Privacy Policy

This Privacy Policy explains how mtransfers (“we”, “us”, “our”) collects, uses, stores and shares personal data when you visit our website, use our booking tools, contact us, or book private transfer and chauffeur services in Portugal and Spain. It is provided pursuant to Regulation (EU) 2016/679 (the “GDPR”) and other applicable privacy and data protection laws.

This policy should be read together with our Terms & Conditions and our Cookie Policy (and the cookie consent banner on our website). By using our website or booking services, you acknowledge the practices described here.

1. Who we are (Data Controller)

The controller of your personal data is mtransfers. You may contact us at info@mtransfers.pt.

Where a booking is fulfilled by an independent chauffeur or partner operator, that provider may process certain booking data as an independent controller or as our processor, solely as needed to perform the transport service you booked.

2. Scope

This Privacy Policy applies to the processing of personal data carried out by mtransfers in connection with:

• Visitors and users of our website and booking tools;
• Clients and passengers who request or book transfers;
• People who contact us (email, phone, WhatsApp, contact forms);
• Travel agents, hotels, concierge partners and other B2B contacts;
• Candidates who apply to work with us;
• Newsletter or marketing recipients, where applicable.

3. Personal data we collect

Data subjects are the natural persons to whom the data relates (for example the person making the booking, passengers named on a booking, or a website visitor).

Depending on how you interact with us, we may process the following categories of personal data:

• Identification and contact data — name, email address, phone number, nationality or language preference where provided.
• Booking and trip data — service type, pickup and drop-off addresses or places, date and time, return trip details, passenger counts (adults/children), luggage, flight number, child seat requests, special requests, vehicle category, quote and price breakdown, reservation reference and booking status.
• Location and routing data — place identifiers, coordinates and route information needed to calculate distance, duration and pricing (processed via Google Maps Platform services as described below).
• Billing and payment data — payment method selected (for example cash or bank transfer), invoicing details (name, address, tax number / NIF where required), and related accounting records. We do not store full payment card numbers on our systems when card payments are processed by a payment provider.
• Communications data — messages you send via contact forms, email, phone or messaging apps (including WhatsApp where used), and records of customer support interactions.
• Technical and usage data — IP address, browser and device information, pages visited, referral source, approximate location derived from IP, and logs related to security and performance.
• Cookie and consent data — preferences recorded by our cookie consent tool (CookieYes), and identifiers used for analytics or advertising where you have consented.
• Marketing data — newsletter subscription status, campaign interactions (opens/clicks) where applicable, and opt-out preferences.
• Recruitment data — CV, qualifications, professional experience and other information you submit when applying to join us.

We do not intentionally collect special categories of personal data (such as health data). If you voluntarily include sensitive information in special requests (for example mobility needs), we will process it only as necessary to provide the service and with appropriate care.

4. How we collect data

We may collect personal data:

• Directly from you when you use the booking widget, complete a reservation, fill in a contact form, email or call us, or subscribe to updates;
• From a person booking on behalf of passengers (travel agent, hotel, companion), in which case that person is responsible for ensuring passengers are informed;
• Automatically through cookies, pixels and similar technologies when you browse our website (see Cookie Policy);
• From service providers that support booking, maps, communications, analytics or payments;
• Occasionally from public sources, where relevant and lawful; we will inform the data subject at the earliest appropriate opportunity when data was collected indirectly.

5. Purposes and legal bases

We process personal data only where we have a lawful basis under the GDPR. The main purposes and bases are set out below. We keep data only for as long as needed for those purposes, or for longer where required by law.

1. Providing booking and transfer services (performance of a contract / pre-contractual steps — Art. 6(1)(b) GDPR) — quoting routes, creating and managing reservations, assigning chauffeurs/partners, sending booking confirmations, updates, reminders and service messages, and fulfilling the transport. Without the data needed for a booking, we cannot complete the reservation.
2. Customer support and communications (contract and/or legitimate interests — Art. 6(1)(b)/(f)) — responding to enquiries, complaints and operational messages via email, phone, website forms or messaging channels.
3. Invoicing, accounting and legal obligations (legal obligation and contract — Art. 6(1)(c)/(b)) — issuing invoices or receipts, keeping accounting records, tax compliance and responding to lawful requests from authorities. Accounting records are typically retained for the periods required under Portuguese law (commonly up to 10 years where applicable).
4. Website operation, security and fraud prevention (legitimate interests — Art. 6(1)(f)) — keeping the site secure, preventing abuse of our APIs and booking endpoints, debugging and improving reliability.
5. Analytics and service improvement (consent and/or legitimate interests — Art. 6(1)(a)/(f)) — understanding how visitors use the website and booking funnel (for example via Google Analytics 4 and related tools), subject to your cookie choices where consent is required.
6. Marketing and advertising (consent — Art. 6(1)(a), and where permitted soft opt-out for similar services) — newsletters, offers and advertising/remarketing (including Meta Pixel / Conversions API where enabled), only in line with your consent preferences. You may withdraw consent or unsubscribe at any time without affecting your ability to book.
7. Maps, geocoding and routing (contract / legitimate interests, and cookie consent where applicable) — using Google Maps Platform to search addresses, geocode places, calculate routes and display a map preview so we can price and deliver transfers accurately.
8. Claims, disputes and protection of rights (legitimate interests and/or legal obligation — Art. 6(1)(f)/(c)) — establishing, exercising or defending legal claims.
9. Recruitment (pre-contractual steps / legitimate interests — Art. 6(1)(b)/(f)) — reviewing applications and CVs. Unsuccessful applications are typically retained for up to 2 years from submission unless you ask us to delete them sooner where legally possible.
10. B2B partner relationships (contract / legitimate interests) — managing enquiries and bookings from travel agents, hotels and corporate partners.

