Privacy Policy

Last updated: April 2026

1. Who We Are

Arrábida Untold is operated by Segmentrevelation – Consulting – Unipessoal, Lda, a company incorporated in Portugal under NIF 514534877, operating under Tourism Animation Operator license RNAAT 375/2010, issued by Turismo de Portugal.

Registered address: Porto de Abrigo de Sesimbra, Sesimbra, Portugal.

Contact for data protection matters: concierge@arrabidauntold.com

2. Data We Collect

We collect personal data in the following circumstances:

2.1 Data you provide directly

Name, email address, telephone number

Number of participants and occasion details (for experience planning)

Payment information (processed securely by our payment provider — we do not store card data)

Any information you share via our AI concierge, contact form, or enquiry form

Correspondence by email or other channels

2.2 Data collected automatically

IP address, browser type, device identifiers

Pages visited, time on site, referral source (via cookies and analytics tools)

Session data from our AI concierge (conversation history linked to your session)

2.3 Data from third parties

Booking or referral information received from travel agents or partner platforms

3. How We Use Your Data

We process your personal data for the following purposes:

To respond to enquiries and plan your experience

To process bookings, payments, and issue confirmations

To send you your booking plan by email (if requested via our concierge)

To send transactional communications relating to your booking

To send our newsletter, if you have subscribed (you may unsubscribe at any time)

To comply with legal obligations (tax, consumer protection, insurance)

To improve our website and services (analytics)

To defend our legal rights in the event of a dispute

4. Legal Basis for Processing

We rely on the following legal bases under the GDPR (Regulation EU 2016/679) and Lei 58/2019:

Contract performance (Art. 6(1)(b)) — processing necessary to fulfil your booking or to take pre-contractual steps at your request

Legal obligation (Art. 6(1)(c)) — tax records, insurance documentation, consumer rights compliance

Legitimate interests (Art. 6(1)(f)) — fraud prevention, security, improving our services

Consent (Art. 6(1)(a)) — newsletter subscription; you may withdraw consent at any time without affecting prior processing

5. Third-Party Processors

We share your data only with trusted processors strictly as necessary:

Shopify Inc. (USA) — our e-commerce platform; data processed under standard contractual clauses and Shopify’s Data Processing Agreement

Resend Inc. — transactional email delivery

Cloudflare, Inc. — website infrastructure and AI concierge backend

Supabase, Inc. — database for conversation and lead storage (AI concierge)

Google LLC — analytics and workspace tools

Discord Inc. — internal notifications (no personal data beyond booking reference and first name)

All processors are bound by contractual obligations ensuring GDPR-equivalent protection. Where processors are based outside the EEA, appropriate safeguards (Standard Contractual Clauses or adequacy decisions) are in place.

6. Retention

Booking and financial records: 10 years (Portuguese tax law obligations — CIVA Art. 52)

Insurance and liability records: 5 years after the activity date

AI concierge conversations: 90 days, then anonymised

Newsletter subscribers: until unsubscription plus 30 days

Website analytics: 26 months (aggregated; no individual tracking beyond this period)

Enquiry data (non-converted): 12 months

7. Your Rights

Under GDPR and Lei 58/2019, you have the following rights:

Right of access — to obtain a copy of your personal data

Right of rectification — to correct inaccurate data

Right of erasure (“right to be forgotten”) — subject to legal retention obligations

Right to restriction of processing

Right to data portability

Right to object to processing based on legitimate interests

Right to withdraw consent at any time (where processing is consent-based)

To exercise any of these rights, please contact us at: concierge@arrabidauntold.com. We will respond within 30 days. If you consider that your rights have not been respected, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) at www.cnpd.pt.

8. Cookies

Our website uses cookies and similar technologies. These include:

Strictly necessary cookies — required for the website to function (session management, security)

Analytics cookies — to understand how visitors interact with our site (we use aggregated, anonymised data)

Preference cookies — to remember your language and consent choices

You may manage cookie preferences via our cookie banner or your browser settings. Blocking strictly necessary cookies may affect site functionality.

9. Photography and Image Rights

During activities, our team may take photographs or video for documentation and promotional purposes. By participating, you consent to the use of such images in our communications, website, and social media, unless you inform our team member before the activity that you do not wish to be photographed.

No images will be sold to third parties. To withdraw consent for images already published, contact concierge@arrabidauntold.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated version on our website with a new “last updated” date. For active bookings, we will also notify you by email if changes affect how we process your data.

11. Contact

Data controller: Segmentrevelation – Consulting – Unipessoal, Lda

NIF: 514534877

Email: concierge@arrabidauntold.com

Address: Porto de Abrigo de Sesimbra, Sesimbra, Portugal