Privacy Policy

Privacy Policy
Last updated: September 2026

1. Data Controller Identification

The data controller is:

ANA SORAIA CAMPOS, UNIPESSOAL LDA
Company Registration No. (NIF/NIPC): 519 502 531
RNAVT (Portuguese Travel Agency Registry): 13577
Civil Liability Insurance: Allianz — Policy No. 20 90 22 98 6
Address: Rua António Botto, n.º 2, 2855-411 Corroios, Portugal
Email: info@portugalelegance.pt
Phone: +351 937 211 227
Website: www.portugalelegance.pt

For any questions regarding this Privacy Policy or the processing of your personal data, please contact us using the details above.

2. Personal Data We Collect

We may collect the following categories of personal data:

• Full name;
• email address;
• phone number;
• country of residence;
• preferred date for the experience;
• number of participants;
• message, preferences and request details;
• data necessary for booking, organising and delivering the experience;
• billing data, including address and tax identification number, where applicable;
• data relating to dietary requirements, accessibility needs or other information voluntarily provided by the client;
• communications with us via email, phone, form, WhatsApp or other channels;
• IP address, device type, browser, pages visited and other technical data collected through cookies or similar technologies.

Please do not send us personal data that is not necessary for the provision of the service.

Where a booking includes other people, the person making the booking must ensure they are authorised to provide the relevant data and have informed those individuals of this Privacy Policy.

3. How Data Is Collected

Personal data may be collected:

• through the website’s contact or booking form;
• by email, phone, WhatsApp or social media;
• during the booking, contracting or delivery of the experience;
• through tour operators, agencies, accommodation providers or other partners referring a booking;
• automatically, while using the website, through cookies and similar technologies.

Where data is not collected directly from the data subject, we will endeavour to provide the legally required information within the timeframes set out in the GDPR.

4. Purposes and Legal Bases

We process your personal data for the following purposes:

4.1. Responding to enquiries

We use your data to respond to questions, contact requests and quote requests. This processing is based on pre-contractual steps taken at the data subject’s request or, where applicable, on our legitimate interest in responding to communications addressed to us.

4.2. Managing bookings and delivering experiences

We use the data to: process and confirm bookings; organise and deliver the contracted experience; communicate changes, instructions or relevant information; provide support before, during and after the experience; manage payments, cancellations or refunds. This processing is necessary for the performance of the contract or for pre-contractual steps requested by the client.

4.3. Billing and legal compliance

Data may be processed to issue invoices, maintain accounting and tax records, and comply with other legal obligations. This processing is based on the company’s legal obligations.

4.4. Complaint handling and defence of rights

We may retain and process data necessary to handle complaints, prevent fraud, and exercise or defend rights in judicial, administrative or extrajudicial proceedings. This processing is based on legal obligations and on our legitimate interest in protecting and defending our rights.

4.5. Website security and operation

We may process technical data to ensure the security, availability and proper functioning of the website, prevent misuse and diagnose technical issues. This processing is based on our legitimate interest in keeping the website secure and operational.

4.6. Non-essential cookies

Where we use analytics, advertising or other non-essential cookies, processing will be based on your consent. Consent may be refused or withdrawn at any time via the cookie preference management tool available on the website.

5. Special Category Data

Certain information, such as allergies, health-related dietary restrictions, reduced mobility or medical needs, may constitute special category data. This data will only be requested and processed when necessary to adapt or safely deliver the service, and where an appropriate legal basis exists, namely the data subject’s explicit consent. Providing this information is voluntary. Please only share data that is strictly necessary.

6. Whether Providing Data Is Mandatory

Fields marked as mandatory on forms are necessary to respond to your request or process your booking. If you do not provide this data, we may be unable to respond to your request, confirm your booking, or deliver the requested experience. Providing other data is optional.

