Privacy policy

Last updated: [TO BE FILLED IN: review date]

Who is responsible for your data

The controller is [TO BE FILLED IN: legal name], tax number (NIF) [TO BE FILLED IN: tax number (NIF)], [TO BE FILLED IN: address]. For any question about your data, write to parcerias@example.com.

What we collect and why

When you visit the site, we don't ask for any data and don't use tracking or advertising cookies (see the Cookie policy). The site host (Cloudflare) logs technical request data, such as the IP address, for security.

When you buy an itinerary, we collect:

• name and email, to send the itinerary, the confirmation and the invoice;
• tax number (NIF, optional), if you want it on the invoice;
• mobile number, only if you pay with MB WAY, to send the payment request;
• the itinerary bought, the amount, the payment method and status, the order dates and the times at which you accepted the terms and asked for immediate delivery;
• how many times the itinerary was downloaded.

To protect the checkout and the "request a new link" page from abuse, we keep request counters tied to a hash of the IP address, never the IP itself. If enabled, Cloudflare Turnstile checks that the request isn't coming from a bot.

We don't sell your data or use it for advertising. We don't make automated decisions or profiles.

Legal bases (article 6 GDPR)

• Performance of a contract (point b): processing the order, payment and delivery.
• Legal obligation (point c): issuing the invoice and keeping tax records.
• Legitimate interest (point f): site security and preventing fraud and abuse.

Processors

Your data is processed by these service providers, only for the purposes above:

• Cloudflare, Inc.: site hosting, server functions, order database (D1), PDF storage (R2), abuse protection and, if enabled, Turnstile.
• ifthenpay: processing MB WAY and Multibanco payments.
• Resend: sending purchase emails (confirmation and download link).
• Sanity: managing the site content (texts and photos). It receives no order data.

Some of these providers are based outside the European Economic Area (in the USA). In those cases the transfer relies on the EU-U.S. Data Privacy Framework or on standard contractual clauses approved by the European Commission.

Review: confirm each provider's data processing agreement (DPA), data region and the applicable transfer mechanism.

How long we keep data

• Order and invoice data: 10 years, the retention period for tax records.
• Abuse counters: deleted or replaced at the end of each counting window (minutes to hours).
• Sent emails: for Resend's retention period.
• Hosting technical logs: for Cloudflare's retention period.

Review: confirm the periods with the accountant and decide whether non-tax data (e.g. the MB WAY mobile number) should be deleted sooner.

Your rights

You can ask for access, rectification, erasure, restriction of processing and portability of your data, and object to processing based on legitimate interest. Write to parcerias@example.com. We reply within one month. Some data must be kept by law (e.g. invoice data) even if you ask for erasure.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or to the authority where you live.

Changes

If this policy changes, we'll publish the new version here with the update date.

The Portuguese version prevails in case of doubt.