LIGHTMOBIE, LDA (hereinafter, MOBICYCLE), headquartered at Avenida das 2 Rodas, Lote 36-A, Parque Empresarial do Casarão 3750-041 Aguada de Cima, NIPC 515 514 748, is the owner of MOBICYCLE. MOBICYCLE provides services to ENTITIES as a data processor and will process users' personal data in this capacity. The referred ENTITIES are the data controllers for your data.

1. WHAT DOES THIS POLICY COVER?
   1. This Privacy Policy explains how we collect and process the personal data necessary to provide services available through MOBICYCLE.
   2. The services mentioned above are provided through MOBICYCLE, including bicycle reservations for ENTITIES with whom MOBICYCLE has contracts and data processing agreements.
   3. MOBICYCLE acts as a data processor for these ENTITIES regarding bicycle reservations. Users must contact these ENTITIES to exercise their rights or ask questions about how their data is processed in the context of bicycle reservations.
   4. The aim is to provide these services efficiently and without inconvenience, describing the practices adopted for this purpose.
2. WHAT IS PERSONAL DATA?
   1. Personal data is any information relating to a person that identifies that person or makes them identifiable, regardless of the nature and format of the information, including sound and image.
   2. Identifiable means a person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more specific elements of their physical, physiological, psychological, economic, cultural, or social identity.
3. HOW WILL WE USE YOUR PERSONAL DATA?
   1. MOBICYCLE will use the personal data you provide for the following purposes:
      1. To create an account registration in MOBICYCLE;
      2. To manage bicycle reservations for each ENTITY;
      3. To allow users to pay for services through MOBICYCLE;
      4. For invoicing purposes by ENTITIES;
      5. For MOBICYCLE operations and management;
      6. For commercial purposes, such as data analysis and audits;
      7. For fraud prevention and information system security;
      8. For adaptation, improvement, and modification of services, including identifying usage trends.
   2. These personal data processing operations are essential tools for your satisfaction and MOBICYCLE's activity and are carried out in accordance with applicable legislation and best practices.
   3. Your personal data will not be reused for purposes other than those previously identified or unrelated to the purposes for which they were initially collected.
   4. Users of MOBICYCLE are responsible for all data entered in the application. If you enter third-party data, you must ensure its lawful basis, exempting MOBICYCLE from responsibility for collecting such personal data.
4. WHAT ARE THE GROUNDS, DATA WE COLLECT, AND RETENTION PERIODS FOR THE PERSONAL DATA WE COLLECT?

   PURPOSE	LEGAL BASIS	DATA	MAXIMUM PERIOD
   To create an account registration in MOBICYCLE	Pre-contractual steps at the request of the data subject and contract execution.	Full name, Date of birth, Email and password, Phone number, Nationality, ID number (ID card/Passport), Tax ID, Address, Identification documents sent (photos/files).	According to the period defined by the ENTITIES' GDPR.
   To manage bicycle reservations for each ENTITY	Contract execution.	Full name, Date of birth, Email and password, Phone number, Nationality, ID number (ID card/Passport), Tax ID, Address, Identification documents sent (photos/files).	According to the period defined by the ENTITIES' GDPR.
   To allow users to pay for services through MOBICYCLE	Legal obligations and contract execution.	Full name. MBWay payment: Phone number. Credit/Debit Card payment: Card name, Cardholder, Card number, Security code, Expiry date.	According to the period defined by the ENTITIES' GDPR.
   For invoicing purposes by ENTITIES	Legal obligations.	Full name, Email, Tax ID, Address.	According to the period defined by the ENTITIES' GDPR.
   For MOBICYCLE operations and management	Consent for this specific purpose; Legitimate interests pursued by MOBICYCLE.	IMEI, Geolocation data.	According to the period defined by the ENTITIES' GDPR.
   For commercial purposes, such as data analysis and audits	Consent for this specific purpose; Legitimate interests pursued by MOBICYCLE.	IMEI, Geolocation data.	According to the period defined by the ENTITIES' GDPR.
   For fraud prevention and information system security	Legitimate interests pursued by MOBICYCLE.	Full name, Email, IMEI, Geolocation data.	According to the period defined by the ENTITIES' GDPR.
   For adaptation, improvement, and modification of services, including identifying usage trends	Consent for this specific purpose; Legitimate interests pursued by MOBICYCLE.	Full name, Email, IMEI, Geolocation data.	According to the period defined by the ENTITIES' GDPR.

