Search for your bus ticket
Last updated: 10/02/2022
DeÔnibus values you as a customer and recognizes the importance of your privacy. We want you to become familiar with how we collect, use, and share your personal data, because we respect your privacy and want you to feel safe while using our services. We understand that you are trusting us with your information, and that is a great responsibility. We work hard to protect that information and to give you control.
DeÔnibus, CNPJ 15.448.440/0001-83, acts as the controller when processing the personal data of website visitors, prospects, and customers.
Our Data Protection Officer (DPO) is responsible for receiving requests from data subjects, providing clarifications, and taking appropriate actions regarding data protection. You can contact our DPO at privacidade@deonibus.com.
This Notice is intended to inform website visitors, customers purchasing via the site or App, and passengers about how we handle their data.
Some of the following terms are defined in Article 5 of the Brazilian General Data Protection Law (LGPD):
Personal data: Information related to an identified or identifiable natural person.
Sensitive personal data: Personal data about racial or ethnic origin, religious beliefs, political opinions, union membership, or membership in religious, philosophical, or political organizations, as well as data concerning health or sex life, genetic or biometric data, when linked to a natural person.
Data subject: The natural person to whom the personal data refers.
Data processing agents: The controller and the processor.
Controller: A natural or legal person, under public or private law, responsible for decisions regarding the processing of personal data.
Processor: A natural or legal person, under public or private law, who processes personal data on behalf of the controller.
Data Protection Officer (DPO): Person appointed by the controller and processor to act as a communication channel between the controller, the data subjects, and the National Data Protection Authority (ANPD).
Processing:Any operation carried out with personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction
Legal basis: The justification for processing personal data, as established by the LGPD.
Shared use of data: Communication, dissemination, international transfer, interconnection of personal data or shared processing of personal data databases by public bodies and entities in the exercise of their legal competencies, or between these and private entities, with specific authorization.
International data transfer: Transfer of personal data to a foreign country or an international organization of which the country is a member.
Consent: A free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.
National Authority (ANPD): The public administration body responsible for ensuring, implementing, and overseeing compliance with the LGPD throughout Brazil.
We process your personal data in accordance with the legal bases provided for in the LGPD and keep your data for the period necessary to achieve the purposes specified in this Notice.
| Personal Data | Purpose | What justifies the processing? |
|---|---|---|
| Registered user: Full name, social name, email, phone(s), CPF (or foreign passport), date of birth, legal guardian data in case of minors, city and state of residence, password, IP. Passengers: Full name and CPF, for passengers with travel insurance, date of birth is also requested. | So that the customer can make a purchase securely and the trip operation with the bus company is feasible. | Contract execution or preliminary procedure (art. 7, V) |
| Name, profiles, purchase transactions, tracking of what the user accessed (list of URLs accessed, location based on user IP), routes, email, date of birth, mobile, CPF, legal guardian's name (if under 18) and social name. | Analyze and survey the database | Legitimate Interest |
| By order number, access to: Full name, email, phone, CPF, date of birth, origin, and destination | Respond to customer request: check the log for error identification | Contract execution or preliminary procedure (art. 7, V) |
| In the most critical situation, the maximum data are: name, profiles, purchase transactions, user navigation tracking, routes (origin and destination), phone, email, card (first 6 and last 4 digits). | Respond to customer request for site error correction (“bug”). | Contract execution or preliminary procedure (art. 7, V) |
| Full name, email, CPF, mobile, date of birth, origin, destination. | Respond to customer requests | Contract execution or preliminary procedure (art. 7, V) |
| Name, email and CPF | Deactivate user (customer) | Contract execution or preliminary procedure (art. 7, V) |
| Passenger name and CPF | Confirm ticket through integration of supplier data and services | Legitimate Interest (art. 7, IX) |
| Passenger name and CPF | Deactivate integration with supplier | Legitimate Interest (art. 7, IX) |
| Full name, email, phone(s), cpf, date of birth, payment data (payment method, installments, card ending, purchase device, chargeback history, financial transactions (purchases and refunds), trip information (origin, destination, date, time, bus company, name and document of traveling passengers), IP information (number, browser, city, state, country, operator), history of transactional emails and SMS (receipts and openings), fraud prevention history, navigation logs history). | Data to make a purchase: Contract execution or preliminary procedures (art. 7, IX) | IP information, email and transactional service history, including fraud and navigation logs; Legitimate Interest (art. 7, IX) |
| Full name, email, CPF or RG, phone, order number (which gives access to all related information) | Analyze and resolve the customer's request | Contract execution or preliminary procedures (art. 7, IX). |
| User name, device, device language, app version code, app version name, android version | Analyze comments in app stores | Consent (art. 7, I) |
| Full name, email and order number. The review is published only under the first name, or anonymously (the customer may choose). | Analyze the purchase review made by the customer | Consent (art. 7, I) |
| Name, email, phone, subject, sub-subject and message.* Optional: social name, attachment and order number. | Analyze and resolve the customer's request | Contract execution or preliminary procedures (art. 7, IX). |
