Privacy Policy

1. Who we are

OportoBus is a licensed travel and transport operator based at Rua das Moutas N.º200, 4475-205 Gondim-Maia, Portugal, registered with Turismo de Portugal under RNAVT no. 7073 and transport licence (Alvará) no. 200793. We are the data controller for the personal data described in this policy.

2. What data we collect

We only collect the data we need to answer your enquiries and provide our services:

• Booking data: name, email address, phone number, pickup details, number of passengers and any notes you add to your booking.
• Contact data: name, email address and the content of messages sent through our contact form, by email or by WhatsApp.
• Payment data: payments are processed by Stripe. We never see or store your full card number. We keep only the payment status and a Stripe reference.
• Technical data: if you accept optional cookies, we collect anonymised usage statistics through Google Analytics (pages visited, device type, approximate location) and measure advertising conversions through Google Ads.
• Location data: when you use the pickup-location suggestions on the booking form, the text you type and - only if you allow your browser's location prompt - your device location (otherwise your approximate location derived from your IP address) are sent to Google Maps to suggest nearby addresses. We do not store this location data; only the address you choose is saved with your booking.
• Notification data: if you opt in to browser notifications, we store a push subscription token for your browser.

3. Why we use your data

We process your data to manage and confirm bookings (performance of a contract), to reply to enquiries (legitimate interest), to meet legal obligations such as invoicing and tax rules, and, with your consent, to measure how our website is used so we can improve it.

4. Who we share it with

We do not sell your data. We share it only with service providers who help us operate:

• Stripe Payments Europe (payment processing).
• Google Ireland (analytics and advertising measurement, only if you consent to optional cookies; Google Maps address suggestions, only when you use the pickup-location field).
• Our email hosting provider, for sending booking confirmations and replies.

5. How long we keep it

Booking and invoicing records are kept for the periods required by Portuguese tax law (generally 10 years). Contact messages are kept for up to 2 years. Analytics data is retained according to Google Analytics settings (14 months).

6. Your rights

Under the GDPR you can ask us to access, correct, delete or export your personal data, restrict or object to its processing, and withdraw consent at any time. To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with the Portuguese supervisory authority, CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt).

7. Security

Our website is served over HTTPS and access to booking data is restricted to authorised staff. Payments are handled entirely by Stripe, a PCI-DSS Level 1 certified provider.