Privacy Policy

Who is the Data Controller for your personal data?

In accordance with applicable regulations, the data subject (hereinafter, the “User”) is informed that the personal data provided will be processed by the owner of the website www.busup.com (hereinafter, the “Website”), BUSUP TECHNOLOGIES S.L. (hereinafter, “BUSUP”), whose contact details are as follows:

Tax identification numberB-66864307

Registered officeGran Via de les Corts Catalanes 133 (CP 08014) Barcelona, España

Data Protection Officer emailinfo@busup.com

For what purposes and on what legal bases will your personal data be processed?

Personal data provided by the User through Website forms or other channels, other than the App itself, will be used for the following purposes:

Processing activities common to all countries where we operate

Requests, inquiries and information

To respond to requests, applications, inquiries for information or documentation submitted through Website contact forms by a representative of a company, business and/or technology park, university, school or event, a passenger transport service operator, or any other type of Website User. In these cases, the processing of personal data is based on the User’s consent, given by checking the corresponding box on the form.

You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal. The method for withdrawing consent is described at the end of this section.

Job applications

To manage job applications submitted for vacancies published on our Website, LinkedIn, or through a recruitment or employment agency. In this case, processing is based on taking pre-contractual steps at the request of the data subject or the intention to enter into a contract. Where applicable, we may receive your résumé/CV or academic and professional experience through LinkedIn or a recruitment or employment agency in order to begin the relevant selection process. We may also process personal data that you voluntarily provide through an unsolicited application, based on BUSUP’s legitimate interest in managing such applications. In addition, if you authorize us, we may share your résumé/CV with other BUSUP Group companies to increase your chances of joining the Group. You may withdraw this consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Blog subscription

To register and manage the User’s subscription to the blog on our Website https://www.busup.com/es-es/blog in order to receive the latest news and published articles by email. The processing of personal data is based on the User’s consent, given by checking the corresponding box on the form.

You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

Blog comments

To manage the User’s participation in the Website blog comment form through the publication of comments. The processing of personal data is based on the User’s consent, given by checking the corresponding box on the form. Publication of a User comment is subject to compliance with the Website Legal Notice.

You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

Marketing communications

To send marketing communications about BUSUP services and updates by email. The processing of personal data is based on the User’s consent, given by checking the corresponding box on our Website or social media forms, for example when using a contact form or downloading documents free of charge.

You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

Relationships with legal entities

To maintain relationships of any kind with the legal entity for which an authorized individual provides services when representing that organization. Based on Bus Up’s legitimate interests, we will process information you provide — for example, through business cards — or that third parties lawfully provide to us. You may object to this processing by exercising your rights. In certain cases, Bus Up’s legitimate interest may override the right to object, in which case you will be provided with a reasoned explanation.

Telephone customer service

To receive and manage calls made to BUSUP’s telephone customer service (Call Center), based on the performance of the contractual relationship with Users who have contracted BUSUP services. The purpose is to handle and manage requests, inquiries or incidents communicated by telephone.

Call recording

To record calls made to BUSUP’s telephone customer service (Call Center) in order to properly manage your request, improve service quality and defend BUSUP’s interests against potential claims. This processing responds to BUSUP’s need to ensure service quality, resolve current and future incidents, and verify information provided by Users. BUSUP considers this processing appropriate to satisfy its legitimate interest in addressing potential claims, since the information may be necessary for the establishment, exercise and/or defense of such claims. It also responds to BUSUP’s current and genuine interest in protecting itself against potential practices that could cause harm. Data subjects may object to this processing at any time in accordance with the rights described in this Privacy Policy.

Specific processing activity

Driver geolocation while providing the service

The BUSUP Drivers application records the driver’s geographic location while assigned transport services are being provided, through an automated system that operates via a background service in the mobile device’s operating system, allowing it to function even when the application is closed.

What data do we process and when?

The system downloads the services assigned to the driver and verifies the start and end times of each service.
Tracking is activated automatically 15 minutes before the official start time of each service.
Tracking ends automatically 90 minutes after the official scheduled arrival time, or when STOP is pressed.
Tracking may be activated even if the driver has not manually started the service in the app.

For what purposes?

Verification of compliance with transport service routes and schedules.
Passenger road-safety assurance through real-time monitoring.
Incident management during and after the journey (delays, passengers left behind, assistance if needed).
Evidence of service performance for the corporate customer.
Protection against civil liability or contractual claims.
Operational optimization of fleet management.

What is the legal basis?