6. Retention

As a guide:

• Active bookings and trip records — for the duration of the booking and afterwards as needed for customer service, complaints and accounting (typically aligned with legal retention for commercial/accounting documents).
• Incomplete booking drafts stored in your browser (for example session storage) — until you complete, clear or abandon the booking; server-side rate-limit and security logs are kept only for short operational periods.
• Marketing contacts — until you unsubscribe or withdraw consent, and for a short period afterwards to honour opt-outs.
• Support correspondence — for as long as needed to resolve the matter and for a reasonable period thereafter.
• Cookie / analytics identifiers — according to the periods stated in the Cookie Policy and tool settings.

When retention ends, we delete or anonymise personal data, unless a longer period is required by law or needed for pending disputes.

7. Cookies and similar technologies

Our website uses cookies and similar technologies to operate the site, remember preferences, measure traffic and — where you consent — support analytics and advertising. We use a consent management platform (CookieYes) so you can accept or reject non-essential cookies.

For details on cookie types, purposes and how to change your choices, please see our Cookie Policy and the cookie banner on the website.

8. Google Maps Platform

To power location search, geocoding, route calculation and map previews in our booking flow, we use Google Maps Platform services (including Places, Geocoding, Routes and Maps JavaScript APIs). When you search for or select a pickup or drop-off place, relevant query and place data are processed so we can return suggestions, coordinates, distance/duration and a route display.

Google may process data as an independent controller or processor according to Google’s terms. Further information is available in the Google Privacy Policy and Google Maps Platform terms. Map and Places features on booking pages may also display Google’s required attributions.

9. Analytics and advertising tools

Subject to your consent preferences, we may use tools such as:

• Google Analytics 4 / Google Tag Manager — to measure website and booking-funnel usage;
• Meta Pixel and Meta Conversions API — to measure marketing effectiveness and, where enabled, conversion events related to bookings or leads;
• optional tags loaded via GTM for additional marketing or product analytics, only as configured and consented.

These tools may set cookies or process identifiers (including IP address, device/browser data and event data). You can withdraw analytics or marketing consent at any time via the cookie banner. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

10. Security and sharing with third parties

We apply technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure — including HTTPS, access controls, server-side validation of booking quotes, and rate limiting on public booking endpoints. Equivalent protection is required of service providers that process personal data on our behalf.

We do not sell your personal data. We may share data only where necessary, including with:

• Chauffeurs and partner operators assigned to fulfil your transfer (typically name, phone, pickup/drop-off, time, passenger count, flight number and special requests);
• IT, hosting, email and communications providers that support our website, booking system and customer messages;
• Maps, analytics and advertising providers (for example Google, Meta), as described above;
• Payment and banking providers, where you choose a payment method that requires them;
• Professional advisers (for example accountants or lawyers) under confidentiality;
• Public authorities, courts or regulators when required by law;
• Parties involved in a corporate transaction (merger, acquisition or reorganisation), subject to appropriate safeguards.

Recipients may act as processors under our instructions or, in some cases, as independent controllers (for example Google or Meta under their own policies, or a partner chauffeur for delivering the ride).

11. International transfers

We primarily process data in the European Economic Area (EEA). Some providers (including Google and Meta) may process data in countries outside the EEA, such as the United States.

Where personal data is transferred outside the EEA, we rely on an adequacy decision where available, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with any supplementary measures required. You may request more information about these safeguards by contacting us.

12. Your rights

Under the GDPR, you may have the right to:

1. Access — obtain confirmation of whether we process your data and receive a copy and related information;
2. Rectification — request correction or completion of inaccurate or incomplete data;
3. Erasure — request deletion, subject to legal retention duties or other lawful grounds to keep data;
4. Restriction — request that we limit processing in the circumstances set out in the GDPR;
5. Portability — receive data you provided to us in a structured, commonly used, machine-readable format, where technically feasible and where processing is based on consent or contract;
6. Objection — object to processing based on legitimate interests, including direct marketing (we will stop marketing on request);
7. Withdraw consent — where processing is based on consent, withdraw it at any time (without affecting prior lawful processing);
8. Not be subject to solely automated decisions producing legal or similarly significant effects — we do not make such decisions about you; pricing quotes are generated from route and booking parameters you provide, not from profiling that produces legal effects about you as an individual.

These rights may be limited where legal obligations, third-party rights or our overriding legitimate interests apply.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or with another EU supervisory authority of your habitual residence or place of work.

13. How to exercise your rights

To exercise your rights, ask questions about this Privacy Policy, or request information about processors and international transfers, contact us by email at info@mtransfers.pt.

We may need to verify your identity before fulfilling certain requests. We aim to respond within the time limits set by the GDPR.

14. Children

Our booking services are intended for adults. We may process children’s data (for example passenger age/count or child seat requirements) only when provided by a parent, guardian or booking adult in connection with a transfer. We do not knowingly market directly to children.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date below will change when we publish a revised version. For material changes, we may also provide additional notice on the website or by email where appropriate. Please review this page periodically. Continued use of the website after an update constitutes acknowledgement of the revised policy, to the extent permitted by law.

Last updated on: 17 August, 2026