Privacy notice

Who is responsible

Douro Vintage Tours is a trading name of JB Douro Zoage Lda, NIF/NIPC 514379995, RNAAT 778/2017, with registered address at Rua Quinta do Santo 24 - Ferreiros, 5000-062 Vila Real, Portugal. Contact info@dourovintagetours.pt for privacy questions and rights requests, using “Privacy” in the subject.

Scope and information collected

This notice covers the website and journey enquiries. Hosting access and security records are separate from the details supplied in an enquiry.

When you use the enquiry service with sending enabled, we collect your name, email, intended dates, group size, stay, interests, message and any travel professional you identify. We record the reference, receipt time, source, follow-up status and privacy notice version. Required fields are marked; without the necessary information we may be unable to respond.

Do not include identity documents, payment details or health information. If additional information is needed for a booking, we will explain the purpose and appropriate channel. There is no solely automated decision producing legal or similarly significant effects.

Purposes and legal grounds

We handle a traveller’s enquiry and prepare a requested proposal as steps before entering a contract. We handle professional enquiries and coordinate services on the basis of our legitimate interests in responding to business requests, taking account of the people concerned. Security and prevention of spam, abuse and duplicate submissions also serve our legitimate interests in protecting the service.

Optional analytics and advertising measurement require a separate affirmative choice. Refusal does not prevent an enquiry. Legal obligations and, where necessary, the establishment, exercise or defence of legal claims may require limited retention. Acknowledging this notice is not consent to marketing and does not subscribe you to a mailing list. An enquiry is not a booking.

Staff, partners and service providers

Access is limited to authorised DVT staff and service providers according to their role. Our technical providers include Domínios.pt for hosting, Supabase for the platform and Cloudflare Turnstile for anti-abuse verification. Necessary information may be shared with the travel professional you identify, after checking their involvement, and with providers arranging your agreed journey. Naming an agency does not automatically give it access to your dossier or internal notes.

If information comes from an agency or another person, we provide the applicable privacy information, including its source. When providing someone else’s details, you must be entitled to do so and make this notice available to them.

When live verification is used, Turnstile processes technical signals such as IP address and browser information to detect abuse. Our integration does not send your enquiry fields to Turnstile. Cloudflare describes its processing in its Turnstile privacy notice. It loads only when live verification is requested.

International processing

Providers and travel partners may process information outside the European Economic Area. Where this is a restricted international transfer, DVT must use an applicable legal mechanism, such as an adequacy decision or appropriate safeguards, including standard contractual clauses where relevant. The appropriate mechanism depends on the recipient and processing involved; we do not claim all data remains in Portugal or the EU.

You may request information about the relevant safeguards and how to obtain a copy through our privacy contact. Provider arrangements are described in the Supabase data processing addendum and Cloudflare privacy documentation.

Retention by purpose

• Enquiries without a booking: review after 12 months from the last meaningful interaction; an ongoing future journey may justify documented further retention.
• Professional contacts: while needed for the relationship, with annual review and assessment after 24 months without interaction.
• Completed journeys: review unnecessary operational details 12 months after the journey; retain necessary contractual or fiscal evidence separately.
• Optional first-party analytics events: 90 days, followed by deletion or effective anonymisation.
• Security records: the ordinary operational limit is 30 days, with justified, restricted retention for a specific incident or legal obligation. Short-lived anti-abuse counters are cleared after two days.
• Backups: a rolling operational cycle of 30–90 days, with a normal maximum of 90 days. Exceptional preservation requires a documented security or legal need. Backups are restricted to recovery; restored data must respect previous erasure and restriction decisions.
• Fiscal and accounting records: generally 10 years where the applicable obligation requires it, subject to legal exceptions. This period does not apply indiscriminately to messages, preferences or photographs.

These are purpose-specific rules. Review may lead to erasure, effective anonymisation or restricted retention with a recorded reason and review date. It does not require deleting an entire dossier or information still necessary for another lawful purpose. The log and backup limits are DVT’s operational requirements, not a claim that every provider uses an identical technical cycle.

Optional measurement

Optional measurement is off by default. With consent, first-party measurement uses a random session identifier, limited page and form events and approved campaign values. Form contents are excluded. Google Analytics 4, provided by Google Ireland Limited / Google, is enabled in this website only after affirmative analytics consent. It measures fixed page and experience identifiers, form starts and confirmed enquiries. The tag is not loaded before consent. Enquiry contents and references, direct contact details, URL query strings and referrers are excluded from Google events. Google receives browser and connection information and pseudonymous analytics identifiers. Advertising storage, advertising user data and personalisation remain denied; no advertising tag or marketing audience is enabled. See Google’s privacy policy.

You can change or withdraw your choice through Analytics choices. Withdrawal applies to future processing and does not affect the lawfulness of earlier consent-based processing. See our cookies and measurement notice.

Your rights and our response

You may request access, correction, erasure, restriction and, where applicable, portability or objection. Send requests to info@dourovintagetours.pt. We record and assess each request, verify identity proportionately where needed and generally respond within one month of receipt. If a lawful extension of up to two further months is necessary, we explain the reasons within the first month.

Rights are subject to their legal conditions and the rights of others. You may complain directly to Portugal’s CNPD without contacting DVT first.

Updates

Effective date: 17 September 2026. Version: privacy-2026-09-17-v1; analytics clarification added 17 September 2026. We will communicate material changes appropriately. The version shown here is recorded with each enquiry submitted through the website.