Privacy Policy

This Privacy Policy explains what personal information may be collected through iberyc.com, how it may be used, the circumstances in which it may be shared, and the rights available to you.

1. Data Controller

The data controller responsible for personal information processed through this website is:

2. Personal Data We May Collect

When you request a quote, contact Iberyc or interact with the website, we may collect information including:

• Full name
• Email address
• Telephone or WhatsApp number
• Travel date
• Number of passengers
• Requested route, pickup and destination information
• Travel preferences
• Messages and special requests voluntarily provided by you

The website and its supporting technologies may also process technical information including:

• IP address
• Browser and device information
• Referring website or page
• Pages visited and interactions with the website
• Cookie and consent preferences
• Advertising attribution information
• UTM parameters
• Google Ads click identifiers
• Information reasonably required for website security, fraud prevention and diagnostics

3. Purposes of Processing

Personal information may be processed for purposes including:

• Responding to quote requests and enquiries
• Preparing personalised travel proposals
• Communicating about requested or booked services
• Organising and providing private transportation services
• Managing customer relationships
• Confirming availability, routes and travel arrangements
• Maintaining appropriate business and administrative records
• Securing the website and preventing misuse
• Diagnosing technical problems
• Understanding website usage and improving performance
• Measuring advertising and marketing effectiveness
• Complying with applicable legal, accounting, regulatory and administrative obligations

4. Legal Bases for Processing

Depending on the circumstances, Iberyc may process personal data on one or more of the following legal bases:

• Taking steps at your request before entering into a contract, including preparing a quotation
• Performance of a contract when you book a service
• Your consent, where consent is legally required
• Iberyc’s legitimate interests in operating, securing and improving its website and services
• Compliance with applicable legal obligations

Where processing is based on consent, you may withdraw that consent at any time without affecting processing lawfully carried out before withdrawal.

5. Quote Requests and Website Forms

Information submitted through website forms is used to assess your travel requirements and respond to your enquiry.

The website uses WordPress and Fluent Forms to manage form submissions.

Information submitted through a form may also be transmitted by email to authorised Iberyc personnel in order to review and respond to the request.

You are responsible for ensuring that information you provide is accurate and that you are authorised to provide any personal information relating to other passengers or third parties.

6. Analytics, Advertising and Attribution

Iberyc may use Google Analytics, Google Ads and related technologies to understand website usage, measure advertising performance and improve marketing effectiveness.

These services may process information including website interactions, device information, referral information, advertising identifiers and campaign attribution data.

Where required by law, analytics and advertising technologies are controlled according to the consent choices made through the website’s cookie consent system.

7. Cookies and Consent

The website uses cookies and similar technologies.

Essential cookies may be necessary for the website to operate properly.

Non-essential technologies, including analytics or advertising technologies, are used according to your consent preferences where legally required.

Visitors may accept, reject or manage non-essential cookies through the consent banner available on the website.

Detailed information about cookies and related technologies is available through Iberyc’s Cookie Policy.

8. Service Providers and External Systems

Iberyc relies on independent technology and service providers to operate the website and its business activities.

These may include providers of:

• Website hosting and infrastructure
• WordPress software and plugins
• Contact and quotation forms
• Email and business communications
• Analytics
• Advertising and conversion measurement
• Cookie and consent management
• Website security
• Performance and caching services

These providers may process personal information where reasonably necessary to provide their services.

Where a service provider processes personal information on behalf of Iberyc, Iberyc takes reasonable steps to select appropriate providers and to use contractual, organisational or technical safeguards where required by applicable law.

Some third-party services may operate as independent data controllers for certain processing activities. Their processing may therefore also be governed by their own privacy notices and legal obligations.

9. Security and Circumstances Outside Iberyc’s Control

Iberyc implements reasonable and appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or other misuse.

Such measures may include access controls, secure communications, authentication measures, software maintenance, website security measures and the use of reputable technology providers.

However, no website, hosting platform, telecommunications network, cloud service, email system, software product or internet transmission can be guaranteed to be completely secure, uninterrupted or immune from malicious activity.

Iberyc does not guarantee that cyberattacks, unauthorised intrusions, malicious acts, technical failures, service interruptions or security incidents can never occur.

