Privacy policy

Booking data

Name, contact details, payment details, rental and return dates, selected additional services — to process the booking.

Legal basis: Performance of the contract (Art. 6(1)(b) GDPR)

Driving licence data

Licence number, date of issue, issuing country — to check driving entitlement before handover.

Legal basis: Performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR)

Visual check of ID and driving licence (counter rental)

If the rental is recorded at the airport counter, a member of staff looks at your ID card or passport and your driving licence in the original and compares the numbers with the documents. We make NO copy and NO scan of your documents; no image is stored. All that is stored is whether the check took place, when it took place and which member of staff carried it out. The ID and licence numbers read off at that moment are part of the contract data and are described above.

Legal basis: Performance of the contract (Art. 6(1)(b) GDPR): without checking your driving entitlement we may not hand a vehicle over to you. In addition, legitimate interest in evidencing that the check took place (Art. 6(1)(f) GDPR). No consent is required for this — the law asks only for the driving licence number (Article 9(3) of Decreto-Lei n.º 181/2012). Because nothing is reproduced, Article 5(2) of Lei n.º 7/2007 (ban on reproducing the citizen card without consent) does not apply either.

Images of ID and driving licence (online check-in)

If you use the online check-in, you upload images of your ID card or passport and of your driving licence. These images are stored on our own server, are not shared with third parties and can only be viewed by signed-in Ilha 9 staff. Thirty days after the rental ends the image files are deleted automatically; all that remains is the note that a check took place, with time and result — that note is deleted after two years. What is evaluated automatically is the machine-readable zone of your document: we recompute its check digits (the ICAO Doc 9303 method) and compare name, date of birth, document number and expiry date with what you entered. That is a text measurement and NOT artificial intelligence. There is NO face match and NO automatic authenticity check. Nothing is rejected automatically — a human always decides (Art. 22 GDPR). You can remove the images yourself at any time.

Legal basis: Explicit consent (Art. 6(1)(a) GDPR) — required here because Article 5(2) of Lei n.º 7/2007 prohibits reproducing the citizen card without the holder's consent (fine of 250–750 € under Article 43). Without that consent we accept no image; the online check-in then does not apply and you show the original documents at the counter. You can withdraw your consent at any time by removing clearing the consent tick box in the check-in and saving; your images are deleted immediately. Withdrawal takes effect for the future.

Handover photos

Photos of the vehicle at handover and return (condition, mileage, fuel level) — as evidence for both sides in the event of damage.

Legal basis: Performance of the contract and legitimate interest in securing evidence (Art. 6(1)(b) and (f) GDPR)

GPS location data

If theft or unauthorised use outside the agreed conditions is suspected, the vehicle's location is evaluated on a case-by-case basis.

Legal basis: Legitimate interest in theft protection (Art. 6(1)(f) GDPR) — expressly not consent