Privacy Policy

This Privacy Policy applies to the personal data processed by Category Itinerary, Lda, with registered office at Avenida do Bocage, N.º 61, 3.º Dto, 2830-001 Barreiro, Tax ID 514844604, phone 968 728 723, email reservas@viptours.pt, registered with the Portuguese National Register of Tourism Entertainment Agents (RNAAT) under no. 1290/2018 (hereinafter “viptours” or “the Operator”).

• Booking data: name, email, phone, pickup address, group size, preferred language, additional notes.
• Payment data: processed by our payment provider; we never store full card numbers.
• Geolocation: during the tour, the audio guide uses your device GPS to detect stops. The data stays on your device — it is not transmitted to us.
• Technical logs: IP address, timestamp, browser — for security and abuse prevention.

• Performance of the tourism services contract (Art. 6(1)(b) GDPR): booking management, customer communication, tour delivery, invoicing.
• Legal obligations (Art. 6(1)(c) GDPR): retention of accounting records, tourism-activity (RNAAT) regulatory compliance.
• Legitimate interest (Art. 6(1)(f) GDPR): site security, fraud prevention, rate-limiting.
• Consent (Art. 6(1)(a) GDPR): marketing communications when applicable.

• Booking data: duration of the service + 5 years for tax purposes.
• Accounting documents: 10 years (Portuguese VAT Code).
• Technical logs: 90 days.
• Marketing communications: until consent is withdrawn.

We share strictly necessary data with the following sub-processors, all bound by GDPR-compliant data processing agreements:

• Supabase (Singapore/Ireland) — database hosting
• Vercel Inc. (USA, EU SCCs) — website hosting
• Resend (USA/EU) — transactional emails
• ElevenLabs (USA) — voice synthesis (text only, no personal data)

Under GDPR Articles 15–22, you have the right to:

• Access your data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time (without affecting the lawfulness of prior processing)

To exercise these rights, contact us at reservas@viptours.pt. We respond within 30 days.

You have the right to lodge a complaint with the Portuguese Data Protection Authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt.

We only use strictly necessary cookies: admin session and language preference. No marketing, advertising or behavioural tracking cookies.

We may update this policy periodically. The current version is always available at viptours.pt/privacy. Material changes will be emailed to active customers.