Legal

PRIVACY POLICY

Last updated · July 2026

Your privacy matters to us. This policy explains what personal data we collect when you visit our site or book a tour, how we use it and what rights you have.

1. DATA CONTROLLER

Lusitano Journeys, Lda. ("we", "us"), with registered office at Rua da Estrada 1, 1200-000 Lisbon, Portugal, is the controller responsible for processing personal data collected through this website, booking forms and customer communications.

For any privacy-related enquiry you can contact us at ride@lusitanojourneys.pt

2. DATA WE COLLECT

Account & booking data: full name, email, phone number, country of residence, date of birth, motorcycle licence number and years of experience, emergency contact and dietary or medical notes you choose to share.

Payment data: billing address and transaction reference. Card details are handled exclusively by our PCI-DSS certified payment providers (Stripe / PayPal) — we never see or store full card numbers.

Technical data: IP address, browser type, device information, pages visited and referral source, collected through cookies and analytics tools.

3. HOW WE USE YOUR DATA

To manage your bookings, issue invoices and provide the tour and related services you have purchased.

To communicate with you before, during and after the tour (logistics, safety briefings, feedback requests).

To comply with our legal, accounting and tax obligations under Portuguese and EU law.

With your explicit consent, to send you our newsletter with upcoming tours, stories and offers. You can withdraw consent at any time from any newsletter footer.

To improve our website and services through aggregated, anonymised analytics.

4. LEGAL BASIS

We process your data under the following legal bases (GDPR art. 6): performance of a contract (bookings), compliance with a legal obligation (tax and safety records), your consent (marketing and non-essential cookies) and our legitimate interest (site security and service improvement).

5. SHARING WITH THIRD PARTIES

We only share your data with trusted providers strictly necessary to deliver our service: payment processors (Stripe, PayPal), booking and CRM software, email delivery, insurance partners for the tour, and hotels or transfer providers involved in your itinerary.

Every provider is bound by a data-processing agreement and may only use your data on our instructions. We never sell your personal data.

6. INTERNATIONAL TRANSFERS

Some of our providers may process data outside the European Economic Area. In such cases we rely on the European Commission Standard Contractual Clauses or an adequacy decision to guarantee an equivalent level of protection.

7. RETENTION

Booking and invoicing data: 10 years, as required by Portuguese tax law.
Account data: for as long as your account is active, plus 2 years of inactivity.
Marketing data: until you withdraw your consent.
Website analytics: up to 14 months in anonymised form.

8. YOUR RIGHTS

You have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to receive it in a portable format. You may exercise these rights at any time by writing to ride@lusitanojourneys.pt.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority CNPD — www.cnpd.pt

9. COOKIES

We use strictly necessary cookies to run the site and booking flow, and analytics cookies (anonymised) to understand aggregated visitor behaviour. Non-essential cookies are only set after your consent, which you can manage from the cookie banner shown on your first visit.

10. SECURITY

We apply technical and organisational measures to protect your data against unauthorised access, loss or alteration, including TLS encryption in transit, restricted access to production systems and regular backups.

11. CHANGES TO THIS POLICY

We may update this policy to reflect changes in our services or legal obligations. The current version is always available on this page with the "Last updated" date below.

12. CONTACT