Privacy Policy

Baby On Board®  respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal information when you visit or use https://babyonboard.pt/ (the “Website“), make a booking, rent our baby or child car seats, make a payment through the Website, contact us, or otherwise interact with our services.

This Privacy Policy is intended to comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable Portuguese data-protection legislation and other applicable privacy and electronic-communications laws.

1. Who is responsible for your personal data?

The data controller responsible for processing your personal data is:

BABY ON BOARD® Portugal
Registered office: Rua Domingos Sequeira Nº 27 – R/C G, 1350-119 Lisboa, Portugal
Email: info@babyonboard.pt
Telephone: +351 210 907 687

For the purposes of applicable data-protection legislation, Baby On Board is the entity responsible for determining how and why your personal data is processed in connection with the Website and our rental services.

If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact us using the details above.

2. What personal data do we collect?

Depending on how you use the Website and our services, we may collect the following categories of personal data:

A. Information you provide when making a booking or rental

This may include:

• Full name;
• Email address;
• Telephone/mobile number;
• Billing and invoicing information;
• Address and country of residence;
• Booking and rental dates;
• Collection and return location;
• Rental details;
• Information concerning the rented equipment;
• Information necessary to administer, modify or cancel your booking;
• Communications and correspondence with us;
• Any other information you voluntarily provide to us.

B. Payment information

When you make a payment through the Website, payment information may be processed by our third-party payment service provider.

Depending on the payment method used, this may include information such as:

• Payment status;
• Transaction amount and currency;
• Transaction/reference number;
• Payment method;
• Card type and limited card information;
• Billing information;
• Fraud-prevention and payment-security information.

We do not intend to store your complete payment-card number, CVV/CVC or other sensitive card authentication information on our own servers. Payments are processed through our payment service provider, subject to that provider’s own terms and privacy policy.

Where applicable, the payment provider may process personal data independently for the purposes of payment processing, fraud prevention, security and compliance with its legal obligations.

C. Information collected automatically

When you visit the Website, certain technical information may be collected automatically, including:

• IP address;
• Browser type and version;
• Device type;
• Operating system;
• Language and regional settings;
• Date and time of access;
• Pages visited;
• Referring website;
• Approximate location derived from IP address;
• Website interaction information;
• Cookies and similar technologies.

We use this information to operate, secure and improve the Website and, where applicable, to analyse Website usage and measure the effectiveness of our services.

3. How do we use your personal data?

We may process your personal data for the following purposes:

3.1 Managing bookings and rentals

We use your information to:

• Create and manage your booking;
• Provide the requested rental service;
• Process rental agreements;
• Confirm collection and return arrangements;
• Communicate with you about your booking;
• Manage changes, cancellations and refunds;
• Provide customer support;
• Manage equipment availability and logistics;
• Handle incidents relating to rented equipment.

The legal basis for these activities is generally the performance of a contract or taking steps at your request before entering into a contract.

3.2 Processing payments

We use the necessary information to process payments, refunds and other financial transactions connected with your booking.

The legal basis is generally the performance of the contract.

Payment transactions may also be subject to legal obligations applicable to us and to our payment providers.

3.3 Customer communications

We may use your contact information to send you:

• Booking confirmations;
• Payment confirmations;
• Rental instructions;
• Collection and return information;
• Changes or cancellations;
• Important service notices;
• Responses to your enquiries.

These communications are necessary for providing the service and are not the same as promotional marketing.

3.4 Customer service

We process communications and relevant customer information to answer questions, resolve complaints, investigate problems and provide support.

The legal basis may be the performance of a contract, our legitimate interests, or compliance with a legal obligation, depending on the circumstances.

3.5 Security and fraud prevention

We may process technical, transaction and booking information to:

• Protect the Website;
• Detect and prevent fraudulent transactions;
• Prevent misuse of our services;
• Investigate security incidents;
• Protect our customers, employees and business;
• Enforce our terms and conditions.

The legal basis may be our legitimate interests and/or compliance with legal obligations.

3.6 Legal and regulatory obligations

We may process and retain information where necessary to:

• Comply with tax and accounting obligations;
• Comply with legal requests;
• Establish, exercise or defend legal claims;
• Maintain appropriate business records;
• Prevent or investigate fraud or other unlawful activity.

The legal basis is compliance with a legal obligation and/or our legitimate interests.

3.7 Marketing

Where permitted by applicable law, we may use your contact details to send promotional communications about Baby On Board services, offers or related products.

Where consent is required, we will only send such communications where you have provided the necessary consent.

You may withdraw your consent or unsubscribe from marketing communications at any time.

Withdrawing marketing consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Legal bases for processing

Depending on the circumstances, we process personal data on one or more of the following legal bases under the GDPR:

• Performance of a contract – for providing rental services, managing bookings and processing payments;
• Legal obligation – where we are required to process or retain information by law;
• Legitimate interests – for security, fraud prevention, business administration, customer support, service improvement and protecting our legal rights, provided that these interests do not override your fundamental rights and freedoms;
• Consent – where consent is legally required, including certain marketing and non-essential cookie activities.

We do not rely on consent where another appropriate legal basis applies.

5. Cookies and similar technologies

The Website may use cookies and similar technologies.

Cookies may be used for different purposes, including:

Strictly necessary cookies

These cookies are necessary for the Website to function, including functions such as:

• Shopping/booking functionality;
• Session management;
• Security;
• Payment and checkout functionality;
• Remembering necessary preferences.

These cookies generally do not require consent where they are strictly necessary to provide a service explicitly requested by you.

6. Who do we share personal data with?

We do not sell your personal data.

We may share personal data with trusted third parties where this is necessary for the purposes described in this Privacy Policy.

These may include:

Payment service providers

Payment providers process payment transactions and related security information.

