PortuguêsVIRTUDE Group is committed to protecting your personal data and respecting your privacy. This Privacy and Cookie Policy explains how we collect, use, store, and protect your personal information when you visit our website, use our services, or use the Virtude Drive mobile application, in full compliance with Regulation (EU) 2016/679 (GDPR) and Portuguese Law No. 58/2019 of 8 August.
Index
1. Data Controller
The entity responsible for the processing of personal data is VIRTUDE Group (hereinafter referred to as “VIRTUDE”), with registered address Travessa da Queiró 79, 5000-063 Vila Real, NIF/NIPC 519138023. For any matter relating to data protection, you may contact our Data Protection Officer at clotilde@virtudegroup.com.
2. Personal Data Collected
In the context of the use of our services and website, VIRTUDE may collect the following categories of personal data: identification and contact data, such as name, email address, and telephone number; service and contract data, including information relating to proposals and agreements entered into; financial data necessary for the conclusion and performance of contracts; content of messages and enquiries submitted via contact form or email; and navigation and technical data, such as IP address, browser type, and session information, collected automatically through cookies and analytics tools.
The provision of certain data may be required for the conclusion or performance of a service agreement. Failure to provide it may prevent the delivery of the requested services. VIRTUDE does not collect special categories of sensitive data as defined under Article 9 GDPR, nor personal data from persons under 16 years of age.
3. Purposes and Legal Basis for Processing
Personal data is processed for the following purposes: management of service enquiries and contact requests; preparation and performance of service proposals and contracts; compliance with applicable legal, fiscal, and accounting obligations; sending of commercial communications and marketing activities, subject to prior and unambiguous consent; and continuous improvement of the quality and personalisation of the services offered.
Processing is carried out on the following legal bases under Article 6 of the GDPR: performance of a contract or pre-contractual steps at the request of the data subject (Art. 6(1)(b)); compliance with a legal obligation (Art. 6(1)(c)); consent of the data subject, where applicable (Art. 6(1)(a)); and legitimate interests of VIRTUDE, where such interests are not overridden by the rights and freedoms of the data subject (Art. 6(1)(f)). VIRTUDE will not process personal data in a manner incompatible with the purposes for which it was originally collected.
4. Data Sharing and Transfers
VIRTUDE does not sell, rent, or trade personal data. Data may be disclosed to trusted service providers acting as data processors on our behalf – such as IT, hosting, accounting, or marketing services – bound by data processing agreements that ensure confidentiality and security; to partner entities where necessary for the performance of contracted services; and to public authorities, including the CNPD, where required by applicable law or court order.
In the event of any transfer of personal data to third countries outside the European Economic Area, adequate legal safeguards will be ensured in accordance with the GDPR, including Standard Contractual Clauses approved by the European Commission where required.
5. Data Retention
Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected, or for the periods required by applicable law. Contact and enquiry data is generally retained for a period of three years. Data relating to service contracts, fiscal records, and accounting documentation is retained for ten years in accordance with Portuguese commercial and tax law. Analytics and navigation data collected via cookies is retained for a maximum of twenty-six months. Data processed on the basis of consent is retained until that consent is withdrawn. Upon expiry of the applicable period, data will be securely deleted or anonymised.
6. Rights of the Data Subject
Under the GDPR and Law No. 58/2019, you have the right to access your personal data; to request its rectification where inaccurate or incomplete; to request its erasure where there is no legitimate ground to continue processing; to request restriction of processing in certain circumstances; to receive your data in a portable format; to object to processing based on legitimate interests or for direct marketing purposes; and to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.
To exercise any of these rights, please send a written request to clotilde@virtudegroup.com. We will respond within thirty calendar days of receipt of your request, in accordance with Article 12 of the GDPR.
7. Data Security
VIRTUDE implements appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction, taking into account the nature of the data and the risks associated with its processing. All staff and partners with access to personal data are subject to confidentiality obligations and receive appropriate guidance on data protection requirements.
9. Contact and Complaints
For any questions relating to this Policy or the exercise of your rights, please contact VIRTUDE Group at clotilde@virtudegroup.com or at our registered address in Portugal. You also have the right to lodge a complaint with the competent supervisory authority – the CNPD – Comissão Nacional de Proteção de Dados, Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa, www.cnpd.pt – if you consider that the processing of your data infringes applicable legislation.
This Policy may be updated periodically to reflect changes in our practices or in applicable law. The date of the most recent revision is indicated at the top of this page. Significant changes will be communicated by a prominent notice on our website prior to taking effect.
10. Virtude Drive – Transportation Application
This section supplements the present Policy and applies specifically to the Virtude Drive mobile application, made available by VIRTUDE Group for the provision of passenger transportation services, and describes in detail the data collected, the purposes of processing, and the rights of users, whether passengers or partner drivers.