| All registration data | Respond to customer demands | Regular exercise of rights (art. 7, VI) |
| Name, phone, email, complaint, service evaluation, and whether they would do business with us again | Analyze and resolve the customer's complaint from Reclame Aqui | Identification and contact data and the complaint itself: Contract execution or preliminary procedures (art. 7, IX). Service evaluation and the question about doing business with the company again: Consent (art. 7, I) |
| Navigation data | Create target audience in marketing campaigns | Legitimate Interest (art. 7, IX) |
| Order number, sale date and time, price, status, site, sale status and channel | Close monthly sales for the affiliate | Legitimate Interest (art. 7, IX) |
| Name, email and phone | Increase the number of users who engage with the brand through sweepstakes | Contract execution or preliminary procedures (art. 7, IX). |
| Increase the user base by sending offers | Prospect (visitor): Consent (art. 7, I) Customer: Legitimate Interest (art. 7, IX) | |
| Update the customer base regarding news and promotions | Prospect (visitor): Consent (art. 7, I) Customer: Legitimate Interest (art. 7, IX) | |
| Name, email and phone | Send relevant information for the trip and promotions | For the trip: Contract execution or preliminary procedures (art. 7, V) Promotions: Legitimate Interest (art. 7, IX) |
| Geolocation, ID, operating system, device type and browser | Strengthen the brand and send promotions | Consent (art. 7, I) |
| Cookies, Hotjar (user behavior on the site), Search Console, Facebook Pixel (user navigation behavior for campaign creation), Google Analytics cookie (ID, time, device type, city, state, what was accessed, language, interests, age, payment method, revenue types, purchase value, number of purchases, browser type, screen size, round trip, navigation time, page sequence) | Personalize the site experience and create marketing campaigns | Consent (art. 7, I) |
| Push - Firebase: Age range, gender, installation and uninstallation, number of active and daily users, user engagement time, device type, source (acquisition), geolocation, navigation data (where the person stopped, cart abandonment) | Segment users for notifications and push offers. | Consent (art. 7, I) |
| Affiliate Networks: We cross the order number, if someone impacted by advertising made a purchase at DeÔnibus. With the order number we have customer data, email, phone, purchased ticket information | Advertising to potential audience | Consent (art. 7, I) |
Your personal data is provided directly by you or indirectly through the use of the platform.
Your personal data will only be kept with us if we have a valid legal basis that justifies its storage.
Data used for marketing will be kept until you request us to stop receiving our communications, through the unsubscribe link at the end of the email.
You have the right to obtain, regarding the data we process about you, at any time and upon request:
confirmation of the existence of processing;
access to data;
correction of incomplete, inaccurate or outdated data;
anonymization, blocking or deletion of unnecessary, excessive or non-compliant data as provided by Law 13.709/2018 (LGPD);
data portability to another service or product provider, upon express request, in accordance with the regulation of the national authority, subject to commercial and industrial secrets;
deletion of personal data processed with the data subject's consent, except in cases provided for in art. 16 of the LGPD;
information about public and private entities with which the controller has shared data;
information about the possibility of not providing consent and about the consequences of refusal;
revocation of consent, under the terms of § 5 of art. 8 of the LGPD.
right to petition regarding your data against the controller before the national authority.
To exercise your rights, you must send an email (from your email registered on our platform, if you are a customer) to privacidade@deonibus.com, stating the right you wish to exercise. You will be asked only for the necessary and appropriate data to prove your identity, according to the right you wish to exercise, so that no more data will be requested than we already have.
We are committed to responding as quickly as possible, which may take up to 15 days. However, your request may not always be granted, as it may not correspond to any of the cases provided for in the LGPD. But, if this is the case, you will receive a response with the appropriate justification, as required by law.
We only share your personal data for the purposes specified in this Notice or when there is a legal requirement.
Your data is shared with systems, platforms and/or applications necessary for the execution of our activities and according to the purpose provided for each personal data processing activity.
We use some products or services (or parts of them) that are hosted outside Brazil, which means we may transfer any information you send us abroad. This happens due to the need to store personal data in the cloud, where servers may be in other countries.
You are not required to provide your personal data to us. However, this data is necessary for the contract you have with us to be executed, for our communication or any other specific purpose informed. Therefore, we will not be able to carry out these operations without your data. The same applies to the exercise of your rights provided for in the LGPD. That is, if you do not provide the personal data necessary for confirming your identity, we will not be able to respond to your request.
DeÔnibus only processes your personal data in accordance with this Privacy Notice and the LGPD. If, however, you wish to file a complaint about our processing activities regarding your personal data, you have the right to petition (see section What are your rights and how can they be exercised?) before the National Authority (https://www.gov.br/anpd/pt-br).
This Notice may be revised at any time, in order to keep it up to date with applicable legislation and the company's own organization. Therefore, we recommend that you consult this document periodically and check the date of the last update.