7. Sharing of Personal Data

Your personal data may be shared, strictly as necessary, with: tour operators; guides, drivers and transport companies; restaurants, accommodation providers and experience providers; booking platforms; payment service providers; website hosting, maintenance and security providers; email, communications and data storage providers; accountants, consultants, insurers and other professional service providers; administrative, tax, police or judicial authorities, where legally required.

Partners directly involved in the experience receive only the data necessary to deliver the requested service. Where providers process data on our behalf, we seek to ensure they are subject to appropriate confidentiality, security and data protection obligations. We do not sell or transfer your personal data to third parties for commercial purposes.

8. International Data Transfers

Some technology providers or platforms used by Portugal Elegance may store or process personal data outside the European Economic Area. Where this occurs, we will seek to ensure the transfer is based on: a European Commission adequacy decision; standard contractual clauses approved by the European Commission; or another mechanism legally permitted under the GDPR. You may request further information about these transfers and the applicable safeguards via info@portugalelegance.pt.

9. Data Retention

Personal data is retained only for as long as necessary for the purposes that justified its collection. As general criteria: enquiries that do not result in a booking will be retained for as long as necessary for follow-up and, as a rule, for up to 12 months after the last communication; data relating to bookings and service delivery will be retained for the duration of the contractual relationship and subsequently for applicable statute-of-limitations periods; accounting, tax and billing records will be retained for the period required by law; data processed on the basis of consent will be retained until consent is withdrawn or until no longer necessary; technical and security logs will be retained for as long as necessary to ensure the security and operation of the website; data necessary for complaint handling or the defence of rights may be retained until the end of the applicable legal deadlines.

At the end of the relevant periods, data will be securely deleted or anonymised, unless retention is required by law.

10. Data Subject Rights

Under the GDPR, and subject to applicable legal conditions, you may exercise the following rights: right of access to your personal data; right to rectify inaccurate or incomplete data; right to erasure; right to restriction of processing; right to object to processing; right to data portability; right to withdraw consent at any time; right not to be subject to a decision based solely on automated processing that produces legal effects or significantly affects you.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. The exercise of these rights may be subject to legal limitations. For example, certain data may need to be retained to comply with tax or accounting obligations, or for the defence of rights.

To exercise any of these rights, send your request to: info@portugalelegance.pt

We may request additional information strictly necessary to confirm the identity of the requester. Requests will be handled within the legally applicable timeframes.

11. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority:

Comissão Nacional de Proteção de Dados — CNPD
Avenida D. Carlos I, n.º 134, 1.º
1200-651 Lisbon, Portugal
Website: www.cnpd.pt

We recommend contacting us first so that we may seek to resolve any issue relating to your personal data directly.

12. Automated Decision-Making

We do not use personal data to make solely automated decisions, including profiling, that produce legal effects or significantly affect the data subject. Should this situation change, data subjects will be informed in advance as legally required.

13. Cookies

The website uses cookies strictly necessary for its operation and may, subject to consent, use analytics, functional or third-party cookies. Non-essential cookies will not be installed without the user’s prior consent. Users may accept, refuse or change their preferences via the cookie management tool available on the website. For information on the cookies used, their providers, purposes and duration, please consult our Cookie Policy.

14. Data Security

We adopt technical and organisational measures appropriate to the risk to protect personal data against loss, destruction, alteration, unauthorised disclosure or access. Despite the measures adopted, no electronic transmission or storage system is completely secure. Should a personal data breach occur that is likely to pose a risk to the rights of data subjects, we will comply with the legal obligations regarding assessment, documentation and notification.

15. Links to Third-Party Websites

The website may contain links to websites, platforms or services operated by third parties. This Privacy Policy does not apply to processing carried out directly by those entities. We recommend reviewing their respective privacy policies before providing personal data.

16. Changes to the Purpose of Processing

Should we intend to use personal data for a purpose other than that for which it was collected, we will provide the data subject with prior information about the new purpose and any other legally required details.

17. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect legal, technical or service-related changes. The updated version will be published on this page, indicating the date of the last update. Where changes are significant, we may use other appropriate means to inform data subjects.