Privacy Policy

1. Introduction & Data Controller

Spot Madeira Travel (referred to as “Company”, “we”, “us”, or “our”) operates tourism excursions, guided day tours, and private transfers in Madeira Island under license RNAVT 11610 issued by Turismo de Portugal.

We respect your privacy and are committed to protecting the personal data of our customers, travelers, and website visitors (“you” or “your”). This Privacy Policy details how we collect, store, process, and safeguard your personal information when using our website spotmadeiratravel.pt or booking our travel services, in compliance with the General Data Protection Regulation (EU 2016/679 – GDPR) and Portuguese Law n.º 58/2019.

The designated Data Controller responsible for processing your personal information is:

2. Categories of Personal Data We Collect

We strictly collect personal data necessary to provide and manage our travel services, satisfy Portuguese statutory duties, and ensure passenger comfort and safety:

• Contact & Identity Details: Full name, email address, mobile telephone number reachable during your stay in Madeira (for WhatsApp/SMS pickup notifications), and communication language preference.
• Tax & Invoicing Information: Tax Identification Number (NIF/VAT) and billing address if an official tax invoice is requested.
• Booking & Logistics Details: Selected tour itineraries, dates, passenger count, pickup hotel or private address in Funchal/Madeira, cruise ship vessel name, and scheduled docking times.
• Passenger Composition & Child Ages: Ages of accompanying children to ensure the provision of legally certified child safety seats pursuant to Article 55 of the Portuguese Highway Code (Código da Estrada).
• Special Requests (Voluntary): Mobility restrictions or accessibility notes provided voluntarily by you to accommodate your excursion.
• Payment Data (Tokenized): We utilize certified, PCI-DSS Level 1 compliant third-party payment gateways (Stripe and PayPal). All credit/debit card data is entered into encrypted forms. Spot Madeira Travel never views, stores, or handles raw card numbers on its servers.
• Technical & Browsing Data: IP address, browser type, device information, and session logs collected via strictly necessary and analytical cookies.

3. Purposes and Legal Bases for Processing

In accordance with Article 6 of the GDPR, we process your information under lawful and clear legal grounds:

• Performance of a Contract (Art. 6(1)(b) GDPR): Confirming tour bookings, scheduling pickup times, communicating logistical updates, and delivering private or group excursions.
• Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Mandatory reporting of invoices to the Portuguese Tax and Customs Authority (Autoridade Tributária e Aduaneira – AT), maintaining statutory passenger insurance coverage as required by Portuguese Tourism Law (Decreto-Lei n.º 199/2012).
• Legitimate Interests (Art. 6(1)(f) GDPR): Ensuring website security, fraud mitigation, quality control, customer dispute handling, and service enhancements.
• Consent (Art. 6(1)(a) GDPR): Sending informational newsletters or promotional notices where you have voluntarily and explicitly opted in. Consent can be revoked at any time.

4. Sharing & Disclosure of Personal Data

Spot Madeira Travel will never sell, rent, or trade your personal information to third parties for marketing purposes. Data sharing is limited to trusted partners strictly necessary for executing your tour or complying with statutory duties:

• Assigned Chauffeurs & Guides: Provided strictly with the client’s name, phone number, and pickup location for the scheduled excursion day.
• Mandatory Insurance Providers: Submitting passenger information when required to activate statutory Civil Liability and Personal Accident coverage in case of an incident.
• Secure Payment Processors: Stripe Inc. and PayPal Inc. for transaction settlement.
• Public Authorities & Regulators: Portuguese Tax Authority (AT), Turismo de Portugal, or police/maritime authorities when required by enforceable law.
• IT Infrastructure & Hosting Partners: GDPR-compliant server hosts and cloud services operating under strict Data Processing Agreements (DPAs).

5. International Data Transfers

Your personal data is predominantly stored and processed on secure servers within the European Economic Area (EEA). If any technological sub-processors process data outside the EEA, transfers are executed under recognized legal safeguards, including European Commission Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework.

6. Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was gathered, or to comply with statutory fiscal obligations:

• Invoices & Financial Records: Retained for 10 years in compliance with the Portuguese Commercial Code and Corporate Income Tax Code (Código do IRC).
• Tour Booking & Operational Records: Retained for up to 3 years following excursion completion to address post-trip inquiries, claims, or insurance matters.
• Inquiries & Correspondence: Retained for up to 12 months following resolution of your query.
• Marketing Consents: Maintained until you opt out or request cancellation.

7. Technical & Data Security Measures

We deploy robust organizational and technological safeguards to prevent unauthorized data loss, manipulation, or disclosure:

• 256-bit SSL/TLS end-to-end transport encryption across all website pages;
• PCI-DSS Level 1 certified payment processing through encrypted tokenization;
• Strict role-based authentication limiting data access solely to authorized personnel;
• Daily encrypted backups and ongoing web application firewall monitoring.

8. Your Rights Under the GDPR

Under Chapter III of the GDPR and Portuguese Law n.º 58/2019, you are entitled to exercise the following fundamental rights:

• Right of Access (Art. 15): Obtain confirmation and copies of your personal data being processed.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete information promptly.
• Right to Erasure (Art. 17): Request deletion of your personal data when no longer needed for its initial purpose, subject to statutory 10-year tax retention laws.
• Right to Restriction (Art. 18): Request limits on processing under specific conditions.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent (Art. 7(3)): Revoke previously granted marketing consent at any time without retroactive detriment.

To exercise any of these rights, please email our privacy team at info@spotmadeiratravel.pt. Requests are fulfilled free of charge within 30 days.

9. Cookies & Tracking Technologies

Our website utilizes cookies to ensure platform stability, smooth navigation, and booking execution:

• Strictly Necessary Cookies: Essential for page navigation, session persistence, and secure checkout. Cannot be disabled without breaking website functionality.
• Analytical Cookies: Anonymized usage data (e.g. popular tour pages, loading speeds) used exclusively to improve user experience.
• Preference Cookies: Remember your language and regional settings.

You can manage or disable cookies at any time via your browser settings.

10. Supervisory Authority & Complaints

You have the legal right to submit a formal inquiry or lodge a complaint with Portugal’s national data protection authority if you consider that our processing violates data protection regulations:

11. Updates to this Policy

We may update this Privacy Policy periodically to reflect enhancements to our tours, infrastructure, or regulatory changes. The date of the most recent revision will always be displayed at the top of this document.

12. Contact Information