Privacy Policy

1. Who is responsible for your data

The data controller is Joaquim Eduardo – Condução, Lazer e Turismo, Unip., Lda., which runs MM Ouressa Driving School.

• Company tax number (NIPC): 508233488
• Registered office: Rua Francisco Sá Carneiro, n.º 28, Cave-Loja C, 2725-316 Mem Martins
• School: Rua Francisco Sá Carneiro, n.º 28, Cave-Loja C, 2725-316 Mem Martins
• Privacy questions and exercising your rights: geral@mmouressa.com · 219 260 894
• Data Protection Officer (formally appointed): Bruno Pereira, who can be contacted at geral@mmouressa.com

2. Data we collect and where it comes from

On the website

• Contact form: name, email, subject and message (required); phone number and preferred contact method (optional). You provide this data.
• Spam protection: an identifier derived from your IP address using a hash function with a secret key held by the website, used to limit the number of submissions. Your IP address is not stored in clear text, but this identifier is still pseudonymised personal data, not anonymous data. We do not record the pages you visit.
• Form data if there is an error: if a submission fails because of a filling-in error, what you typed is stored temporarily so you do not have to type it again.
• Cookie choice: the categories you accepted and the date, stored in the mmo_cookies cookie.
• Google map: if you allow it, Google receives data such as your IP address. See the Cookie Policy.

If you contact us by phone, email or WhatsApp, we process the data you send us through that channel. WhatsApp is a Meta service with its own terms.

During enrolment and training at the school

Enrolment, lessons, tests and professional training take place outside this website. When you enrol, we collect directly from you:

• your name and address;
• the details shown on your identity document;
• a photograph;
• your mobile phone number and email address.

Paper documents. We keep paper copies of your identity document, your medical certificate and, where applicable, your psychological assessment certificate. These documents prove the fitness required for driving; they are not medical records, and the school does not keep any other health information.

Copy of the Citizen Card. We ask for your free consent in advance before making a paper copy for your file. The copy is optional: if you do not allow it, you show the original document so we can check your identity and record the necessary details, and refusing does not prevent you from enrolling.

The Student Area and the Online Training Platform are MM Ouressa Driving School's own services. Each provides specific privacy information about the personal data processed when you use it, which you can read within each service.

3. What we use your data for and on what legal basis

We do not rely on a general acceptance of this policy as a legal basis: each type of processing has its own legal basis, shown above.

4. Which data is required

On the form, your name, email, subject and message are needed for us to reply. Without them, we cannot deal with your request. Your phone number and preferred contact method are optional.

When you enrol, the data listed in section 2 is needed to enter into the training contract and handle your file with IMT; without it, enrolment cannot be completed. The copy of the Citizen Card is optional and refusing it does not prevent enrolment.

5. Who receives the data

• School staff who handle requests.
• Website hosting: the website is hosted on a server owned by the school, located on its premises in Portugal. Form requests are stored on that server, without using an external hosting company.
• Domain: the domain is registered and managed by OVH. OVH does not receive the data you send through the form.
• Email: we use business Google Workspace to receive and manage email communications, including form requests. Google acts as a processor.
• Google, only if you allow the map, as controller of its own processing of that data.
• Document destruction company: we use a certified company to destroy paper copies once their retention period ends. It acts as a service provider (processor).
• Public authorities, when required by law.
• IMT and test centres: during enrolment and training, we send the Instituto da Mobilidade e dos Transportes (IMT) and test centres the data and documents needed to process students' files and hold driving tests.
• Partner training providers: for professional training courses, the data needed for enrolment and delivery of the training is also shared with the partner training providers involved.

We do not sell personal data.

6. Transfers outside the European Union

Website server: the website and the copy of requests stored in the dashboard are on a server owned by the school, on its premises in Portugal. This does not mean all data stays in Portugal: emails and, if you allow it, the map depend on Google.

Email (Google Workspace): emails, including those containing form requests, may be processed in any country where Google or its subprocessors have facilities, including the United States. For transfers outside the European Economic Area, Google relies on the EU-U.S. Data Privacy Framework and, where that does not apply, on standard contractual clauses approved by the European Commission, under the Google Workspace data processing addendum.

Map (Google Maps): only if you allow it. In that case, data may be transferred to Google LLC in the United States, which participates in the EU-U.S. Data Privacy Framework.

7. How long we keep the data

• Requests stored in the website dashboard: 3 months; after that they are deleted automatically.
• Emails with information requests: 3 months; after that they are deleted.
• Anti-spam identifier: expires 1 hour after the last submission.
• Form data after a filling-in error: up to 10 minutes, or until the form is submitted successfully.
• Consent cookie: 182 days (about 6 months).
• Paper copies of the identity document, medical certificate and psychological assessment certificate: 5 years after the end of the training; after that they are destroyed by a certified company.
• Other student file data (digital records of enrolment and training): 5 years after the end of the training; after that it is deleted.
• Invoicing documents: 10 years, to comply with tax and accounting obligations.

8. Your rights

You can ask us, free of charge, for:

• Access to your data and a copy of it;
• Rectification of incorrect or incomplete data;
• Erasure, when the data is no longer needed or there is no basis for keeping it;
• Restriction of processing, in certain situations;
• Portability, when processing is based on consent or a contract and carried out by automated means;
• Objection to processing based on legitimate interest, on grounds relating to your situation.

These rights are not absolute: they depend on the legal basis for the processing and may be limited, for example when the law requires us to keep the data.

How to exercise them: send a request to geral@mmouressa.com or hand it in at the school. We may ask you for information to confirm your identity. We reply within one month, which may be extended by two further months for complex requests; in that case, we will let you know within the first month.

9. Consent and marketing communications

When processing depends on your consent, you can withdraw it at any time, as easily as you gave it. Withdrawing consent does not affect processing carried out before.

• Google map: click 'Manage cookies' in the footer.
• Copy of the Citizen Card: tell the school, in person or at geral@mmouressa.com, and you can ask for the copy to be destroyed.

This website does not collect data for sending marketing communications. If in the future we want to send you news or offers, we will ask for separate, optional consent, and you will be able to object at any time.

10. Complaints to the CNPD

If you believe your data has not been processed correctly, you can lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt. You can also contact us first so we can try to resolve the matter.

11. Security

We use appropriate technical and organisational measures to protect data, such as an encrypted connection (HTTPS), access to the website dashboard restricted to authorised people, and protection of the form against automated submissions. No system is completely free of risk; if a data breach occurs that poses a risk to you, we will inform the CNPD and, where the law requires, you as well.

12. Minors

Some licence categories, such as A1 and B1, can be obtained from age 16, so the school may receive requests from minors. When the student is under 18, the training contract is signed by the student and by their legal representative. This signature relates to the training contract: it is not general consent to all data processing, which has the legal bases shown in section 3.

If you are under 18, ask a parent or legal guardian to accompany you when you contact the school.

13. Cookies

For the cookies used on this website and how to manage your choice, read the Cookie Policy.

14. Automated decisions and profiling

We do not make decisions based solely on automated processing, nor carry out profiling, through this website.

15. Updates

We may update this policy when we change how we process data or when the law changes. The date of the last review is shown at the top of the page.