Privacy policy

Varela & Ca, Lda., with headquarters situated at Rua de Lisboa, Ed. Varela s/n, 9500-216 Ponta Delgada (Portugal), with tax and legal person number 512004854 (henceforth "WAYZOR"), responsible for wayzor.pt website and all its subdomains (henceforth the “website”), as data controller and in reference to the rights of users registered on the website (henceforth “Users”), approved this privacy policy in accordance with the law No. 58/2019, of August 8, EU Regulation No. 2016/679 and data protection laws that are currently in force (“Data Protection Legislation”).

WAYZOR fully respects the privacy rights and protection of personal data of website users. Users may contact WAYZOR to obtain any information related to this privacy policy, using the contact details provided in this policy for this purpose.

1. Processing of Personal Data

As a provider of mobility solutions, we collect and process various categories of Personal Data regarding this website and our application products, to provide you with our services.

“Personal Data” includes information relating to an identified or identifiable singular person (“Data Holder(s)”), it is considered an identifiable singular person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, electronic identifiers or one or more elements specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that singular person.

The categories of Personal Data that we collect in the context of our services, the use of our website, and our applications include the following:

  1. Your identification data: first name, surname, email address, telephone number, address, date of birth, account identifier;
  2. If applicable, identification of additional driver(s): surname, first name, email address, telephone number and address;
  3. Your driving license and that of any additional driver or drivers;
  4. Payment data: account numbers, card numbers, etc.;
  5. Financial data: your invoices;
  6. If applicable, data relating to traffic violations;
  7. Information about your flight, if your vehicle pick-up location is an airport;
  8. Data relating to your browsing on our website;
  9. Voice, audiovisual and electronic data: communication records via email, chat or telephone with our customer support department;
  10. Data related to cookies and other similar technologies. For information on the use of cookies, please consult our cookies policy.

We collect most of your personal data from you, but we may receive data from third parties, including the competent authorities responsible for managing fines for traffic violations.

2. Legal Basis and the Purposes of Data Processing

We collect and process your Personal Data for various purposes and in accordance with the following legal basis:

Processing Purpose Legal Basis
Creating and managing your customer account This processing activity is based on acceptance of the terms and conditions of use of our website or mobile applications.

The management of your reservation and rental contract, specifically for:

  • Confirm, modify or cancel your reservation;
  • To communicate with you regarding your reservation and rental (for example, to provide you with information about your reservation and rental, to send you reminder notifications before returning your vehicle, and to respond to your questions or suggestions);
  • Manage your rental;
  • Manage your payment and invoices;
  • Manage the collection of outstanding amounts (including subsequent costs specified in the service rental contract, such as tolls, fines for traffic violations, or compensation for damage to the vehicle);
  • Manage complaints;
  • Purchase and manage insurance for your vehicle.

These processing activities are necessary for the execution of the rental service contract you conclude with us.

You can choose to register your credit card to make subsequent payments.

Verification of your driving license.

This validation is carried out manually by our customer support department.

 This processing is necessary for the execution of the rental service contract you enter into with us.
Combating credit card fraud. This processing is based on our legitimate interest in protecting ourselves against credit card fraud.
Carrying out satisfaction surveys to improve your experience with our products/services. This processing is based on our legitimate interest in better understanding customer needs and improving services and customer support.

Carrying out business development and marketing activities, including:

  1. Send emails and SMS notifications about special offers and deals;
  2. Record your rental history to suggest our products and services when looking for new reservations, or to send you special offers and benefits;
  3. Organize competitions and prize draws;
  4. Send emails about a reservation that we have not completed, or about the status of your reservation requests;
  5. Manage and update the customer database.

Our commercial and marketing activities, i.e. sending commercial messages to promote our products and services, are subject to your consent.

If you are already our customer, you may receive commercial messages for products and services similar to those we have already provided to you.

The sending of these messages will be based on our legitimate interest in communicating about our products and services.    

The processing activities included in category (5) are based on our legitimate interest in managing our customer database.

Management of fines for traffic violations, in particular for:

Transfer of the identity of the main driver mentioned in the rental contract to agencies or authorities responsible for the infractions.

 This processing activity is based on legal obligations, in particular that set out in no. 1, article 171 of the Highway Code, i.e., Decree-Law no. 44/2005, 23 February.

Management and maintenance of personal data from a list of customers who represent certain risks to our business and/or personnel, with regard to:

  • Payment incidents that result in legal proceedings;
  • Traffic accidents or repeated damages;
  • Inappropriate or abusive conduct towards our employees or our customers;
  • Use of our vehicles in violation of the general rental conditions.

