Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

Tuk Tuk Lisbon
Rua das Janelas Verdes, 1200-692 Lisbon, Portugal
Email: info@tuktuk-lisbon.com
Phone: +351 934 028 252

For any questions regarding this Privacy Policy or your personal data, please contact us using the details above.

2. Scope

This policy applies to visitors and customers worldwide who use our website (tuktuk-lisbon.com and related domains), communicate with us via email, telephone, or WhatsApp, or book our vintage car and tuk tuk tour services.

Our services are operated from Portugal (European Union). If you are located outside the EEA, UK, or Switzerland, your data may be transferred to and processed in Portugal. We implement appropriate safeguards as described in Section 9.

3. Personal Data We Collect

We may collect the following categories of personal data, depending on how you interact with us:

• Identity and contact data: name, email address, telephone number, country of residence.
• Booking and communication data: tour preferences, dates, group size, messages sent via WhatsApp, email, or contact forms.
• Technical data: IP address, browser type, device information, language preference, pages visited, and referral source.
• Cookie and consent data: your cookie preferences and consent timestamp (see our Cookie Policy).
• Marketing data: your preferences for receiving promotional communications, where applicable.

4. How We Collect Data

We collect personal data when you: book or enquire about a tour via WhatsApp, email, or phone; browse our website; change your language preference; accept or manage cookie settings; or interact with us on social media platforms linked from our website.

We do not knowingly collect data from children under 16 without parental consent. Our services are not directed at children.

5. Legal Bases for Processing (GDPR Article 6)

We process your personal data only where we have a valid legal basis:

• Contract (Art. 6(1)(b)): to respond to booking enquiries, confirm reservations, and deliver tour services you request.
• Legitimate interests (Art. 6(1)(f)): to operate and improve our website, prevent fraud, ensure security, and analyse aggregated usage — balanced against your rights.
• Consent (Art. 6(1)(a)): for non-essential cookies, optional marketing communications, and any processing where consent is required by law. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to comply with tax, accounting, or regulatory requirements applicable in Portugal and the EU.

6. Purposes of Processing

We use your personal data to: provide and manage tour bookings; communicate with you before, during, and after your experience; process payments where applicable; improve our website and services; comply with legal obligations; and, with your consent, send promotional offers about our tours.

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Non-essential cookies are placed only after you give consent via our cookie banner. For full details, including cookie types, retention periods, and how to manage preferences, please read our Cookie Policy at /cookies-policy.

8. Data Sharing and Processors

We do not sell your personal data. We may share data with trusted third parties only where necessary:

• Hosting and infrastructure providers that store and deliver our website.
• Communication tools (e.g. WhatsApp/Meta, email providers) used to respond to your enquiries.
• Analytics providers, only if you accept non-essential cookies.
• Professional advisers (lawyers, accountants) bound by confidentiality.
• Public authorities when required by law.

9. International Data Transfers

Some third-party services we use (such as WhatsApp, Google Fonts, or social media platforms) may process data outside the European Economic Area. Where transfers occur, we rely on appropriate safeguards under GDPR Chapter V, including Standard Contractual Clauses, adequacy decisions, or your explicit consent where applicable.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Booking and customer records: up to 7 years after the tour date (for tax and legal compliance).
• Enquiry messages: up to 2 years unless a booking is made.
• Technical and cookie logs: as specified in our Cookie Policy.
• Marketing consent records: until you withdraw consent or object, plus a reasonable period to demonstrate compliance.

11. Your Rights Under GDPR

If you are in the EU/EEA, UK, or another jurisdiction with similar protections, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion in certain circumstances.
• Right to restriction of processing — request that we limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — at any time, without affecting prior lawful processing.
• Right to lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at info@tuktuk-lisbon.com. We may need to verify your identity before processing your request.

12. Supervisory Authority

In Portugal, the competent supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt | Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal.

If you believe your data protection rights have been violated, you may contact CNPD or the supervisory authority in your country of residence.

13. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include secure hosting, access controls, and staff training. No method of transmission over the Internet is 100% secure; we encourage you to use secure channels when sharing sensitive information.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top will indicate the latest revision. We encourage you to review this page periodically. Material changes may be communicated via our website or by email where appropriate.

15. Contact Us

For privacy-related requests, including exercising your GDPR rights, please contact us at info@tuktuk-lisbon.com or +351 934 028 252. We will respond within one month, as required by GDPR, and may extend by a further two months for complex requests with notice to you.