opportunity.
04 Booking & Contact Information
The most common reason we collect personal data is to confirm and deliver a booking. This includes the data listed in Section 3, as well as records of communications you have with us by email, telephone, WhatsApp, or social media.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) and our legitimate interests in operating a passenger transport service (Article 6(1)(f) GDPR).
05 Payment Information
Payments made through our website are processed by Stripe Payments Europe, Limited ("Stripe"), an independent payment processor headquartered in Ireland. When you enter card details on our checkout page, those details are submitted directly to Stripe and never reach our servers. Stripe is certified PCI-DSS Level 1 and acts as an independent data controller for payment processing.
We receive from Stripe only the information necessary to confirm payment: transaction reference, card type, last four digits, billing country, and outcome (succeeded / failed). We retain this information for the duration required by applicable accounting and tax law (currently ten years in Portugal for invoicing records).
Legal basis: performance of a contract and compliance with legal obligations (Articles 6(1)(b) and 6(1)(c) GDPR).
You can read Stripe's privacy notice at stripe.com/privacy.
06 Location & Mapping Data
When you use the booking form on our website, the pickup and destination addresses you enter are submitted to Google Maps Platform in order to autocomplete addresses, calculate distances and estimated travel times, and generate a fare estimate. This is performed in your browser via the Google Maps JavaScript API.
Google may collect technical information such as your IP address and approximate location in connection with these calls. Google is an independent data controller in respect of such processing. Their privacy notice is available at policies.google.com/privacy.
We do not track your real-time location during a journey. Our chauffeurs follow the agreed route based on the pickup and destination you have provided, using standard satellite navigation that does not transmit personal data back to us.
Legal basis: performance of a contract and your consent, where required by law.
08 Email, SMS & WhatsApp Communication
We will use the email address and phone number you provide to:
- Confirm your booking and send pre-arrival reminders
- Communicate route updates, chauffeur details, and meeting point information
- Resolve any post-trip query or complaint
- Send a receipt or invoice on request
- Send service-related notices (changes to these policies, suspensions of service)
We will not send marketing or promotional messages unless you have explicitly opted in. You may withdraw consent to marketing at any time by replying STOP to any marketing message or by emailing privacy@prestigemove.pt.
Legal basis: performance of a contract, our legitimate interests, and your consent where required.
09 Analytics
We may use privacy-conscious web analytics tools to understand how visitors use our website (for example, which pages are most viewed, the country of origin of visits, and the type of device used). Where we use such tools, we configure them to anonymize IP addresses and to respect any Do Not Track or cookie consent setting that you have made.
We do not combine analytics data with your booking data, and we do not use it for advertising or profiling.
10 How Long We Keep Your Data
We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law. Indicative retention periods:
| Data Category | Retention Period |
|---|---|
| Booking records | Up to 5 years after the last interaction |
| Accounting & invoicing data | 10 years (Portuguese tax law) |
| Marketing consent records | Until consent is withdrawn, plus 1 year |
| Website analytics data | Up to 26 months, anonymized |
| Server access logs | Up to 90 days |
After the applicable retention period, data is securely deleted or irreversibly anonymized.
12 International Data Transfers
The majority of our data processing takes place within the European Economic Area. Where personal data is transferred outside the EEA — most notably to Google in the United States — we rely on the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework, or other lawful transfer mechanisms to ensure your data receives an equivalent level of protection.
13 Your Rights Under GDPR
You have the following rights in respect of your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention obligations.
- Right to restriction of processing — ask us to limit how we use your data.
- Right to data portability — receive your data in a structured, machine-readable format and have it transferred to another controller.
- Right to object — object to processing based on our legitimate interests, including direct marketing.
- Right to withdraw consent — where we process data on the basis of consent, you may withdraw it at any time.
- Right not to be subject to automated decision-making — we do not currently make any decisions producing legal effects on you using purely automated processing.
To exercise any of these rights, please contact us at privacy@prestigemove.pt. We aim to respond within thirty (30) days. There is no fee for exercising your rights, unless your request is manifestly unfounded, excessive, or repetitive.
14 Right to Lodge a Complaint
If you believe we have failed to comply with the GDPR or other applicable data protection law, you have the right to lodge a complaint with the Portuguese data protection authority:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
Telephone: +351 213 928 400
Website: cnpd.pt
You may also lodge a complaint with the supervisory authority in the EU Member State in which you reside or work.
15 Data Security
We take the security of your personal data seriously and implement appropriate technical and organizational measures, including:
- HTTPS encryption (TLS 1.2 or higher) for all data transmitted between you and our website
- Encryption at rest of backups and stored booking records
- Access controls limiting personal data to authorized personnel on a need-to-know basis
- Regular security updates and monitoring of our infrastructure
- Periodic internal review of our data protection practices
- Use of certified third-party processors (Stripe — PCI-DSS Level 1)
No method of transmission over the internet or storage system is completely secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.
16 Children's Privacy
Our services are not directed to individuals under the age of sixteen (16). We do not knowingly collect personal data from children. Where we transport minors, the booking is made by, and personal data is collected from, the adult responsible for the booking. If we become aware that we have inadvertently collected personal data from a child without parental consent, we will delete it promptly.
17 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any material change will be brought to your attention by a notice on our website and, where appropriate, by direct communication.
18 Contact
Questions, requests, or complaints relating to this Privacy Policy or your personal data may be addressed to:
4430-239 Vila Nova de Gaia, Portugal