Privacy Policy

The data controller is Lisbon Luxury Car Rental, the brand under which this website is operated in Lisbon. We do not publish a company registration number, VAT number or street address on this site, and none should be assumed from this policy.

For any question about this policy, about a specific enquiry, or to exercise the rights described below, write to [email protected]. This is also the address we use for all booking correspondence, so please mention that your message concerns privacy if that is the case.

We collect personal data directly from the person concerned, and limited technical data automatically as the site is used.

When an enquiry is sent through the website, we collect the fields completed in the form: name, email address, phone number if given, the car selected if any, pick-up and drop-off dates, the flight number if the enquiry is made through the airport delivery form, and any free-text message. The form also records the page URL and the referring website, so we understand which page the enquiry came from.

When a visitor contacts us directly by email, phone or WhatsApp outside the form, we collect whatever details are given in that conversation, such as name, contact details and rental preferences.

When a visitor taps a WhatsApp button on the site, we record the click itself in our booking system before WhatsApp opens: the page URL, the referring website, the site language and the prefilled message text. The conversation that follows happens inside WhatsApp and is governed by WhatsApp's own privacy policy, not by us.

Our server keeps standard logs of requests to the site, including IP address, time, requested page and browser, kept for a short period for security purposes.

We also measure visits using a script we serve ourselves from our own domain, with no third-party analytics, advertising or social-media trackers. This records pages viewed, time on page, the referring website, campaign parameters carried in the link such as UTM or ad click identifiers, device type, browser, operating system, screen size, browser language and the country derived from the IP address; the IP address itself is not stored. If the same visit later leads to an enquiry or a tap on a WhatsApp or phone link, that action is linked to the visit so we know which channel brought it.

The site places three items in the browser: a local-storage entry recording that the cookie notice was closed, a session-storage entry remembering which car was clicked so the enquiry form can be prefilled (deleted when the tab is closed or the form is sent), and a local-storage entry holding random visitor and session identifiers for the visit measurement described above, which expires thirty days after the last visit and can be cleared at any time in the browser. None of these three items contains contact details, and the site itself sets no cookies.

Two external resources load as the page is built: web fonts from Google Fonts, which receives the visitor's IP address to serve the font files, and the intl-tel-input library used by the phone-number field, loaded from the jsDelivr content delivery network. Neither sets cookies for us. The footer also links to our Tripadvisor and Trustpilot profiles; these are plain links, and nothing from those platforms loads unless the link is clicked.

We use enquiry and contact data to reply to the request, prepare a written quote and, if the client confirms, manage the resulting booking. This processing is necessary to take pre-contractual steps at the client's request and, once a booking is confirmed in writing, to perform the rental contract.

Server logs and the visit measurement described above are processed on the basis of our legitimate interest in keeping the site secure, understanding which pages and channels work, and improving how enquiries are handled, balanced against the limited and largely non-identifying nature of that data.

Booking records are also kept to satisfy Portuguese tax and accounting obligations, which is a legal obligation independent of the client's consent.

For a confirmed rental, we additionally ask for driving-licence and identity-document details at vehicle handover. This is necessary to verify that the driver is legally entitled to drive the car, to meet the conditions of our insurance cover, and to complete the rental contract itself; without these details the vehicle cannot be handed over.

We do not sell personal data to anyone, we do not use it to take automated decisions about any person, and we do not send marketing emails unless the recipient has asked us to.

Enquiry and booking data is stored in our own booking system and forwarded to our team through an internal messaging tool so that enquiries can be answered quickly. Access is limited to the people who need it to respond to the client or arrange the rental.

When a booking includes a chauffeur-driven service, the captain who performs that service receives the details needed to carry it out, such as the client's name, itinerary and contact details.

The site is hosted by a hosting provider that serves the pages and keeps the server logs described above; we do not name the provider here, and this policy does not disclose where its infrastructure is located.

Web fonts are served by Google Fonts and the phone-field library by the jsDelivr content delivery network; loading these resources can involve sending the visitor's IP address to servers operated by those providers outside Portugal, potentially outside the European Economic Area. We do not control the countries in which these providers process requests; each operates under its own privacy terms.

When a visitor starts a conversation on WhatsApp, that conversation is processed by WhatsApp (Meta) under WhatsApp's own privacy policy, which may also involve processing outside the European Economic Area. We only hold the click record described earlier, not the content of the WhatsApp conversation.

Enquiries that do not lead to a booking are deleted twenty-four months after they are received.

Booking records, including the data collected at handover, are kept for as long as Portuguese tax and accounting rules require records of that kind to be retained.

Server logs are kept for a short period for security purposes and then deleted.

The local-storage identifier used for visit measurement expires thirty days after the last visit and can be removed earlier by clearing browser storage; the session-storage entry used to prefill the enquiry form is removed as soon as the tab is closed or the form is submitted.

The website is a static site with no online payment and a deliberately small set of data flows: an enquiry form, a WhatsApp click record and self-hosted visit measurement. Access to the booking system and to the internal messaging tool used by our team is limited to the people who handle enquiries and bookings, and server logs are used to monitor and secure the site against misuse.

Under the GDPR and Law 58/2019, any person whose data we hold may ask us to:

• confirm whether we process their data and obtain a copy of it;
• correct inaccurate or incomplete data;
• erase data we no longer have a valid reason to keep;
• restrict or object to certain processing, including processing based on our legitimate interest;
• receive, in a portable format, data they provided to us for a contract; and
• withdraw, at any time, any consent previously given for marketing.

To exercise any of these rights, write to [email protected]. We may ask for information to confirm the identity of the person making the request, and we aim to respond within one month.

If a person believes their data has not been handled correctly, they may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, at www.cnpd.pt.

This site is addressed to adults arranging a car rental, chauffeur service or airport delivery in Lisbon, and we do not knowingly collect personal data from children through the enquiry form or any other channel on the site.

If we change how we process personal data, we will update this page and the updated text will apply from the date it is published; the version shown on the site at any given time is the one in force.