Privacy Policy
Last updated: 2026
This policy explains how The Porter Tours handles personal data when you visit this website, request a quote or contact us. We collect only what we need to answer you and to provide the service you ask for. We do not sell your data and we do not use it for advertising.
1. Who is responsible for your data
The data controller is The Porter Tours, Porto, Portugal.
- Email: [email protected]
- Phone and WhatsApp: +351 927 432 299
We are not required to appoint a Data Protection Officer. For any question about your data, write to the email above.
2. What data we collect
Quote request form. When you use the request form on our website, you choose how to send it: by email, which opens a message addressed to us in your email app, or by WhatsApp, which opens a chat with the message ready. The message carries the details you entered: service, date, time, pick-up point, drop-off point and number of passengers. When you send it, we also receive your name, your email address or phone number, and anything else you write in the message. The website itself does not store or send this data. It reaches us only when you press send in your own email app or in WhatsApp.
Email. When you write to us, we receive your email address, your name as it appears in your account and the content of your message and attachments.
WhatsApp. When you contact us on WhatsApp, we receive your phone number, your profile name and picture (depending on your privacy settings) and the messages you send.
During a service. To carry out a transfer or tour we may also need flight or train numbers, hotel names, the names of other passengers and information you choose to share about accessibility needs, mobility, dietary restrictions or the age and size of children (for child seats). We only ask for health related information when it is needed for your safety or comfort, and we use it only for that trip.
Invoicing. If you book, we need the details required by Portuguese tax law to issue an invoice: name and, if you want it on the invoice, a tax number and address.
We do not collect data from children on purpose. Information about a child is provided by the parent or guardian making the booking.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your enquiry and preparing a quote | Steps taken at your request before entering into a contract, Art. 6(1)(b) |
| Confirming, organising and carrying out the transfer or tour | Performance of a contract, Art. 6(1)(b) |
| Passing the necessary details to a partner who operates your tour | Performance of a contract, Art. 6(1)(b) |
| Accessibility, mobility or dietary information you give us | Your explicit consent, Art. 9(2)(a), which you can withdraw at any time |
| Issuing invoices and keeping accounting records | Legal obligation, Art. 6(1)(c) |
| Handling complaints and defending legal claims | Legal obligation and our legitimate interest, Art. 6(1)(c) and (f) |
| Keeping the website secure and working | Legitimate interest, Art. 6(1)(f) |
We do not send newsletters or marketing messages. If this ever changes, we will ask for your consent first.
4. How long we keep your data
- Quote requests that do not turn into a booking: 12 months after our last contact, then deleted.
- Booking and trip details: until the service is completed and any questions or complaints are closed, and in any case no longer than 3 years after the service.
- Invoices and accounting records: 10 years, as required by Portuguese tax law.
- Accessibility, mobility or dietary information: deleted after the trip.
- Complaints: until the matter is closed and the legal limitation period has ended.
5. Who receives your data
We do not share your data except with the following recipients, and only as far as each one needs it:
- Google (Gmail and Google Workspace services), which hosts our email. Provider: Google Ireland Limited.
- WhatsApp, if you contact us through it. Provider: WhatsApp Ireland Limited, part of Meta.
- Local partners, when a tour or transfer is operated by a partner. We share only what the partner needs to run the tour, such as names, number of passengers, date, meeting point and relevant needs. The partner then handles that data under its own responsibility and its own privacy policy, which we will point you to.
- Our certified accountant, for invoicing and tax compliance.
- Insurers, if an incident requires a claim under our mandatory insurance.
- Public authorities, when the law requires it.
6. Transfers outside the European Economic Area
Google and Meta may process data in the United States or other countries outside the European Economic Area. Both companies take part in the EU-U.S. Data Privacy Framework and also use the Standard Contractual Clauses approved by the European Commission. You can find more information in the Google Privacy Policy and the WhatsApp Privacy Policy.
7. Cookies
This website does not use cookies for tracking, analytics or advertising, and does not set cookies of its own.
8. Links to other services
Buttons that open WhatsApp or your email app take you to services run by other companies. Their own privacy policies apply once you use them.
9. Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where there is no legal reason for us to keep it;
- restrict how we use your data;
- object to processing based on our legitimate interest;
- receive the data you gave us in a common, machine readable format;
- withdraw consent at any time, without affecting what was done before.
To use any of these rights, write to [email protected]. We reply within one month. We may ask you to confirm your identity before we act on the request. The service is free.
10. Complaints to the supervisory authority
If you believe we have not handled your data correctly, please tell us first so we can put it right. You also have the right to complain to the Portuguese data protection authority:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
www.cnpd.pt
If you live in another EU country, you may also complain to the authority in your country.
11. Security
We protect your data with strong passwords, two-step verification on our accounts and access limited to the person responsible for the business. No system is completely secure, so please avoid sending documents or information we have not asked for.
12. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version.
13. Contact
The Porter Tours
[email protected]
+351 927 432 299