AboutRides is the commercial brand of the entity operating this SaaS platform for transfers operations management.
For the purposes of Regulation (EU) 2016/679 (the «GDPR»), AboutRides is (a) the Data Controller for users of the CRM, the mobile app and visitors to our website, and (b) a Data Processor (Art. 28 GDPR) for the personal data of third parties (end clients, passengers, drivers) that the Operator (tenant) enters into the Platform — the Operator is the Controller of that data.
Privacy contact and rights requests: [email protected].
Full registered address available on request via the email above.
GDPR: Regulation (EU) 2016/679, of 27 April 2016.
Platform: the web CRM (aboutrides.com), the REST API, the «AboutRides Driver» mobile app, and associated technical services.
Operator (tenant): the legal entity contracting use of the Platform to manage its transfers operation.
End user: a natural person whose data is processed in the context of the Operator's operation (clients, passengers, drivers, etc.).
Sub-processor: a third party engaged by AboutRides to provide technical services required by the Platform, under Art. 28(2) GDPR.
Account and profile data: name, email, phone, password (stored as Argon2id hash), language, theme, role, primary admin flag.
Operational data entered by the Operator: clients, drivers, vehicles, bookings, trips, routes, invoices, payouts, notes, messages, attachments.
Payment data: card numbers are processed exclusively by Stripe (PCI-DSS Level 1 certified). We receive only tokens and metadata (amount, status, reference); never the card number, never the CVV.
Technical data: IP address, user agent, device identifiers, refresh token fingerprint, access timestamps, audit logs of sensitive operations.
Communication data: transactional emails (password recovery, invites, receipts, contracts), push notifications, messages between Operator and driver.
Location data (driver mobile app): GPS coordinates — see «Driver mobile app» below.
Contract performance (Art. 6(1)(b) GDPR): providing the Platform to the Operator and its users — authentication, operations management, communications, invoicing, partner management and partnership contracts.
Legal obligation (Art. 6(1)(c)): issuing and retaining tax documents (Portuguese VAT Code Art. 52), responding to lawful requests from authorities, retaining data for defence in legal proceedings.
Legitimate interest (Art. 6(1)(f)): Platform security (fraud detection, audit logs, rate limiting, abuse detection), defence of AboutRides' rights, service improvement through aggregated/anonymised analysis, strictly necessary administrative communications.
Consent (Art. 6(1)(a)): analytics cookies, push notifications, mobile geolocation. Revocable at any time, without affecting the lawfulness of prior processing.
We do not process special categories of data (Art. 9 GDPR). Operators are instructed not to enter sensitive data into the Platform.
Where transport is booked and paid for directly on the AboutRides website, the roles set out in the “Who we are” section are reversed in respect of that passenger’s data.
In such cases AboutRides is the Controller of the passenger’s data, since it is AboutRides that contracts with the Customer, determines the purposes and means of processing, and collects the data directly from the data subject.
The transport operator that physically performs the trip processes that data on behalf of and under the instructions of AboutRides, as Processor, under article 28 GDPR and pursuant to a written agreement.
The data passed to the operator is limited to what is necessary to perform the transport, namely passenger name, contact details, pickup and destination locations and time, number of passengers, and flight information where applicable.
The legal basis is performance of the transport contract entered into with the data subject under article 6(1)(b) GDPR, and compliance with legal obligations, in particular tax and accounting obligations, under article 6(1)(c).
With strictly necessary sub-processors (listed below), under Art. 28 GDPR contracts with standard clauses.
With the Operator your account belongs to, for operational purposes. Each Operator only sees its own data; tenant isolation is enforced both at application and database level.
With public authorities upon legitimate request (judicial order, tax authority, data protection authority). We notify the data subject whenever legally permitted.
In case of a merger, acquisition, or sale of assets of AboutRides, data may be transferred to the successor entity, with 30 days' prior email notice and a right to export/delete.
We do not sell personal data. We do not share data with advertising platforms.
List current as of this policy's date. Material additions or substitutions are notified by email 30 days in advance — the Operator may object and, failing agreement, terminate the contract without cost.
Microsoft Azure (Microsoft Ireland Operations Ltd) — hosting, SQL database, blob storage, telemetry. Datacenter: West Europe (Netherlands). EU.
Stripe Payments Europe Ltd — payment processing. Based in Ireland. PCI-DSS Level 1 certified.
Azure Communication Services (Microsoft Ireland) — transactional email delivery. EU.
Expo Application Services (Expo, Inc.) — mobile push notification services. USA, with SCCs in place.
Apple Push Notification Service (Apple Inc.) and Firebase Cloud Messaging (Google LLC) — push notification delivery. USA, with SCCs in place.
Google Maps Platform (Google Ireland Ltd) — geocoding, maps, route calculation. Ireland and USA, with SCCs in place.
By default, personal data is stored in the European Union (Azure West Europe).
Transfers outside the European Economic Area — when they occur (Expo, Apple, Google) — are covered by Standard Contractual Clauses (SCCs) approved by the European Commission on 4 June 2021 (Decision (EU) 2021/914) and, where applicable, by the EU-U.S. Data Privacy Framework.
Copy of the SCCs in force available on request to [email protected].
The «AboutRides Driver» mobile app (iOS and Android) collects additional data needed for the driver workflow:
Precise foreground location: used to display the route on the map and compute distances while the app is open. Requested on first use, revocable in OS settings.
