Privacy Policy
Last updated: 9 November 2026
This policy explains how The Porter Tours handles personal data when you visit this website, request a quote or contact us. We collect only what we need to answer you and to provide the service you ask for. We do not sell your data and we do not use it for advertising.
1. Who is responsible for your data
The data controller is Alexandre Lopes, sole trader, NIF PT212632655, trading as The Porter Tours, Porto, Portugal (RNAAT no. 1095/2026).
- Email: info@theportertours.com
- Phone and WhatsApp: +351 927 432 299
We are not required to appoint a Data Protection Officer. For any question about your data, write to the email above.
2. What data we collect
Booking assistant. The transfer booking assistant at the top of the home page collects the details of your request in four steps: pick-up and drop-off, date and time (and the return, for a round trip), vehicle, passengers, luggage and extras, your first and last name, email, phone number, flight number if you give one, comments, your preferred payment method and your confirmation that you have read the Terms and Conditions and this policy. When you press Send booking request, this data is sent to our server, which emails it to us through our own email server (section 5). No payment is taken on the website. If sending fails, you can send the same summary by email or WhatsApp instead.
Tour and golf transfer request forms. The private tour form on the home page and the golf transfer form collect the details of your request, your name, your email address, your phone number and anything you write in the message box. For a tour, these are the tour, date, start time, pick-up point and number of passengers. For a golf transfer, they are the course, date, preferred tee time, an alternative date or time if you give one, pick-up address, number of players and of other passengers, whether you bring your clubs or rent them (and how many golf bags), other luggage, 9 or 18 holes, and whether you have a handicap certificate. We ask only whether you have one, not for the certificate itself. When you press the request button, this data is sent to our server, which emails it to us through our own email server (section 5). Nothing is sent to you by email automatically: we answer to the email address you gave us. No payment is taken. If sending fails, your email app opens with the same message ready to send. You can also use the WhatsApp button, which opens a chat with the message ready; what you send there reaches us only when you press send in WhatsApp.
Address suggestions. When you type at least three characters in a pick-up or address field (the booking assistant, the tour request form and the golf transfer form), the text you type is sent to Google as you type, with your IP address and browser details, so that Google can suggest places. In the tour request and golf transfer forms the field also works as plain text. In the booking assistant you choose one of the suggestions (unless your route is one of our listed fixed-price routes, or Google's suggestions are unavailable): when you do, the place you chose is sent to Google to get its position, and the coordinates are sent to Google's Routes API to calculate the distance and the tolls. What you type there stays with us only if you submit the form. Section 5 explains the details and how to object.
Which details are required. On both forms we need your name, your email address, the details of the trip (tour or course, date, time, pick-up and number of passengers or players) and your confirmation that you have read this policy. For golf transfers we also need your phone number, whether you bring your clubs (and how many golf bags) and the number of holes. Everything else is optional, including your phone number for tours. We need the required details to answer your request and prepare a quote. If you do not give them, we cannot send you a quote.
Email. When you write to us, we receive your email address, your name as it appears in your account and the content of your message and attachments.
WhatsApp. When you contact us on WhatsApp, we receive your phone number, your profile name and picture (depending on your privacy settings) and the messages you send.
During a service. To carry out a transfer or tour we may also need flight or train numbers, hotel names, the names of other passengers and information you choose to share about accessibility needs, mobility, dietary restrictions or the age and size of children (for child seats). We only ask for health related information when it is needed for your safety or comfort, and we use it only for that trip. If you give us details of other people, such as the names of fellow passengers, please let them know and point them to this policy.
Invoicing. If you book, we need the details required by Portuguese tax law to issue an invoice: name and, if you want it on the invoice, a tax number and address.
Technical data. To protect the request forms from abuse, our server briefly checks the IP address of each request against a limit on how many requests one address can send. The IP address is not included in the email we receive.
We do not collect data from children on purpose. Information about a child is provided by the parent or guardian making the booking.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your enquiry and preparing a quote | Steps taken at your request before entering into a contract, Art. 6(1)(b) |
| Confirming, organising and carrying out the transfer or tour | Performance of a contract, Art. 6(1)(b) |
| Passing the necessary details to a partner who operates your tour | Performance of a contract, Art. 6(1)(b) |
| Accessibility, mobility or dietary information you give us | Your explicit consent, Art. 9(2)(a), which you can withdraw at any time |
| Issuing invoices and keeping accounting records | Legal obligation, Art. 6(1)(c) |
| Handling complaints and defending legal claims | Legal obligation and our legitimate interest, Art. 6(1)(c) and (f) |
| Keeping the website secure and working, including limiting abuse of the request forms | Legitimate interest, Art. 6(1)(f) |
| Keeping a private copy of each request for 30 days, so that it is not lost if the email cannot be delivered | Legitimate interest, Art. 6(1)(f) |
| Suggesting addresses while you type in pick-up and address fields (Google Maps Platform) | Legitimate interest, Art. 6(1)(f) |
| Counting visits without cookies (Cloudflare Web Analytics) | Legitimate interest, Art. 6(1)(f) |
| Measuring how the website is used with Google Analytics cookies | Your consent, Art. 6(1)(a), which you can withdraw at any time |
We do not send newsletters or marketing messages. If this ever changes, we will ask for your consent first.
We do not use automated decision-making or profiling.
4. How long we keep your data
- Requests that do not turn into a booking: we review them once a year and delete those older than 12 months.
- Booking and trip details: until the service is completed and any questions or complaints are closed, and in any case no longer than 3 years after the service.
- Invoices and accounting records: 10 years, as required by Portuguese tax law.
- Accessibility, mobility or dietary information: deleted after the trip.
- Complaints: until the matter is closed and the legal limitation period has ended.
