Privacy and Cookie Policy

1. What data we collect

We collect personal data through the two reservation forms on this site — one for boat tours, one for bike rentals. Neither takes payment online: you pay in person when you collect your tickets at our office or your bikes at the store.

• Full name
• Email address
• Phone number — required for bike reservations, optional for boat reservations
• Chosen tour, date and preferred departure time, and the number of adults, children and babies — boat reservations
• Store, bike type, date, pick-up and drop-off times, and the number of bikes and helmets — bike reservations

2. Bike reservations and WhatsApp

Bike rentals are reserved through the form on this site, and that reservation is stored in our database on the same terms as a boat reservation — the same retention period, and the same rights described below.

WhatsApp remains available for questions, but it is no longer how bike rentals are booked. Whatever you share in a WhatsApp conversation (such as your phone number and message content) stays within WhatsApp, governed by WhatsApp Ireland Ltd / Meta's own privacy policy, and isn't copied into a database of ours. The exception: if you arrange a booking with us there, our staff may record your name and phone number with that booking, as described below.

Our staff can also register a booking on your behalf — for example one you made through a partner booking platform or arranged with us on WhatsApp. In that case we may record your name and phone number with it, so we can contact you about that booking (for example if you don't arrive). We keep them only for as long as needed to process your reservation (see section 5) and erase or anonymize them on request.

3. Why we use your data, and on what legal basis

• To process and confirm your reservation request, including generating your confirmation code — basis: pre-contractual steps and performance of a contract (GDPR Art. 6(1)(b)).
• To contact you, if needed, about schedule changes or availability — same basis.
• To protect the internal admin area of the site against unauthorised access (for example, limiting repeated login attempts) — basis: legitimate interest in keeping the system secure (GDPR Art. 6(1)(f)).

4. Who we share data with

We do not sell or share your personal data with third parties for marketing or advertising purposes. Reservation data is stored on the server hosting the site, whose hosting provider acts only as a technical processor. We use Google Analytics 4 to understand how visitors use this site, but only after you accept this on the cookie banner shown on your first visit. If you don't accept, no analytics data is collected about your visit. Google may process this data outside the European Union. See Google's privacy policy for details.

Confirmation emails for your reservation are sent through Resend, our email delivery provider, which processes your name, email address and — for bike reservations — phone number for that purpose. Resend stores this data in the United States, outside the European Economic Area; this transfer is safeguarded primarily by EU Standard Contractual Clauses, with Resend's certification under the EU-U.S. Data Privacy Framework as an additional safeguard.

5. How long we keep your data

We retain your reservation details (name, contact information, and booking information) for as long as needed to process your reservation. You may request earlier deletion by contacting us.

6. Cookies and similar technologies

This site stores exactly one thing in your browser: your language preference (Portuguese/English/Spanish/French/Italian/German/Dutch/Korean), via local storage. That stays on your device, is never sent to us, and is strictly necessary for the site to work — it doesn't require your consent under Law 41/2004.

Our staff access an internal admin area through a login system that sets a strictly-necessary session cookie to keep that session active. This cookie is only set when a DURUS staff member logs in — never for ordinary site visitors.

This site uses Google Analytics 4, which sets cookies ("_ga", "_ga_0FZ7PTZSH5") to recognise you across visits — but only if you accept this on the cookie banner shown on your first visit. You can accept or reject it at any time via "Cookie settings" in the site's footer; rejecting means these cookies are never set, and accepting and later changing your mind deletes any cookies already set. Aside from that and your language preference, we don't use advertising or social-media cookies.

The "Open in Google Maps" button on the bikes page opens a new page on Google's own site — from that point on, Google's privacy and cookie policy applies, which we don't control. We don't embed Google Maps directly on our pages.

7. Your rights

Under the GDPR, you have the right to access your data, request its correction or deletion, request restriction of processing, object to processing, and request data portability. To exercise any of these rights, contact us at info@durusporto.pt.

You also have the right to lodge a complaint with Portugal's data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

8. Security

We use reasonable technical and organisational measures to protect your personal data against unauthorised access, loss or alteration.

9. Changes to this policy

We may update this policy from time to time, for example if we start using new tools on the site. The date at the top of this page shows the most recent version.