Performance of the transport contract (Art. 6(1)(b) GDPR).
Busup’s legitimate interest in the operational management of the fleet (Art. 6(1)(f) GDPR), assessed through a balancing test available from the company upon request.

Who is it shared with?

Recipient	Purpose
End customer (company using the transport service)	Verification of the contracted service
Transport operator (driver’s contracting entity)	Service management and operational coordination
Busup technology providers	Hosting, processing and maintenance

No international transfers are made outside the European Economic Area.

Processing activities specific to countries where we operate

Brazil

BUSUP may interact with you through social networks on which BUSUP has a registered profile in Brazil. In these cases, BUSUP’s processing of personal data will be intended to respond to your inquiry and will be based on taking pre-contractual steps at the request of the data subject.

In all cases, the processing of your personal data is ultimately subject to the privacy and security policy or terms of the social network of which you are a User. You may consult the privacy policies of the social networks on which BUSUP has a profile in Brazil:

What categories of personal data will be processed?

The categories of data processed will be determined in each case according to the collection channel and the purpose pursued. The data may include the following:

Processing activities common to all countries where we operate

Collection channel / Purpose	Types of data
Contact form / Responding to a request, application or inquiry	First and last name; organization name (when acting as a representative of one of the entities mentioned in the purpose); country; email; other data provided in comments.
Application form / Managing job applications	First and last name; email; telephone; LinkedIn profile; CV; cover letter.
Blog sign-up form / Subscription to receive news and articles	Email.
Blog comment form / Participation in the blog through comments	Name; email.
Website or social media forms where consent is requested for marketing communications	First and last name; email and telephone; professional data such as company and position.
Call Center	Name; email.

Processing activities specific to countries where we operate

Brazil

Chats or direct messages on social networks

First and last name; email and telephone.

Requirement to provide data

As a general rule, the data requested in Website forms or other channels, other than the App, are mandatory — unless the required field states otherwise — in order to fulfill the established purposes. Therefore, if the data are not provided or are not provided correctly, those purposes cannot be fulfilled, without prejudice to your ability to carry out other actions on the Website.

Sources from which we obtain User data

Information provided by the User.
Data obtained from browsing behavior (see the Cookie Policy at https://www.busup.com/es-es/cookies-policy).

How long will we process your personal data?

As a general rule, personal data will be retained for as long as you remain registered as a User of any of the services on our Website — for example, a blog subscription — and thereafter until any potential liabilities arising from that relationship have become time-barred.

The criteria or periods for retaining personal data are summarized below.

Processing activities common to all countries where we operate

Purpose	Retention criterion or period
Responding to a request, application or inquiry	For the time necessary to process and respond to your requests and, once completed, for the limitation period applicable to legal actions arising from those requests.
Managing job applications	Data used to assess your job application will be retained for the time strictly necessary to determine whether your application fits the advertised profile and, in any event, for no longer than one year. If BUSUP intends to retain your personal data for a longer period, your consent will be requested.
Subscription to receive blog news and articles	Data used to send blog news and articles based on consent will be processed until the User withdraws consent.
Participation in the blog through comments	Data used to manage participation in the blog through comments, based on consent, will be processed until the User withdraws consent.
Sending marketing communications	Data used to send marketing communications based on consent will be processed until the User withdraws consent.
Handling data protection rights	For the time necessary to fulfill the right requested by the User and, once fulfilled, until any potential liabilities arising from this processing have become time-barred.
Call Center	For the time necessary to process and respond to your requests and, once completed, for the limitation period applicable to legal actions arising from those requests.

Processing activities specific to countries where we operate

Brazil

Chats or direct messages on social networks

For the period during which your request, inquiry or application is being handled.

In any event, where specific retention periods different from those above apply, you will be informed through other collection and information channels made available to you.

Data security

BUSUP has implemented the technical and organizational measures necessary to ensure the security of your personal data and to prevent alteration, loss, unauthorized processing or access, taking into account the state of the art, the nature of the data and the risks to which they are exposed. However, please note that Internet security measures, due to the Internet’s nature and global reach, are not impregnable.

Who are the recipients of your personal data?

User data may be disclosed to:

The Spanish Tax Agency (AEAT) for BUSUP’s compliance with tax obligations, as well as any other public authority with jurisdiction over the relevant matter.
If a request, inquiry or application explicitly or implicitly concerns the services of a BUSUP Group company operating in a specific territory, personal data may be disclosed to that company on the basis of performance of the contractual relationship.
Judges and Courts in the cases provided by law.
Other BUSUP Group companies, with your consent, for the purpose of assessing your job application.