- Text typed in an address field: it stays with us only if you submit the form, and then it is kept as part of that request, for the periods above. Google receives the text as you type, whether or not you submit the form, and handles it under its own terms (section 5).
- Private copy of your request: what you send in a booking, tour or golf transfer form is also kept in a private database for 30 days, so that your request is not lost if the email cannot be delivered, and is then deleted. This is separate from the email and from our records, which follow the periods above.
- Emails containing your request: the email we receive is kept in our mailbox as part of the request and follows the periods above. When we delete it, we also empty it from the trash folder.
5. Who receives your data
We do not share your data except with the following recipients, and only as far as each one needs it:
- Our email service provider, a managed email provider that runs the mail server for theportertours.com. Based on the location of its IP address, the server is in Germany. It stores and delivers the messages you send us and our replies, on our instructions. When you send a booking, tour or golf transfer request, our website server passes it to this mail server as one email from info@theportertours.com to info@theportertours.com, with your email address written in the message and, where possible, set as the reply address so that we can answer you directly. The email contains everything in the request. For the booking assistant: addresses, date and time, vehicle, passengers, luggage and extras, name, email address, phone number, flight number, comments and preferred payment method. For the tour and golf transfer forms: the details listed in section 2, including your name, email address, phone number and message. The email is kept in our mailbox (section 4). We do not send you a copy by email.
- Google Analytics, only if you accept analytics cookies. Provider: Google Ireland Limited.
- Google Maps Platform (Google Ireland Limited). When you type at least three characters in a pick-up or address field (the booking assistant, the tour request form or the golf transfer form), the text is sent to Google as you type, with your IP address and browser details, so that Google can suggest places. In the booking assistant, when you choose a suggestion, the place is sent to Google to get its position, and the coordinates of the pick-up and drop-off are sent to Google's Routes API to calculate the driving distance and the tolls. In the booking assistant, Google's code is loaded as soon as you click or tab into an address field, which already shares your IP address and browser details with Google. In the tour request and golf transfer forms, nothing is sent to Google until you have typed three characters. Google decides how it uses this data and explains it in its Privacy Policy. Basis: our legitimate interest in helping you enter an accurate address, Art. 6(1)(f). To object, do not type the address in the field and send it to us by email or WhatsApp instead, or write to info@theportertours.com. The text stays with us only if you submit the form (section 4).
- Cloudflare, which hosts this website, runs the server code that receives your request, keeps the private copy of it described in section 4, and counts visits without cookies. Provider: Cloudflare, Inc.
- Our payment service providers, if you pay by card through a secure payment link or on the POS terminal in the vehicle. They receive your card details and the amount to process the payment, and handle them under their own terms and privacy policies.
- WhatsApp, if you contact us through it. Provider: WhatsApp Ireland Limited, part of Meta.
- Local partners, when a tour or transfer is operated by a partner. We share only what the partner needs to run the tour, such as names, number of passengers, date, meeting point and relevant needs. The partner then handles that data under its own responsibility and its own privacy policy, which we will point you to.
- Our certified accountant, for invoicing and tax compliance.
- Insurers, if an incident requires a claim under our mandatory insurance.
- Public authorities, when the law requires it.
6. Transfers outside the European Economic Area
Based on the location of its IP address, our email server is in Germany, within the European Economic Area, so sending your request to it is not a transfer outside the EEA. Google, Cloudflare and Meta may process data in the United States or other countries outside the European Economic Area, and all three take part in the EU-U.S. Data Privacy Framework. Google receives what you type in the address fields (section 5). Its terms provide Standard Contractual Clauses where the Framework does not apply. Where a payment service provider processes data outside the European Economic Area, it does so with the safeguards required by law. You can find more information in the Google Privacy Policy, the Cloudflare Privacy Policy and the WhatsApp Privacy Policy.
7. Cookies
Google Analytics (only with your consent). When you first visit, a banner asks whether we may use Google Analytics cookies. They are set only if you choose Accept. They tell us, in aggregate, which pages are visited, from which countries and websites visitors arrive, and whether they contact us by WhatsApp, phone, email or the request form. We do not use them for advertising, and Google signals and ad personalisation are turned off. The cookies are _ga and _ga_<ID>, kept for up to 2 years, and the data is kept in Google Analytics for 14 months.
Visit counts without cookies. Cloudflare Web Analytics counts visits without cookies and without identifying you, to keep the website working well.
Your choice. We remember your Accept or Decline choice in your browser's local storage, which is strictly necessary and needs no consent. You can change it at any time with the Cookie settings link at the bottom of every page. If you decline, the Google Analytics cookies are removed. We use no advertising or social media cookies.
8. Links to other services
Buttons that open WhatsApp or your email app take you to services run by other companies. Their own privacy policies apply once you use them.
9. Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where there is no legal reason for us to keep it;
- restrict how we use your data;
- object to processing based on our legitimate interest;
- receive the data you gave us in a common, machine readable format;
- withdraw consent at any time, without affecting what was done before.
To use any of these rights, write to info@theportertours.com. You can object to address suggestions at any time, as explained in section 5. We reply within one month. We may ask you to confirm your identity before we act on the request. The service is free.
10. Complaints to the supervisory authority
If you believe we have not handled your data correctly, please tell us first so we can put it right. You also have the right to complain to the Portuguese data protection authority:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
www.cnpd.pt
If you live in another EU country, you may also complain to the authority in your country.
11. Security
We protect your data with strong passwords, two-step verification on our accounts and access limited to the person responsible for the business. No system is completely secure, so please avoid sending documents or information we have not asked for.
12. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version.
13. Contact
The Porter Tours
info@theportertours.com
+351 927 432 299