Background location: used exclusively during active trips to share the driver's real-time position with the client and the Operator. Collection stops automatically when the trip ends or the driver goes offline. We do not collect location outside of active trips.
Trip record for dispute defence: during active trips (from "On the way" to "Completed") we store the driver's position at each stage (confirmed, on the way, arrived, passenger on board, completed, no-show) and a simplified route of the trip, without repeated points. It is used to prove the service provided in case of a complaint or legal claim (for example, a disputed no-show or a delay). Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in defending the rights of the Operator, the driver and AboutRides. Only the Operator's staff and AboutRides can access it; the driver cannot. It is deleted 1 year after the trip ends, except while a complaint or dispute about that trip is open, in which case it is kept until it is closed.
Push notification token (ExponentPushToken via Apple APNS and Google FCM): used to notify the driver of new trips, changes and operator messages. The app remains functional without the token, but the driver will not receive notifications.
Device identifier: generated locally and stored in secure storage (iOS Keychain / Android Keystore). Used solely to bind refresh tokens to the device. Not shared with third parties; not the IDFA/AAID advertising identifier.
Legal basis: contract performance with the Operator (Art. 6(1)(b) GDPR). The driver can revoke any permission in the OS settings at any time.
Account data: while the account is active. After a deletion request, we retain for 15 days (recovery window) and then permanently delete.
Operational data (bookings, trips, drivers, vehicles): while needed for the Operator's operation. After contract termination, retained for 12 months for dispute resolution, then deleted.
Invoices, receipts, payouts and other tax documents: 10 years from the end of the fiscal year they relate to (Portuguese VAT Code Art. 52).
Signed partnership contracts: 10 years after termination, for legal defence (Portuguese Civil Code Art. 309) and compliance with commercial obligations.
Audit and security logs: 90 days in standard access, 12 months archived for incident response.
Trip location record (stages and route): 1 year after the trip ends; longer only while a complaint or dispute about that trip is open.
Revoked refresh tokens: 30 days for abuse investigation.
Backups: up to 35 days rolling (Azure SQL point-in-time restore).
After the above periods, data is irreversibly deleted or anonymised.
Encryption in transit (TLS 1.2 or higher on all communications) and at rest (Azure Storage Service Encryption AES-256).
Passwords stored as Argon2id hashes; never in plain text.
Sessions managed via rotating, single-use refresh tokens; actively revoked on password change or logout.
Tenant isolation: every query is forced to filter by TenantID; cross-tenant access is not technically possible on the Platform.
Infrastructure access restricted to a small number of AboutRides operators, with MFA and least privilege.
Immutable audit logs for sensitive operations (login, role changes, account deletion, contract signing).
Continuous dependency update programme and security review on each deploy.
Upon detection of a personal data breach likely to result in a risk to data subjects' rights and freedoms, we notify the CNPD within 72 hours (Art. 33 GDPR) and the affected data subjects without undue delay (Art. 34 GDPR).
The notification includes: nature of the breach, data involved, likely consequences, measures taken and contact point for further information.
Right of access (Art. 15 GDPR): know whether we process your data and obtain a copy.
Right to rectification (Art. 16): correct inaccurate or incomplete data.
Right to erasure (Art. 17, «right to be forgotten»): delete your data — subject to the legal retentions above.
Right to restriction of processing (Art. 18): suspend processing in specific cases.
Right to portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
Right to object (Art. 21): object to processing based on legitimate interest.
Right to withdraw consent (Art. 7(3)): applicable to cookies, push and location. Does not affect the lawfulness of prior processing.
Right not to be subject to a solely automated decision (Art. 22): we do not take decisions with legal effects by exclusively automated means.
In the CRM: Profile → «Export data» (portability) and «Delete account» (erasure).
By email to [email protected], stating: your identity, the right being exercised and a description of the request. We may request identity documentation if there is reasonable doubt about the requester's identity.
Response within a maximum of 30 days, extensible by 60 days in complex cases, with notice.
Manifestly unfounded or excessive requests may be refused or charged (Art. 12(5) GDPR).
Strictly necessary cookies: authentication, language, theme and density preferences. Always active under Art. 5(3) of the e-Privacy Directive.
Functional cookies: remember user at login. Opt-in via the «Remember me» checkbox.
Analytics cookies: opt-in via the consent banner. We use aggregated statistics only, with no cross-site tracking.
We do not use marketing cookies nor share data with advertising platforms.
You can disable cookies in your browser settings. Disabling strictly necessary cookies prevents login.
The Platform is intended exclusively for B2B entities and their adult collaborators. We do not intentionally collect data from minors under 16.
If we identify data from minors, we delete it immediately.
We do not take automated decisions producing legal effects or similarly significant effects on the data subject (Art. 22 GDPR).
Ancillary algorithms (driver-trip matching, commission calculation) are merely tools. The Operator retains final control over decisions.
We may update this policy to reflect new services, legal requirements or improvements in data protection.
Material changes are communicated by email at least 30 days in advance, with the changed version highlighted.
Current version shown in «Last updated». Previous versions archived on request.
If you believe we are processing your data in violation of the GDPR, you may file a complaint with the competent supervisory authority:
In Portugal: Comissão Nacional de Proteção de Dados (CNPD) — [email protected] — Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon — www.cnpd.pt.
We ask that you contact us first at [email protected] so we can try to resolve the matter.