   1. If the law requires a specific or mandatory period, that period will be followed. In all other cases, personal data will be retained for the maximum periods indicated above, which MOBICYCLE considers sufficient to fulfill the purposes.
   2. Once the retention period ends, all collected personal data will be deleted.
5. HOW DO WE COLLECT YOUR PERSONAL DATA?
   1. We collect your personal data through forms on MOBICYCLE, as well as through MOBICYCLE itself and the communication it makes with your device and emails you send us.
   2. Your personal data is collected from your device as follows:
      1. Email address;
      2. Through your user data.
   3. MOBICYCLE is committed to processing your data lawfully and legitimately.
   4. MOBICYCLE will not sell, rent, or share your personal data with third parties, except in cases clearly identified in this Privacy Policy (see Point 8 for details).
   5. MOBICYCLE's services are not directed at minors, and personal data of minors is not intentionally processed.
6. HOW DO WE PROTECT YOUR PERSONAL DATA?
   1. Your personal data is kept secure through various technical and organizational security measures, ensuring that only employees and processes that should access the data do so, according to rules created for this purpose.
   2. To protect your personal data, we only use data center providers that offer adequate and documented security measures, including guarantees that your personal data is stored on servers maintained in controlled environments with limited access.
   3. Personal data is kept on secure servers at DMNS – DOMINIOS, S.A. (hereinafter, "Domínios") NIPC 505.304.775, located at Parque Multiusos, Areal Gordo, Lote 3A, 8005-409, Faro, which offers adequate security guarantees to protect personal data against dissemination, loss, misuse, alteration, unauthorized processing or access, and any other form of unlawful processing.
   4. Likewise, when you browse MOBICYCLE, we protect your data with encryption, such as Transport Layer Security (TLS, a security protocol that protects internet communications), and your password is stored using a one-way hash, meaning it cannot be recovered (or disclosed) by anyone, including MOBICYCLE, and can only be reset.
   5. Although we take precautions and measures we consider appropriate to protect the personal data you provide and we collect, it is important to be aware that no security system is impenetrable.
   6. Therefore, you should take certain precautions, such as keeping your password secret and not disclosing it to anyone; if you believe your password has been misused, notify us immediately; also, make sure to start and end your session whenever you close your browser.
7. HOW CAN YOU EXERCISE YOUR RIGHTS?
   1. Before explaining how you can exercise your rights, it's important to know what they are. Legislation grants you the right to request the exercise of the following rights:
      1. Access: the right to obtain confirmation as to whether or not personal data concerning you is being processed and, if so, the right to access your personal data;
      2. Rectification: the right to obtain the rectification of inaccurate personal data concerning you and to have incomplete personal data completed;
      3. Erasure: the right to obtain the erasure of your personal data when one of the reasons listed in the legislation applies;
      4. Restriction of processing: the right to obtain restriction of processing if one of the situations listed in the legislation applies;
      5. Objection: the right to object at any time to the processing of personal data concerning you;
      6. Portability: the right to receive your personal data in a structured, commonly used, and machine-readable format.
   2. You also have the right to lodge a complaint with the competent supervisory authority (in Portugal, the Comissão Nacional de Proteção de Dados at www.cnpd.pt)
   3. To exercise the above rights, please contact MOBICYCLE via the following email: suporte@mobicycle.pt.
   4. If you request the deletion of some or all of your personal data, some requested services may not be provided, and MOBICYCLE will retain only the personal data necessary to fulfill its legal obligations.
8. WHEN DO WE DISCLOSE DATA TO THIRD PARTIES?
   1. MOBICYCLE will use third parties to provide certain services, such as payment management, and these may have access to some personal data, namely the data necessary for the contracted purposes. Altice Pay, S.A. (hereinafter, "MEO WALLET") NIPC 510.563.090, located at Av. Fontes Pereira de Melo, 40, 1069-300 Lisbon, Portugal, will be responsible for payment management and will have access to your personal data collected for this purpose.
   2. Moloni Unipessoal, Lda. (hereinafter, "MoloniOn") NIPC 513.321.527, located at Av. José Malhoa, n.º 2 - Tardoz, Malhoa Plaza Building, Office 1.5, 1070 - 325 Lisbon, will be responsible for payment management and will have access to your personal data collected for this purpose.
   3. This site uses Google's reCAPTCHA service to protect forms from spam and abuse by automated bots. The reCAPTCHA service analyzes visitor behavior on the site to determine if the action is performed by a human. This analysis occurs automatically and may include the collection of information such as IP address, browser data, operating system, mouse movements, and other interactions with the page. The data collected is processed by Google in accordance with its Privacy Policy and Terms of Service. The use of reCAPTCHA is based on the legitimate interest in protecting the website against spam and abusive activities. For more information, see:
      • https://policies.google.com/privacy
      • https://policies.google.com/terms
   4. MOBICYCLE ensures that entities with access to the data are credible and offer high protection guarantees, and data is never transmitted beyond what is necessary for the contracted service.
   5. MOBICYCLE will disclose users' personal data to ENTITIES that have contracted MOBICYCLE's services for bicycle reservations, and these ENTITIES will be the Data Controllers.
   6. MOBICYCLE may also transmit data to third parties in investigations, inquiries, and judicial and/or administrative proceedings or similar, provided it is duly ordered by judicial order.
9. THIRD-PARTY WEBSITES.
   1. MOBICYCLE may contain links to other websites that may collect and process your personal data, and such processing is the sole responsibility of the owners of those websites. MOBICYCLE has no responsibility for their policies and/or practices.
   2. Examples of such third parties include Google through the buttons present on MOBICYCLE.
10. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION.
    1. If data transfers to third countries outside the European Union occur, MOBICYCLE will comply with legal rules, particularly regarding the adequacy of the destination country for personal data protection and applicable requirements. Personal data will not be transferred to jurisdictions that do not offer security and protection guarantees.
11. MINORS.
    1. MOBICYCLE is not directed at minors under 18 years old, so we ask that minors do not provide personal data through MOBICYCLE, social networks, or emails.
12. SENSITIVE PERSONAL DATA.
    1. MOBICYCLE will not process special categories of user data, so please do not send such data. If you do, we will delete it immediately.
13. CHANGES TO THE PRIVACY POLICY.
    1. MOBICYCLE reserves the right to adjust or change this Privacy Policy at any time, and such changes will be publicized.
14. OUR CONTACT DETAILS.
    1. If you have any questions or concerns regarding this Privacy Policy, please contact us in writing via email suporte@mobicycle.pt.
15. LATEST VERSION.
    12.03.2026. Águeda (Portugal)