Privacy Policy

1. Who is the data controller

Voala Tour, based in Portugal, is the controller responsible for the processing of the personal data described in this policy, meaning it decides why and how such data is processed. This policy applies to Customers, Companies, Partners, Drivers and anyone who uses voalatour.com or receives our communications. For any privacy-related question or request, please contact geral@voalatour.com.

2. What data we process

• Account: name, e-mail, password (stored encrypted, never in plain text) or, if you sign in with Google, the name and e-mail of your Google account; account type, optional profile photo, notification preferences and your choice regarding the newsletter (with the date).
• Bookings: traveller's name, e-mail and telephone number, WhatsApp, pick-up and destination locations, date and time, number of people, vehicles and extras chosen, luggage, flight details (number, airline and time), remarks, and the status of the booking and of the payments. We also keep bookings that were started but not paid, so that the Company can send the traveller a link to complete them.
• Messages and reviews: the messages exchanged within each booking and the reviews you publish.
• Companies: trading name, legal name and registered address (obtained from the tax number via the VIES system), tax/VAT number, contact details and WhatsApp, address, description, logo and photographs, documents for approval (permanent certificate code, licence number, insurance policy), IBAN and account holder for payments made through the platform, description of the billing method (for example, "Visa •••• 4242") and the date the terms were accepted.
• Drivers: name, telephone number, vehicle, optional photograph, days off, assigned services and the record of when each service is started, completed or reported as having a problem.
• Partners: business name, type, contact details, agreed commission and sales.
• Payments: processed by Stripe. We only receive the outcome, the amount and the payment references; we never receive the full card number.
• Newsletter: the e-mail address and name of professional contacts imported by Voala Tour, and the list of addresses that have unsubscribed.
• Technical data and statistics: to measure use of the site, we log anonymous events (viewing the homepage, searching, viewing a service, starting checkout, completing a booking) together with a random identifier that only exists for the duration of the browser session. The IP address is used solely to limit abuse. We also keep a log of relevant actions taken within accounts (for example, approvals and price changes), for security purposes.

3. What we use the data for and on what legal basis

• Creating and managing accounts, processing bookings, payments, refunds and transfers to Companies, and enabling messages and reviews: performance of a contract (GDPR, Art. 6(1)(b)).
• Verifying and approving Companies, preventing fraud and keeping the platform secure: legitimate interest (point (f)) and, where applicable, legal obligation.
• Complying with accounting, tax and other legal obligations: legal obligation (point (c)).
• Anonymous usage statistics: legitimate interest in improving the site.
• Newsletter for Customers: your consent (point (a)), which you may withdraw at any time.
• Platform-related communications for Companies and professional contacts: legitimate interest, with the possibility to object via each e-mail.

We do not make automated decisions with legal effects on you, nor do we build profiles for advertising purposes.

4. Who we share data with

The data relating to a booking is shared only with those who need it in order to carry it out: the Company, the assigned Driver, the Partner who made the booking and, for services sold by Voala Tour, the operator shown as "Operated by". We use the following processors, under data processing agreements compliant with the GDPR:

• Supabase: database, authentication and file storage.
• Stripe: payments, refunds, charges and transfers.
• Resend: sending of platform and newsletter e-mails.
• Anthropic: artificial intelligence used to suggest descriptions, translate listings and read price tables uploaded by Companies. It receives listing content, not Customer data.
• Google: only if you choose to sign in using your Google account.
• European Commission (VIES): validation of Companies' tax/VAT numbers.

We may also disclose data to the authorities where required by law. We do not sell personal data, nor do we pass it on to third parties for their own marketing purposes.

5. Transfers outside the European Economic Area

Some processors (such as Stripe, Resend, Anthropic and Google) may process data outside the European Economic Area, including in the United States. In such cases, these transfers rely on adequacy decisions (such as the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses, in accordance with Chapter V of the GDPR.

6. Cookies and browser storage

We use your browser's storage solely for functional purposes: keeping you signed in, remembering preferences and language, storing for 24 hours the promoted service you clicked on (so that the booking is correctly attributed) and the random identifier used for statistics, which disappears when you close the browser. We do not use advertising cookies or cross-site tracking cookies. At the payment stage, the Stripe form may use its own cookies to prevent fraud, and signing in with Google uses Google's own cookies.

7. How long we keep the data

• Account data: for as long as the account remains active.
• Bookings, payments and invoicing: for the period required by Portuguese tax and accounting law (as a rule, 10 years), even after the account has been deleted.
• Unpaid bookings: expire after 60 minutes; they remain on record, without payment, for the booking history and for the link used to complete the booking.
• Messages and reviews: for as long as the booking or service exists, or until deletion is requested where the law allows this.
• Company documents: for as long as the Company remains active and, thereafter, for the applicable legal period.
• Addresses that have unsubscribed from the newsletter: kept permanently, solely to ensure they do not receive further communications.
• Statistics: anonymous events, without any data capable of identifying you.

8. Security

Data is transmitted in encrypted form, and access is restricted through database-level permissions: for example, the data relating to a booking is only visible to the Customer, the Company, the Driver and the Partner involved, and to the Voala Tour team. Newsletter unsubscribe links are signed, so that no one can unsubscribe someone else. No system is entirely secure, but we apply appropriate technical and organisational measures.

9. Your rights

You may request access to, rectification, erasure or restriction of your data, request portability, and object to certain processing activities, in accordance with the GDPR. You may delete your account on the Account page and stop receiving the newsletter at any time, either by switching off this option in your account or by using the "Unsubscribe" link in any e-mail. To exercise your rights, please contact geral@voalatour.com; we will respond within the statutory time limit.

10. Complaints

If you believe your data has not been processed correctly, please contact us first. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) [National Data Protection Commission], at cnpd.pt, or with the supervisory authority of your country within the European Union.

11. Minors

Creating an account requires you to be at least 18 years old. We do not knowingly collect data from minors as account holders; data relating to minors travelling as part of a booking is provided by the adult making the booking. If we become aware that we have collected data from a minor without a legal basis, we will delete it.

12. Changes to this policy

We may update this policy whenever the platform or the law changes. The "last updated" date at the top indicates the version currently in force; if a change is significant, we will notify you in a clearly visible manner.

13. Contact

Questions and requests concerning your personal data: geral@voalatour.com.