Who processes your data and how to contact us
The controller of your personal data is GTSA – Gestão de Transportes e Serviços Auto, Lda., with registered office at Rua Pedro Hispano, no. 13 – 6th right, 2790-250 Carnaxide, Portugal, legal person no. 509.398.030.
For any matter concerning your personal data, including the exercise of your rights, you may contact the Data Protection Officer at sergio.olim@checkinpark.pt or by post to the address above, marked for the attention of the Data Protection Officer.
What data we process
Identification and contact: name, e-mail address and mobile number.
Vehicle data: number plate, make and model, vehicle type.
Trip data: drop-off and pick-up dates and times, service chosen, number of passengers, outbound and inbound flight numbers and terminal, additional services requested.
Billing data: tax identification number, name and address, when you ask for an invoice with a tax number.
Vehicle condition record: photographs, video and mileage, recorded when the vehicle is handed over and returned, so that both parties can compare the condition of the vehicle.
Customer account: if you create an account, your access details and your booking history.
Communications: the content of the messages you send us by e-mail, WhatsApp or form, and our replies.
Payment: the amount, date and means of payment. We do not collect or store card details — payment is made on the provider's terminal when the vehicle is returned.
Browsing: the data collected by cookies, described in the Cookie Policy.
Why we use your data and on what basis
To provide the service you booked — booking, receiving and returning the vehicle, driving you to and from the terminal and providing any additional services you requested. Basis: performance of the contract.
To talk to you about your booking — confirmations, changes, flight delays and support. Basis: performance of the contract.
To invoice and to comply with tax and accounting obligations. Basis: legal obligation.
To protect people, vehicles and the premises, including the vehicle condition record and video surveillance. Basis: legitimate interest in preventing and clarifying damage, theft and disputes.
To send commercial communications, where you have accepted them. Basis: consent, which you may withdraw at any time.
To measure use of the website and assess advertising. Basis: consent, given through the cookie banner.
If you accept advertising cookies, Google may associate site usage data with your Google account (Google signals) to measure and personalise ads across Google services. You can turn off personalised ads at myadcenter.google.com.
If you accept advertising cookies, the name, email address and mobile number you give in the booking are sent to Meta, and the email address and mobile number to Google, converted into an encrypted code that cannot be read, so that they can link the booking to the ads you saw. Without that consent, we do not send this data.
Video surveillance at the car park
The car park is monitored by cameras, 24 hours a day, in order to protect people and property. The monitored areas are signposted on site.
Footage is kept for 30 days and then deleted, unless it is needed as evidence in proceedings, in which case it is kept until those proceedings end. Access is restricted to people authorised by GTSA and to the authorities, where they lawfully request it.
Basis: legitimate interest in the safety of people and property.
Who else has access to your data
We use providers who process data on our behalf and only on our instructions:
— VEVS, which hosts the website and the booking engine;
— Google, for website analytics, tag management, e-mail, spreadsheets and operational applications;
— Meta, for the WhatsApp Business account we use for customer support and for advertising measurement;
— CookieYes, for cookie consent management;
— InvoiceXpress, for issuing invoices;
— the payment terminal provider;
— flight information providers, to track arrivals and departures.
We also receive bookings from platforms where you may have booked — ParkVia, Parclick, Multipark, Parkmundo, Free2Move and Looking4 — which send us the data needed to provide the service and are controllers of the processing they carry out on their own account.
Apart from these, your data is only disclosed to public authorities where the law requires it.
Transfers outside the European Union
Some of the providers listed above — namely Google, Meta and CookieYes — process data outside the European Economic Area, in particular in the United States of America. Those transfers rely on the mechanisms provided for in the General Data Protection Regulation, namely standard contractual clauses approved by the European Commission and, where applicable, adequacy decisions.
How long we keep your data
Booking and contract data: for the duration of the contractual relationship and, afterwards, for as long as needed to defend legal claims.
Vehicle condition record (photographs, video and mileage): 6 months.
Video surveillance footage: 30 days.
Invoices and tax documents: 10 years, as required by law.
Customer account: for as long as you keep it active; you may ask for it to be deleted at any time.
Customer support communications: for as long as they are needed to handle the request and, afterwards, for the retention period of the booking they relate to.
Cookie consent: 1 year, after which we ask you again.
Your rights
You may ask us for access to your data, its rectification or erasure, the restriction of processing, portability, and you may object to processing — except for data that is essential to provide the service you booked or to comply with legal obligations.
Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise any of these rights, write to sergio.olim@checkinpark.pt. We reply within one month.
If you believe your data is not being processed properly, you may lodge a complaint with the Portuguese Data Protection Authority (CNPD, Av. D. Carlos I, 134 – 1st floor, 1200-651 Lisbon, www.cnpd.pt).
Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, improper use, loss or destruction, and we review them periodically.
After a transaction, payment method information is not stored by our systems.
Cookies
The website uses cookies. Which ones, what they are for, how long they last and how to accept or refuse each category is explained in the Cookie Policy.
Commercial communications
If you have booked with us, we may occasionally send you e-mail messages about our services. We do so under Article 13(2) of Decree-Law 7/2004 and our legitimate interest in maintaining the commercial relationship, and only about services similar to those you have used.
Every such message contains a simple, free way to stop receiving them, and you may also ask us at any time at sergio.olim@checkinpark.pt. Once is enough.
We do not sell or pass your data to third parties for their own advertising.
Stopping these messages does not affect messages about your bookings — confirmations, reminders and notices — which are part of the service.
Changes to this policy
If we change this policy, we publish the new version on this page, with the date. Last updated: 26/10/2026.