Privacy Policy

1. Introduction

Portugal Tours Your Way is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal information when you interact with us — through our website, our online enquiry form, email, or WhatsApp.

This policy is written in compliance with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 and its implementing Portuguese legislation, Lei n.º 58/2019 de 8 de agosto.

Please read this policy carefully. By using our website or contacting us to enquire about or book a service, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

For any questions about how we handle your personal data, or to exercise any of your rights under GDPR, please contact us at the details above.

3. Personal Data We Collect

We only collect personal data that is necessary for the purposes described in this policy. The data we may hold about you includes:

We do not collect any special categories of personal data (such as health data, political opinions, or biometric data) unless you voluntarily share relevant health or mobility information in connection with a specific service requirement (e.g., wheelchair access), in which case it is processed solely to fulfil your request.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• To respond to enquiries — processing your contact form submission or WhatsApp message and providing you with a tailored tour or transfer proposal.
• To arrange and deliver your booking — planning your itinerary, coordinating pickup and logistics, and delivering the agreed service.
• To communicate with you — sending booking confirmations, pre-departure information, and any updates relating to your service.
• To process payments — arranging and recording payment transactions in connection with confirmed bookings.
• To comply with legal obligations — maintaining financial records as required by Portuguese tax and accounting law.
• To improve our services — using aggregate, anonymised feedback to improve our offering (no individual profiling).

We do not use your personal data for automated decision-making or profiling. We do not send marketing communications without your explicit consent.

5. Legal Basis for Processing

Under GDPR Article 6, we process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)) — Processing is necessary to fulfil a confirmed booking or to take steps at your request prior to entering into a contract (e.g., responding to a tour enquiry).
• Legitimate interests (Art. 6(1)(f)) — Processing is necessary for our legitimate business interests in operating as a tour company, including responding to enquiries and maintaining service records, where these interests are not overridden by your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — Processing is necessary to comply with applicable Portuguese and EU law, including financial record-keeping obligations.
• Consent (Art. 6(1)(a)) — Where we seek to contact you for purposes not related to a specific booking (e.g., future marketing), we will ask for your explicit consent. You may withdraw this consent at any time.

6. How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law:

• Enquiries that do not result in a booking — data is retained for up to 12 months from the date of the last communication, after which it is securely deleted.
• Confirmed bookings — booking records, correspondence, and financial documents are retained for 7 years from the service date, as required under Portuguese accounting and tax law (Código do IVA and Código do IRC).
• WhatsApp messages — retained within the WhatsApp platform subject to WhatsApp's own data retention policies. We may retain relevant booking confirmations in our own records for the periods stated above.

After the applicable retention period, personal data is securely deleted or anonymised.

7. Sharing Your Personal Data

We do not sell, rent, or trade your personal data with third parties for marketing purposes. We will never share your data with other tour companies or travel agencies.

We may share limited personal data with the following categories of third parties, only to the extent necessary to deliver our services:

• Web3Forms (web3forms.com) — our contact form provider, which processes form submissions on our behalf to deliver enquiry data to our email. Their privacy policy governs how they process this data.
• WhatsApp / Meta Platforms — as the messaging platform we use to communicate with clients. WhatsApp is governed by Meta's Privacy Policy and processes message data as part of the service infrastructure.
• Google (Gmail) — as our email provider, which may process email content as part of delivering email services.
• Payment service providers — to the extent required to process agreed payments (e.g., PayPal, bank transfer processors), these services operate under their own data protection policies.
• Legal and regulatory authorities — where we are required by law to disclose information to competent authorities (e.g., tax authorities, courts).

8. International Data Transfers

As a company based in Portugal (EU), our primary data processing takes place within the European Economic Area (EEA). However, some of the third-party services we use — in particular WhatsApp/Meta and Google — may transfer or process personal data outside the EEA.

Where such transfers occur, they are governed by:

• EU Standard Contractual Clauses (SCCs) approved by the European Commission; or
• An adequacy decision by the European Commission in respect of the destination country; or
• Other appropriate safeguards as required by Chapter V of the GDPR.

We recommend reviewing the privacy policies of WhatsApp (whatsapp.com) and Google (policies.google.com) for more information on how they manage international data transfers.

9. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights in relation to your personal data. You can exercise these rights at any time by contacting us at Portugaltoursyourway@gmail.com.

We will respond to all valid requests within one month of receipt, as required by GDPR Article 12. In complex cases, this may be extended by a further two months, of which you will be informed.

You also have the right to lodge a complaint with the Portuguese data protection supervisory authority at any time:

10. Cookies & Tracking

Our website is a static HTML website. We do not use:

• Tracking or analytics cookies (e.g., Google Analytics)
• Advertising or retargeting cookies
• Third-party social media tracking pixels
• Session cookies beyond those technically required for page function

The only external resources loaded by our website are:

• Google Fonts — font files loaded from Google's CDN. Google may log the request (including your IP address) as part of CDN operation. See Google's Privacy Policy.
• Font Awesome — icon fonts loaded from Cloudflare's CDN (cdnjs.cloudflare.com). Cloudflare processes this as part of CDN delivery.
• Web3Forms — our contact form service makes an API call to web3forms.com when you submit an enquiry form.
• Flag CDN — national flag images loaded from flagcdn.com for the language selector.

None of these services place persistent tracking cookies on your device in connection with our website. If you have concerns about any of the above, we recommend reviewing the respective privacy policies linked in Section 7.

11. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. These measures include:

• Access to personal data is restricted to authorised personnel only.
• All email communications are transmitted over encrypted connections (TLS).
• WhatsApp communications are end-to-end encrypted by default.
• We do not store payment card details — payment processing is handled by regulated third-party payment services.

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the CNPD within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay, as required by GDPR Article 33 and 34.

12. Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data without appropriate parental consent, please contact us immediately at Portugaltoursyourway@gmail.com and we will take steps to delete the information promptly.

Children under 16 may travel with us as part of a family group — in this context, the data controller is the adult making the booking on behalf of the group.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or third-party services. The updated version will always be published on this page with the date of last revision shown at the top.

For significant changes that materially affect how we use your data, we will take reasonable steps to notify you directly (e.g., by email if we hold your contact details).

We encourage you to review this policy periodically to stay informed about how we protect your data.

14. Contact Us & Data Requests

To exercise any of your GDPR rights, to ask a question about this policy, or to report a data protection concern, please contact us:

If you are not satisfied with our response, you have the right to complain to the CNPD at www.cnpd.pt.