Cookie & Privacy Policy

What to do in Portugal (hereinafter "we", "our" or "whattodoin.pt"), with registered office at Rua da Barroca 62B, 2705-532 São João das Lampas, NIF 229157319, represented by David Alexandre dos Santos Monteiro, operates the website www.whattodoin.pt (the "Site"). This Privacy Policy explains how we collect, use and protect your personal data in compliance with the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and applicable Portuguese law.

1. Data Controller

The data controller is What to do in Portugal, contactable at: info@whattodoin.pt or +351 911 542 421.

2. Personal Data Collected

We collect the following data:

• Identification information: name, email, phone, address (for tour and transfer bookings).
• Payment data: card details or transfers (processed by secure third parties like Stripe or Revolut).
• Usage data: IP, browser type, pages visited (via cookies and analytics).
• Contact data: travel preferences, tour dates.

This data is collected when you register an account, book services, subscribe to newsletters or interact with us.

3. Purposes and Legal Basis for Processing

We use the data for:

• Processing bookings and providing tourism services (basis: contract, art. 6(1)(b) GDPR).
• Sending newsletters and personalised offers (basis: consent, art. 6(1)(a) GDPR).
• Analysing site usage for improvements (basis: legitimate interests, art. 6(1)(f) GDPR).
• Complying with legal obligations (e.g., invoicing, art. 6(1)(c) GDPR).

4. Data Sharing

We do not sell data. We share with:

• Service providers (e.g., hotels, transfers, Google Analytics) under processing agreements.
• Authorities if required by law.

We do not transfer data outside the EEA without safeguards (e.g., Standard Contractual Clauses).

5. Storage and Security

We store data for as long as necessary: 5 years for bookings (tax obligations), until revocation for marketing. We use security measures like SSL encryption, firewalls and restricted access. After the period, data is deleted or anonymised.

6. Your Rights

As a data subject, you have the right to:

• Access, rectification, erasure ("right to be forgotten").
• Restriction, portability and objection to processing.
• Withdraw consent at any time.
• Complain to the CNPD (www.cnpd.pt).

Exercise your rights by emailing info@whattodoin.pt. We respond within 1 month.

7. Automated Decisions

We do not use automated decisions or profiling.

8. Cookies Policy

The Site uses cookies to improve your experience. Cookies are small files stored on your device.

Cookie Types:

• Essential: Necessary for functionality (e.g., login session). No consent required.
• Performance: Analyse traffic (e.g., Google Analytics). Basis: legitimate interests.
• Functionality: Remember preferences (e.g., language).
• Marketing: Personalised ads (e.g., Google Ads). Consent required.

You can manage cookies via the Site's consent banner or browser settings. For more details, see allaboutcookies.org. Third parties: Google Analytics, Facebook Pixel.

9. Minors

The Site is not directed at minors under 16 years. We do not process minors' data without parental consent.

10. Changes to This Policy

We will update this policy periodically. Check regularly. Significant changes will be notified by email or on the Site.

11. Contact

Questions? Contact: info@whattodoin.pt or Rua da Barroca 62B, 2705-532 São João das Lampas. Phone: +351 911 542 421.

For complaints: Comissão Nacional de Proteção de Dados (CNPD), Rua de São Bento, 536, 1249-018 Lisboa.