Privacy Policy | Casta Tours

This Privacy Policy explains how Zebra Boemia, Lda, trading as Casta Tours ("we," "us," or "our"), collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Portuguese Law No. 58/2019 on personal data protection.

1. Data We Collect

We may collect the following personal data:

Identity & contact information — full name, email address, phone number, nationality, and country of residence, provided when you submit an inquiry, request a quote, or make a booking.
Booking details — tour preferences, dates, group size, special requirements (e.g., dietary needs, mobility considerations), and accommodation preferences.
Payment information — processed securely through our third-party payment provider. We do not store credit card numbers on our servers.
Communications — records of correspondence with us via email, contact forms, WhatsApp, or social media.
Technical data — IP address, browser type and version, device information, and browsing behavior on our website, collected automatically through cookies and similar technologies.

2. Legal Basis for Processing

We process your personal data on the following legal grounds under Article 6 of the GDPR:

Contract performance — processing necessary to fulfill your booking and deliver our tour services (Art. 6(1)(b)).
Legitimate interests — to improve our services, respond to inquiries, and ensure the security of our website (Art. 6(1)(f)).
Legal obligations — to comply with Portuguese tax, accounting, and regulatory requirements (Art. 6(1)(c)).
Consent — where you have opted in to receive marketing communications, which you may withdraw at any time (Art. 6(1)(a)).

3. How We Use Your Data

To process and manage your tour bookings and inquiries
To communicate with you about your reservations, including confirmations and updates
To provide customer support before, during, and after your experience
To send marketing communications where you have given consent
To improve our website, services, and customer experience
To comply with legal and regulatory obligations

4. Data Sharing & Third Parties

We may share your personal data with the following categories of recipients, solely to the extent necessary for the purposes described above:

Payment processors — to securely handle transactions.
Email service provider (Brevo/Sendinblue) — to send transactional and, where consented, marketing emails.
Tour partners & suppliers — local guides, transport providers, wine estates, and restaurants involved in delivering your tour, limited to the information necessary for service delivery.
Legal authorities — when required by Portuguese or EU law, or to protect our legal rights.

We do not sell or rent your personal data to third parties.

5. International Data Transfers

Your data is primarily processed and stored within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g., through third-party service providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, in accordance with Chapter V of the GDPR.

6. Data Retention

Booking and transaction records — retained for up to 10 years as required by Portuguese tax and accounting legislation.
Marketing contacts — retained until you withdraw consent or request deletion.
Inquiry data (no booking) — retained for up to 24 months from last contact, then securely deleted.
Website analytics data — retained in anonymized form for up to 26 months.

7. Cookies & Tracking Technologies

Our website uses cookies to:

Essential cookies — ensure the website functions correctly (no consent required).
Analytics cookies — help us understand how visitors interact with the site, using anonymized and aggregated data.

You can manage or disable cookies through your browser settings at any time. Disabling certain cookies may affect the functionality of the website.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted data transmission (SSL/TLS), access controls, and regular security reviews.

9. Your Rights Under GDPR

As a data subject, you have the following rights:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — request correction of inaccurate or incomplete data.
Right to erasure — request deletion of your data where there is no compelling reason for continued processing.
Right to restrict processing — request that we limit how we use your data in certain circumstances.
Right to data portability — receive your data in a structured, commonly used format.
Right to object — object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days of receiving your request.

10. Children's Privacy

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate parental consent, we will take steps to delete it promptly.

11. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Portuguese Data Protection Authority:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134 – 1.º, 1200-651 Lisbon, Portugal
Website: www.cnpd.pt

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be published on this page with a revised "Last Updated" date. We encourage you to review this page periodically.

Contact

For any privacy-related inquiries:
Email: [email protected]
Phone / WhatsApp: +351 917 906 444
Address: Rua de Chousais, 258, 4625-391 Marco de Canaveses, Portugal