This processing activity is based on our legitimate interest, in particular our interest in asserting our rights, in preventing risks and fraud related to the execution of your contract, and in preventing and managing abusive behavior towards our employees.

In this regard, we seek to maintain a fair balance between the need to process your Personal Data and respect for your rights and freedoms, in particular the protection of privacy. If you are on this list of high-risk customers, your reservation request will be analyzed.
Video surveillance at our facilities. This processing activity is based on our legitimate interest in ensuring the safety of property and people at our stations, has a deterrent nature, or allows us to identify those responsible for damage, theft or aggression.
Analysis of navigation data on our website and mobile applications. This processing is based on our legitimate interest in improving our products and services.

Consent for the processing of data for such purposes is free and optional. If consent has been given, the User may revoke it at any time by communicating to WAYZOR. The User may also exercise the right to object to the sending of commercial communications (via email) by clicking on the specific link to revoke consent, which is included in all marketing emails. If consent has been revoked, WAYZOR may send an email to the User to confirm the effective withdrawal of consent.

WAYZOR hereby informs that, following the exercise of the right to object to the sending of commercial communications, the User may continue to receive marketing messages for technical reasons (for example, marketing messages prepared shortly before exercising the right to object). If the User continues to receive marketing communications 72 hours after exercising the right to object, WAYZOR requests that the situation be reported immediately, using the contact details specified in this policy.

3. Processing methods

The processing of personal data will be carried out automatically and manually using IT tools, applying logic strictly related to the purposes and, in any case, guaranteeing the security and confidentiality of personal data.

4. Disclosure and Transmission of Personal Data

WAYZOR employees appointed to manage personal data may access Users’ personal data. The aforementioned employees, appointed by WAYZOR as “persons responsible for the processing”, will process the Users’ personal data exclusively for the purposes specified in the terms of this policy and in strict compliance with the Personal Data Protection Law.

Third parties who may process personal data on behalf of WAYZOR may also access Users' personal data as subcontractors, including, without limitation, IT service providers necessary for the operation of the website, outsourcing service providers or cloud computing services, professionals and consultants, or platforms responsible for sending marketing emails on behalf of WAYZOR.

Users have the right to obtain a complete and updated list of subcontractors (if any) appointed by WAYZOR, and for this purpose they must send a specific request to WAYZOR in accordance with this policy.

5. Conservation Periods

Processing Purpose Data Conservation Periods
Creating and managing your customer account.

Up to 1 year after the end of the contract or, if it has not been concluded, up to 6 months after the start of the process, without completion.

Billing – 10 years

The processing of your rental and reservation contract, in particular for:

  • Confirm, modify or cancel your reservation;
  • Communicate with you regarding your reservation and rental (for example, to provide you with information about your reservation and rental, to send you reminder notifications before returning your vehicle, or to respond to your questions or suggestions);
  • Manage your rental;
  • Manage your payment and invoices;
  • Manage the collection of outstanding amounts (including subsequent costs, such as fines for traffic violations, or compensation for damage to the vehicle);
  • Manage complaints;
  • Contract and manage your vehicle insurance.

Up to 1 year after the end of the contract or, if it has not been concluded, up to 6 months after the start of the process, without completion.

Billing – 10 years
Credit card fraud prevention.

Up to 7 years after fraud identification

For the legal period or, if non-existent, up to 7 years after identification of the fraud
Improving our products and services according to your preferences, by carrying out satisfaction surveys. Up to 1 year after collection.
Management of our website. Up to 6 months from the last visit to the website or application

Carrying out business development and marketing activities, including:

Send emails and SMS notifications about special offers and deals;

Record your rental history to suggest products/services when looking for new reservations, or to send you special offers and benefits;

Send emails related to a reservation that we have not completed, or communication of the status of your reservation requests;

Organize competitions and prize draws;

Manage and update the customer database.

If you are a customer, until the contract ends 

If you are not a customer, 3 years after the collection of your Personal Data OR from the last time you requested information from us.

Fines management, in particular for:

Transfer to the Agência Nacional de Segurança Rodoviária (ANSR) of the identity of the main driver, mentioned in the rental contract;

For the period defined by law

The management and maintenance of Personal Data from a list of customers who represent certain risks to our business and/or personnel, with regard to:

  • Payment incidents that result in legal proceedings;
  • Traffic accidents or repeated damages;
  • Inappropriate or abusive conduct towards our employees or our customers;
  • Use of our vehicles in violation of the general rental conditions.
 10 years to comply with tax obligations.

Video surveillance at our facilities.