Certain infrastructure, platforms, telecommunications networks and third-party systems used in connection with Iberyc’s services are outside Iberyc’s direct technical control.

To the fullest extent permitted by applicable law, Iberyc shall not be responsible for loss, unauthorised access, disclosure, alteration, destruction or other security incidents arising exclusively from:

• Cybercriminals, hackers or other malicious external actors
• Acts or omissions of independent third parties
• Failures or vulnerabilities in third-party platforms or infrastructure outside Iberyc’s reasonable control
• Failures of telecommunications, internet, hosting, cloud or email providers
• Force majeure events
• Malware, phishing or fraudulent communications not caused by Iberyc
• Actions or omissions of the affected user
• Circumstances that Iberyc could not reasonably prevent despite having implemented appropriate measures

This limitation applies only to the extent Iberyc has complied with its applicable legal obligations and is not legally responsible for the event giving rise to the damage.

10. Personal Data Breaches

If Iberyc becomes aware of a personal data breach, it will assess the circumstances and potential risks and take reasonable measures to contain, investigate and mitigate the incident.

Where required by applicable law, Iberyc will notify the competent supervisory authority and, where legally required, affected individuals.

Iberyc may cooperate with relevant service providers, technical specialists, legal advisers, insurers or competent authorities when reasonably necessary to investigate or manage an incident.

A breach caused by a third party does not by itself mean that Iberyc caused or is legally responsible for that breach. Responsibility will depend on the circumstances, the applicable law and whether Iberyc complied with its own legal obligations.

11. International Data Transfers

Some service providers used by Iberyc may process personal information outside Portugal or the European Economic Area.

Where applicable data protection law requires safeguards for such transfers, appropriate mechanisms may be used, including adequacy decisions, contractual safeguards or other transfer mechanisms recognised by law.

12. Data Retention

Iberyc retains personal information only for as long as reasonably necessary for the purposes for which it was collected or where retention is required or permitted by law.

Retention periods may depend on factors including:

• The time necessary to respond to and follow up an enquiry
• Whether an enquiry becomes a booking
• The duration of the customer relationship
• Administrative and accounting requirements
• Applicable limitation periods
• Legal or regulatory requirements
• Security, fraud-prevention and dispute-management requirements

When information is no longer reasonably required, it may be deleted, securely destroyed or anonymised.

13. Data Relating to Other Passengers

A customer may provide personal information concerning another passenger where reasonably necessary to organise the requested service.

By providing information relating to another person, you confirm that you are authorised to provide that information and, where necessary, have informed that person of the relevant processing.

Iberyc should not be provided with personal information about another person that is unnecessary for the requested service.

14. Your Data Protection Rights

Subject to applicable law, individuals may have rights including:

• Access to their personal data
• Correction of inaccurate or incomplete information
• Deletion of personal data
• Restriction of processing
• Objection to certain processing
• Data portability where applicable
• Withdrawal of consent where processing is based on consent

Requests concerning these rights may be sent to: travel@iberyc.com

Iberyc may request reasonable information to verify the identity and authority of the person making a request before disclosing, changing or deleting personal information.

15. Complaints

If you have concerns about how Iberyc processes personal information, you may contact Iberyc so that the matter can be reviewed.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

16. Third-Party Websites and Communications

The Iberyc website may contain links to independent websites, platforms or services.

Iberyc does not control and is not responsible for the privacy, security, availability, content or processing practices of independent third parties.

Visitors should review the privacy and security information of those third parties before providing them with personal information.

Iberyc is also not responsible for fraudulent websites, impersonation attempts, phishing messages or unauthorised communications created by third parties pretending to represent Iberyc.

17. User Responsibilities

Users are responsible for taking reasonable precautions when using the internet and communicating electronically.

This includes:

• Protecting their own devices and accounts
• Verifying suspicious communications
• Avoiding transmission of unnecessary sensitive information
• Providing accurate contact and travel information
• Informing Iberyc promptly if they believe a communication claiming to be from Iberyc may be fraudulent

18. Changes to this Privacy Policy

Iberyc may update this Privacy Policy where its services, website technologies, providers, business practices or legal obligations change.

The version published on the website at any given time is the current version and replaces previous versions.

19. Contact