Vanoia values its customers' privacy and is committed to protecting their personal data with diligence and responsibility. This document explains how we collect, use, share and protect our customers' information, as well as the rights of data subjects.
Data Controller
Vanoia, represented by the data controller Marcelo Aguiar Rodrigues (NIF 225248182), with its address at Rua Vila Cesari 188, 3700-611 Cesar, is the entity responsible for processing your personal data. For any matter relating to the protection of your data, or to exercise your rights, you can contact us by email: [email protected].
Given the size and nature of our activity, we are not legally required to appoint a Data Protection Officer (DPO). All matters relating to your personal data should be directed to the contact above.
Personal Data Collected
We collect and process the personal data you provide directly, which may include:
- Identification Data: name, number and validity of identification documents (and their images), among others.
- Contact Data: address, mobile number, email, among others.
- Personal Situation Data: date of birth, marital status, among others.
- Economic and Transactional Data: bank details and payment-related information.
- Customer History: responses to satisfaction surveys, booking history and complaints, among others.
- Usage Data: mileage, maintenance and intervention records, among others.
Purpose and Legal Basis for Processing
We use your personal data for the following purposes, indicating in each case the relevant legal basis under the General Data Protection Regulation (GDPR):
- Contract Performance: to enter into and manage the rental contract, including presenting offers, managing bookings and extending contracts. Legal basis: performance of a contract (Art. 6(1)(b)).
- Communication and Relationship Management: for administrative and operational communication related to our services. Legal basis: performance of a contract and legitimate interest (Art. 6(1)(b) and (f)).
- Personalisation and Service Improvement: to improve your experience, including conducting satisfaction surveys. Legal basis: legitimate interest in improving our services (Art. 6(1)(f)).
- Marketing: sending information about offers, campaigns, new services and vehicles, only with your prior consent. You can withdraw consent and unsubscribe at any time by emailing [email protected]. Legal basis: consent (Art. 6(1)(a)).
- Compliance with Legal Obligations: to respond to judicial authorities and meet tax and administrative obligations. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
- Litigation Management: to manage judicial and extrajudicial debt collection and dispute resolution. Legal basis: legitimate interest (Art. 6(1)(f)).
- Accounting and Tax Management: to manage invoicing and comply with tax obligations. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
Data Security and Retention
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, destruction or disclosure. We keep your data for as long as necessary to fulfil the purposes described:
- Identification and Contact Data: kept for the duration of the contract and up to 5 years after its end, to comply with legal obligations and manage liabilities.
- Economic and Transactional Data: kept for 10 years to comply with tax obligations.
- Customer History and Usage Data: kept for the duration of the contractual relationship and up to 5 years after its end.
- Marketing Data: kept until you withdraw your consent.
Sharing of Personal Data
Your personal data is treated confidentially and shared with third parties only to comply with legal obligations or to provide our services. These may include:
- Technical and operational service providers: companies that provide technical support, booking platforms and maintenance services.
- Accounting and financial service providers: for financial and accounting management.
- Judicial and regulatory authorities: in compliance with legal obligations.
Vanoia does not sell, transfer or lend your personal data to third parties for marketing purposes.
Subprocessors and International Transfers
To provide our services, we use providers that process personal data on our behalf (subprocessors), such as web hosting, website form processing, email communication and productivity tools. Some of these providers may be located outside the European Economic Area (EEA), namely in the United States of America. In such cases, we ensure that the transfer is carried out under appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission or adequacy decisions.
Specifically, our website's booking form is processed through the Web3Forms service, and we use Google Analytics (Google) for statistical analysis of website traffic.
Cookies and Browsing Data
When you submit the booking form, the data you provide is used solely to manage your request. Fonts are hosted on our own server, so no data is shared with external font services. The pages embed an OpenStreetMap map to show our location, which may involve that service recording your IP address.
We use Google Analytics (provided by Google) to understand how visitors use our website and to improve their experience. This service uses cookies and may collect data such as your IP address, device and browser type, pages visited and interactions with the site, processed in an aggregated, statistical form. The legal basis for this processing is your consent, which you may withdraw at any time. You can object to this collection by disabling cookies in your browser or by installing the Google Analytics opt-out add-on, available at tools.google.com/dlpage/gaoptout. Data may be transferred to the United States under appropriate safeguards (Standard Contractual Clauses).
Automated Decision-Making and Profiling
We do not make decisions based solely on automated processing of your personal data, including profiling, that produce legal effects concerning you or similarly significantly affect you.
Data of Minors
Our services are intended for adults and we do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor without appropriate consent, we will delete it as soon as possible.
Rights of Data Subjects
You have the right, at any time and free of charge, to request from Vanoia:
- Access to your personal data;
- Rectification of incorrect or incomplete data;
- Erasure of your data, except where it must be kept for legal reasons;
- Restriction of the processing of your data;
- Objection to the processing of your personal data;
- Portability of your data to another entity, where applicable;
- Withdrawal of consent, where processing is based on that ground.
To exercise any of these rights, email [email protected]. We will respond to your request within a maximum of one month, extendable by two months in cases of particular complexity. If you are not satisfied with our response, you may lodge a complaint with the Portuguese Data Protection Authority (CNPD), through the website www.cnpd.pt, or at the address: Av. D. Carlos I, 134 - 1.º, 1200-651 Lisbon.
Updates to the Privacy Policy
This privacy policy may be amended from time to time to reflect changes in legislation or in our privacy practices. Updates will be published on our website and, if necessary, we will notify customers by email.