30 days.
Analysis of navigation data on our website and mobile applications. Cookies Policy

6.  International Transfers

WAYZOR may transfer the Data Subject's Personal Data outside the European Economic Area (“EEA”), to locations that may not guarantee the same level of protection.

However, if applicable, WAYZOR will only transfer Personal Data outside the EEA, in accordance with the following measures:

  • When the transfer is carried out to a location or through a method or in circumstances that the European Commission considers to guarantee adequate protection of Personal Data;

  • When have implemented standard data protection contractual clauses approved by the European Commission or a competent supervisory authority; or,

  • When none of the previous options apply, but the law still authorizes this transfer, for example, if it is necessary for the declaration, exercise or defense of a right in legal proceedings.

You can request detailed information about the security measures that WAYZOR has implemented regarding transfers of Personal Data outside the EEA and, when applicable, a copy of the standard data protection contractual clauses in force at WAYZOR through the contact details provided.

7. Data Subject’s Rights

Under the terms of Data Protection Legislation, WAYZOR informs that data subjects have the right to obtain information about (i) the identity of the person responsible for the processing and, if applicable, their representative; (ii) the contact details of the data protection officer; (iii) the purposes of the processing and the legal basis; (iv) the recipients or categories of recipients of the data, (v) the optional or mandatory nature of the response, as well as the possible consequences of not responding, and (vi) the rights of data subjects.

Rights What does it consist of?
Right to Provision of Information

You have the right to obtain clear, transparent and easily understandable information about how WAYZOR uses your Personal Data and what your rights are. Therefore, WAYZOR makes all this information available to you through this Privacy Policy.

Right of Access

 You have the right to obtain information about what Personal Data WAYZOR processes (if it is processing them) and certain information (similar to that provided in this Privacy Policy) about the way in which such Data is processed. This right allows you to know and confirm that we use your Data in accordance with Data Protection laws.
Right to rectification

If your Data is incorrect or incomplete (for example, if your name or address is incorrect), you can ask WAYZOR to take corrective action.
Right to Data Erasure This right is also known as the "right to be forgotten” and, in simple terms, allows you to request the erasure or deletion of your data, as long as there are no valid grounds for WAYZOR to continue using it or your use is unlawful. This is not a generic right to erasure, as exceptions are permitted (for example, whenever this Data is necessary to defend a right in legal proceedings).
Right to Limitation of Treatment

You have the right to "block" or prevent the future use of Personal Data, while WAYZOR evaluates a request for rectification, or to erase them. Whenever Processing is limited, WAYZOR continues to be able to store your Data, but will not be able to use them later. WAYZOR maintains a list of holders who have requested the "blocking" of future use of your Personal Data to ensure that this limitation is respected.

Right to Data Portability

 You have the right to obtain and reuse certain Personal Data for your own purposes across various organizations. This right only applies to your own Data that you have provided to WAYZOR and that WAYZOR processes with your consent and those that are processed by automated means.

Right to Object

You have the right to object to certain types of Processing, for reasons related to your particular situation, at any time that Processing takes place, for the purposes of the legitimate interests of WAYZOR or Third Parties. WAYZOR may continue to process this Data if it can prove "predominant legitimate reasons for the Processing that override your interests, rights and freedoms” or if this Data is necessary for the establishment, exercise or defense of a right in a judicial process.

Right to File a Complaint

  You have the right to lodge a complaint with the competent supervisory authority, the National Data Protection Commission – CNPD, if you consider that the Processing carried out on Personal Data violates your rights and/or applicable Data Protection laws.

You may at any time, in writing, exercise the rights enshrined in Data Protection Legislation via the email address [email protected] or [email protected].

8. Security and Confidentiality

To guarantee the security and confidentiality of personal data collected online by WAYZOR, it will use protected databases, among others, appropriate firewalls and passwords, in accordance with the provisions of the Data Protection Law and other legal terms. Access to personal data is only authorized to employees who have an effective need to use the data and who have been prepared to handle this data appropriately, in accordance with the principles of security and confidentiality. Violations of the Privacy Policy by WAYZOR employees may give rise to disciplinary action. Compliance with standards and procedures by the WAYZOR team is monitored and verified periodically. Although WAYZOR cannot completely exclude the possibility of loss, fraudulent use or alteration of data, these measures intend to avoid such adverse effects.

8. How to Contact WAYZOR on Privacy and Data Protection Matters

Users may exercise their rights by contacting WAYZOR through the following methods: i) sending a registered letter with acknowledgment of receipt to WAYZOR's indicated address, ii) sending an email to the email address dpo@bensaude .pt or [email protected].