Website and hosting providers

We may use third-party providers for:

• Website hosting;
• Cloud storage;
• Website maintenance;
• Security;
• Technical support.

Booking, rental and operational service providers

Where necessary to provide the rental service, information may be shared with service providers involved in:

• Booking management;
• Equipment collection/return;
• Logistics;
• Customer communications;
• Rental administration.

Professional advisers

We may disclose relevant information to professional advisers such as lawyers, accountants, auditors and insurers where reasonably necessary.

Public authorities

We may disclose information where required by law, regulation, court order or a competent authority.

All third-party service providers that process personal data on our behalf are required to process such data in accordance with applicable data-protection requirements and our instructions, where applicable.

7. Payments and payment security

Payments made through the Website may be processed by specialised payment service providers.

For security reasons, Baby On Board does not normally receive or store complete payment-card details.

Depending on the payment provider and payment method, payment data may be transmitted directly to the payment provider’s secure systems.

The payment provider may independently process information in accordance with its own privacy policy and applicable payment-services legislation.

We may receive information such as whether a payment was successful or unsuccessful, the transaction reference, amount and currency, but not necessarily the full card details.

You should review the privacy policy of the payment provider used for your transaction.

8. International transfers of personal data

Some of our service providers may process personal data outside Portugal or outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will ensure that an appropriate legal mechanism is in place as required by the GDPR.

Depending on the circumstances, this may include:

• A European Commission adequacy decision;
• Standard Contractual Clauses approved by the European Commission;
• Appropriate safeguards under applicable data-protection law;
• Another legally permitted transfer mechanism.

Where appropriate, further information regarding relevant international transfers and safeguards may be obtained by contacting us.

9. How long do we keep your personal data?

10. Your rights under the GDPR

Subject to applicable legal conditions and limitations, you have the right to:

• Request access to your personal data;
• Request correction of inaccurate or incomplete data;
• Request deletion of your personal data;
• Request restriction of processing;
• Object to certain processing;
• Request portability of personal data where applicable;
• Withdraw consent where processing is based on consent;
• Object to direct marketing at any time;
• Lodge a complaint with a data-protection supervisory authority.

The GDPR provides these rights, although they are not absolute and certain exceptions may apply.

For example, we may need to retain certain information to comply with legal obligations even if you request deletion.

The Portuguese data-protection supervisory authority is the:

Comissão Nacional de Proteção de Dados (CNPD)
Rua de São Bento, n.º 148 – 3.º
1200-821 Lisboa, Portugal
Website: cnpd.pt

You may contact the CNPD if you believe that your personal data is being processed unlawfully or that your data-protection rights have not been respected.

11. How to exercise your rights

To exercise any of your rights, please contact us at:

info@babyonboard.pt

Please clearly identify your request and provide sufficient information for us to verify your identity where necessary.

We may request additional information where reasonably necessary to confirm that the request relates to the correct individual.

We will respond to valid requests within the period required by applicable law.

12. Data security

We implement appropriate technical and organisational measures designed to protect personal data against:

• Unauthorised access;
• Accidental loss;
• Destruction;
• Alteration;
• Disclosure;
• Unlawful processing.

Security measures may include access controls, authentication mechanisms, encryption where appropriate, secure communications and appropriate procedures for managing security incidents.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

You should also take reasonable precautions when using the Website, including protecting your account credentials and avoiding sharing sensitive information through unsecured communication channels.

13. Data breaches

If a personal-data breach occurs that is likely to result in a risk to the rights and freedoms of individuals, we will take the measures required by applicable law, including notifying the competent supervisory authority within the applicable legal timeframe where required.

Where legally required, affected individuals will also be informed.

14. Children’s personal data

Our services concern the rental of baby and child safety equipment, but the person making a booking should normally be an adult.

We do not intentionally collect personal data directly from children for the purpose of allowing them to make bookings or enter into rental contracts.

If information relating to a child is provided to us as part of a rental booking, we will process it only where necessary for the provision and administration of the requested service and in accordance with applicable data-protection law.

Parents or legal guardians should not provide unnecessary personal information about children when making a booking.

15. Third-party websites and services

The Website may contain links to third-party websites or services.

We are not responsible for the privacy practices, content or security of third-party websites.

If you follow a link to a third-party website, you should review that website’s privacy policy before providing personal information.

This may include websites operated by payment providers, social-media platforms, advertising providers or other service partners.

16. Social media

Our Website may contain links or integrations relating to social-media platforms.

If you interact with social-media content or links, the relevant social-media provider may collect information about your interaction in accordance with its own privacy policy and applicable settings.

Social-media services used by Baby On Board: [INSERT ACTUAL SERVICES, IF ANY].

17. Automated decision-making and profiling

We do not intend to use your personal data for decisions based solely on automated processing that produce legal or similarly significant effects on you.

If this changes, we will provide the information required by applicable data-protection law and, where required, obtain the appropriate consent or establish another lawful basis.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• Our services;
• The Website;
• Technology;
• Data-processing practices;
• Legal or regulatory requirements.

When we make material changes, we will take reasonable steps to notify users where required by law.

The “Last updated” date at the top of this Privacy Policy indicates when the policy was most recently revised.

19. Contact us

If you have any questions about this Privacy Policy, our use of personal data, or your privacy rights, please contact:

BABY ON BOARD® Portugal
Email: info@babyonboard.pt
Telephone: +351 210 907 687
Address: Rua Domingos Sequeira Nº 27 – R/C G, 1350-119 Lisboa, Portugal

20. Governing law

This Privacy Policy is governed by applicable Portuguese and European Union data-protection legislation, including the GDPR and applicable national legislation.

Nothing in this Privacy Policy limits any rights that you may have under mandatory applicable law.

End of Privacy Policy