Privacy Policy

Last updated: June 2026

Your privacy is a priority for us. We are committed to handling your personal data transparently, securely and in compliance with the General Data Protection Regulation (GDPR).

I. Who is the Data Controller?

GlobalBus Lda. — Parque Empresarial Laborim, Largo UTIC 100, Armazém G2, 4430-246 Vila Nova de Gaia, Portugal. Email: geral@globalbus.pt

II. What Data Do We Process and For What Purposes?

We process your personal data only to the extent necessary to provide our service. Below we describe each purpose, the data involved, the legal basis and the retention period.

1. User account

Data: Name, email address, phone number.

Legal basis: Performance of a contract.

Retention: For as long as the account remains active. If you do not log in for 2 consecutive years, the account will be deleted.

2. Order processing

Data: Name, delivery address, company VAT number, order history and value.

Legal basis: Performance of a contract; legal obligation (invoicing).

Retention: Billing data: 10 years (tax obligation). Other data: for as long as the account is active.

3. Stock requests

Data: Name, phone number, product references and message.

Legal basis: Consent.

Retention: 12 months from the date of submission.

4. Contact forms

Data: Name, email, phone number and message.

Legal basis: Legitimate interest in managing and responding to requests.

Retention: For the period necessary to handle the request.

III. Who Do We Share Your Data With?

We rely on technology partners (sub-processors) whose involvement is necessary for the platform to function. They process your data only under our instructions:

Auth0 (Okta) — authentication service; data transferred to the USA under standard contractual clauses.
Neon Inc. — database hosted in the United Kingdom (country with a European Commission adequacy decision).
Google Firebase — image storage; data transferred to the USA under standard contractual clauses.
Airtable — contact form processing; data transferred to the USA under standard contractual clauses.
Vercel Inc. — web application hosting and delivery; data transferred to the USA under standard contractual clauses.

We do not sell or share your data with third parties for marketing or advertising purposes.

IV. What Are Your Rights?

Under GDPR, you have the right to:

Access — know what data we hold about you and receive a copy.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion of your data ('right to be forgotten'), except where retention is legally required.
Portability — receive your data in a structured, machine-readable format.
Restriction — ask us to temporarily suspend processing of your data.
Objection — object to processing based on legitimate interest.

To exercise any of these rights, email us at geral@globalbus.pt. We will respond within 30 days.

If you believe your rights have not been respected, you can lodge a complaint with the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)

Av. D. Carlos I, 134 – 1st floor, 1200-651 Lisbon — Tel. +351 213 928 400

geral@cnpd.pt — www.cnpd.pt

V. How Do We Protect Your Data?

Data is transmitted and stored using encryption (HTTPS/TLS).
Access to the platform and database is restricted and controlled by authentication.
Our sub-processors are leading companies with recognised security certifications.
We regularly monitor the platform to detect and address vulnerabilities.

VI. Changes to This Policy

This policy may be updated to reflect legal or operational changes. Any update will be published on this page with the corresponding date.