In these cases, your personal data will only be sent to the company located in the country where the vacancy is open.

BUSUP Group companies and locations

Company	Location
BUSUP Technologies, S.L.	Spain
BUSUP España Mobility, S.L.	Spain
BUSUP Portugal Mobility LDA	Portugal
busUp do Brasil Tecnología LTDA	Brazil
BUSUP USA Mobility Inc.	United States
BUSUP Mobility Mexico S.A. de C.V.	Mexico

BUSUP’s service providers may also access data when such access is necessary for proper compliance with legal obligations and/or the purposes described above. These providers will not process your data for their own purposes. Categories of processors include:

Collective passenger transport service operators that will perform the transport service.
Hosting and cloud-service providers.
IT maintenance services, analytics-tool providers and CRM systems.
Candidate recruitment agencies.
BUSUP Group companies providing administrative and technological support to Group companies.
Email service providers.

Some of the recipients mentioned above are located in Europe and others outside the European Economic Area (EEA). Through contractual clauses, BUSUP ensures that these service providers process personal data in accordance with European data protection standards to provide a high level of protection, including when personal data are transferred to a country for which there is no EU Commission adequacy decision. No other transfers of personal data are made to other recipients except where required by law. For more information about appropriate safeguards for international data transfers, or to obtain a copy of them, contact our data protection officer at info@busup.com.

What rights do Users have?

In all countries where BUSUP operates, Users have the right to:

Access their personal data.

Rectify inaccurate or incomplete data.

Request deletion of their data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.

Obtain restriction of data processing from BUSUP when any of the conditions established in applicable data protection regulations are met.

Request portability of their data.

Object to processing of their data.

Lodge a complaint with the competent authority in the country where BUSUP has its main establishment when the data subject considers that BUSUP has infringed rights recognized under applicable data protection regulations. In this regard, a complaint may be filed with the Spanish Data Protection Agency (http://www.aepd.es).

Where rights other than those listed above apply in the User’s country of residence, Bus Up will inform the User of those rights at the time the data are collected. You may contact BUSUP by sending a request accompanied by a photocopy of your identity document, or by proving your identity through another legally accepted method, to info@busup.com.

User responsibility

The User:

Guarantees that they are over 14 years old when registering on the Website and/or Application and that the data provided to BUSUP are true, accurate, complete and up to date. The User is responsible for the accuracy of all data communicated and will provide updated information reflecting their actual situation.
Guarantees that they have informed any third parties whose data they have provided, where applicable, of the matters contained in this document and that they have obtained authorization to provide those data to BUSUP for the stated purposes.
Will safeguard access credentials and/or passwords, undertakes not to transfer their use, and assumes responsibility for any misuse.
Will be responsible for false or inaccurate information provided through the Application and/or Website and for any direct or indirect damage that may be caused to BUSUP or third parties.

Changes to this Privacy Policy

If you have any questions about privacy at BUSUP, please contact us at our address with a detailed description of your inquiry and we will try to resolve it.

Our business and technology are constantly changing, and our Privacy Policy may also change. If BUSUP changes this Privacy Policy, BUSUP will publish a notice on the Website so Users can become aware of any changes to the conditions under which their personal data are processed. However, if BUSUP decides at any time to use Users’ personal data in a manner different from that established at the time of collection and User consent is required for such further processing, BUSUP will notify Users by email and request that consent.

Other legal texts applicable to the service

The following legal texts are classified by applicable jurisdiction and User category.

Spain

Passengers

BUSUP Spain App Service Terms and Conditions
BUSUP App Privacy Policy

Drivers

BUSUP Drivers App Privacy Policy

Monitors

BUSUP Schools App Privacy Policy

Portugal

Passengers

BUSUP Portugal App Terms and Conditions
BUSUP App Privacy Policy

Drivers

BUSUP Drivers App Privacy Policy

Monitors

BUSUP Schools App Privacy Policy

Brazil

Passengers

BUSUP Brazil App Terms and Conditions
BUSUP App Privacy Policy

Drivers

BUSUP Drivers App Privacy Policy

Monitors

BUSUP Schools App Privacy Policy

United States

Passengers

BUSUP USA App Terms and Conditions
BUSUP App Privacy Policy

Drivers

BUSUP Drivers App Privacy Policy

Monitors

BUSUP Schools App Privacy Policy

Peru

Passengers

BUSUP Peru App Terms and Conditions
BUSUP App Privacy Policy

Drivers

BUSUP Drivers App Privacy Policy

Monitors

BUSUP Schools App Privacy Policy

Last modified: August 2026.