10.1. Location Data (GPS)
Virtude Drive collects precise geographic location data to enable the functioning of the transportation service. For passengers, location is collected in the foreground (while the application is in use), in order to identify the pick-up point, calculate routes and fares, and track the trip in progress. For partner drivers, location is collected both in the foreground and in the background while they are on duty and available to accept trips, in order to enable the assignment of requests to the nearest driver, real-time trip tracking, and the overall safety of the service.
Background location collection by drivers is clearly disclosed at the time of installation and activation of the application, and is granted through the native permissions of the operating system (iOS/Android), which the driver may manage or revoke at any time in the device settings, although doing so may prevent the normal functioning of the service while acting as an active driver.
10.2. Categories of Data Collected
In the context of using Virtude Drive, the following categories of personal data are collected:
Identification and contact data – full name, telephone number, email address;
Profile photograph – image associated with the user’s profile, used for mutual identification between passenger and driver;
Vehicle data (drivers) – make, model, licence plate, and legal documentation of the vehicle and driver (driving licence, insurance, TVDE driver certificate, where applicable);
Location data – as described in section 10.1;
Trip history – dates, times, origin and destination, route taken, duration, distance, and fare for each trip;
Payment data – information relating to payments made through the application (credit/debit card, MB WAY) or in cash directly to the driver; card data is processed by certified payment service providers and is not stored by VIRTUDE;
Technical and device data – IP address, unique device identifiers, device model, operating system, and application version;
Communications and ratings – messages exchanged between passenger and driver through the application, ratings, and feedback on the trip.
10.3. Specific Purposes of Processing
The data described above is processed for the following purposes: enabling the booking, assignment, and completion of trips; calculating routes, estimated arrival times, and fares; processing payments and issuing invoices; facilitating communication between passenger and driver; ensuring the safety of both parties during the trip (including real-time location sharing and emergency features, where available); preventing fraud and misuse of the platform; complying with legal obligations applicable to the paid transportation of passengers; and improving the performance and reliability of the service.
10.4. Data Shared Between Passenger and Driver
In order to complete each trip, a minimum set of data is shared between passenger and driver: the driver has access to the passenger’s name, pick-up location, and destination, as well as their average rating; the passenger has access to the driver’s name, photograph, vehicle data (make, model, licence plate), and average rating. This sharing is limited to what is strictly necessary for mutual identification and the safe performance of the service, and is automatically deactivated upon completion of the trip.
10.5. Third-Party Subprocessors
With the exception of the services identified in this section, all data collected through Virtude Drive is processed internally by VIRTUDE and is not shared, sold, or disclosed to any other third party. The application relies solely on the following subprocessors, strictly necessary for its technical operation:
Google Analytics (Google Ireland Limited) – used for anonymous statistical analysis of application usage, for the purpose of improving the performance and experience of the service;
Mapbox (Mapbox, Inc.) – used to display maps, calculate routes, and perform address geocoding, based on the location data provided by the user while using the application.
These providers act as independent subprocessors, subject to their own terms and privacy policies, and may involve the transfer of data outside the European Economic Area; any such transfer is carried out under the appropriate safeguards required by the GDPR.
10.6. Data Retention within the Application
Account and profile data is retained for as long as the account remains active. Trip history and associated billing data is retained for ten years, in compliance with Portuguese fiscal and accounting obligations. Detailed location data for each trip is retained for as long as necessary to resolve any complaints, disputes, or safety incidents, and is then deleted or anonymised. Partner drivers’ data relating to legal documentation and certification is retained for the duration of the partnership and for the period legally required thereafter.
10.7. Account and Data Deletion
Any user, whether passenger or driver, may request the deletion of their account and associated personal data by sending a request to clotilde@virtudegroup.com.
Following confirmation of the request, personal data is deleted within thirty days, with the exception of data that VIRTUDE is legally required to retain for longer periods (namely fiscal and accounting records, and data relating to ongoing disputes), which is retained solely for that specific purpose and deleted upon expiry of the applicable legal period.
10.8. Device Permissions
Virtude Drive requests the following device permissions, strictly necessary for the operation of the service: Location (precise, in the foreground and, for drivers, also in the background), Camera (capturing a profile photograph and documents, where applicable), Push notifications (trip status updates), and Storage (uploading a photograph or documents). All permissions may be revoked at any time in the operating system settings, which may affect the availability of certain features.
10.9. Contact for the Application
The entity responsible for data processing within Virtude Drive is VIRTUDE Group, as identified in section 1 of this Policy. For any questions relating specifically to the Virtude Drive application, including requests for access, rectification, or deletion of data, please contact clotilde@virtudegroup.com.
VIRTUDE Group