Privacy Policy

Last updated · October 2026

Data Controller

The controller of your personal data is Hugo José Vale da Silva, sole trader, tax ID 254 220 703, trading as Green Odyssey – Private Tour Experience® (RNAAT no. 1084/2024), with registered address at Rua Manuel Guedes 93, Monção, Portugal.

You can contact us about any privacy matter at info@greenodyssey.pt or by phone at +351 918 595 798. This policy applies to the website greenodyssey.pt and to the personal data we collect when you contact us, book or take part in one of our tours.

Personal Data We Collect

Depending on how you interact with us, we may collect:

  • Identification and contact details: full name, date of birth and passport or ID card number of participants (required by our insurer), email address, phone number and WhatsApp number;
  • Booking details: tour date and pick-up place, accommodation, number of guests, country of origin and language;
  • Invoicing details: name, address and tax number when you ask for an invoice with a tax number;
  • Information you choose to share to personalise your tour, such as dietary requirements, allergies, mobility needs or preferences. Some of this may be health related, and we only use it to adapt the experience, with your consent;
  • Photographs and videos taken during the tours, when you agree to it;
  • Technical data, such as device, browser and pages visited, collected through cookies only if you accept them (see our Cookies Policy).

We do not store bank card data. Payments are made by bank transfer or MB Way and are processed by your bank and the payment service provider.

We collect this data through the contact and booking forms on the website, by email, phone and WhatsApp, through social media messages, and from travel agencies that book on your behalf.

Purposes and Legal Basis

We process your data for the following purposes, each with its own legal basis under the General Data Protection Regulation (GDPR):

  • Managing bookings and delivering the tour (reservations, confirmations, pick-up, communication before, during and after the experience): performance of the contract or steps requested by you before the contract (Article 6(1)(b));
  • Answering your enquiries: steps before a contract and our legitimate interest in replying (Article 6(1)(b) and (f));
  • Invoicing, accounting and tax obligations: legal obligation (Article 6(1)(c));
  • Personal accident insurance and other legal requirements of tourist activity: legal obligation and performance of the contract (Article 6(1)(b) and (c));
  • Dietary, allergy or health related information you give us: your explicit consent (Article 9(2)(a)), which you may withdraw at any time;
  • Newsletters and promotional messages: your consent (Article 6(1)(a));
  • Using your photographs and videos to promote our work: your consent (Article 6(1)(a));
  • Website statistics cookies: your consent (Article 6(1)(a)), given through our cookie banner;
  • Website security and improving our service: our legitimate interest (Article 6(1)(f)).

We do not take decisions based solely on automated processing and we do not sell your data.

Who Receives Your Data

We share your data only when needed and only with:

  • Local partners that take part in your tour, such as wine estates, restaurants and venues, limited to your name, number of guests and any dietary needs;
  • Our insurer (Generali Tranquilidade), which receives participants' details for the personal accident insurance;
  • Travel agencies and tour operators that book on your behalf. They are independent controllers of the data they hold about you;
  • Our accountant and the tax authorities, for invoicing and tax purposes;
  • Technology providers that process data on our behalf: website hosting (Hostinger), image delivery (Optimole), cookie consent management (CookieYes), website analytics (Google Analytics) and messaging (WhatsApp);
  • Banks and payment service providers, when you pay by bank transfer or MB Way;
  • Public authorities, when the law requires it.

All providers that act on our behalf are bound by data protection commitments.

International Transfers

Some of our providers, such as Google and Meta (WhatsApp), may process data outside the European Economic Area, including in the United States. In these cases the transfer relies on an adequacy decision, such as the EU–US Data Privacy Framework, or on the standard contractual clauses approved by the European Commission.

Data Retention

We keep your data only for as long as needed for each purpose:

  • Booking, invoicing and accounting records: up to 10 years, as required by Portuguese tax and accounting law;
  • Enquiries that do not become a booking: up to 12 months;
  • Dietary, allergy and health related information: deleted after the tour has taken place, unless needed to handle a claim;
  • Passport or ID card numbers and dates of birth of participants, sent to our insurer: deleted from our records after the tour has taken place, unless needed to handle a claim;
  • Promotional messages: until you withdraw your consent, or after 24 months without interaction;
  • Photographs and videos: until you withdraw your consent, and we remove published content from our channels on request;
  • Website statistics: up to 14 months;
  • Cookies: for the periods stated in our Cookies Policy.

Your Rights

Under the GDPR, you have the right to:

  • Access your personal data;
  • Correct incorrect or outdated data;
  • Request the erasure of your data, where applicable;
  • Restrict or object to the processing of your data;
  • Receive your data in a portable format;
  • Object to direct marketing at any time;
  • Withdraw your consent at any time, without affecting the lawfulness of the processing carried out before.

To exercise your rights, write to info@greenodyssey.pt or to Rua Manuel Guedes 93, Monção. We reply within one month.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

Cookies

We use cookies and similar technologies only as described in our Cookies Policy. Except for strictly necessary cookies, they are placed only after you accept them in the cookie banner. You can change or withdraw your choice at any time through the cookie settings button on the website.

Data Security

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction, including secure website connections (HTTPS), access control and regular backups.

Children

Our tours are designed for adults. Minors may only take part accompanied by a responsible adult, who provides their data. We do not knowingly collect data from children without the consent of a parent or guardian.

Links to Third Party Sites

Our website contains links to third party sites, such as Instagram, Facebook, WhatsApp and the online complaints book. We are not responsible for their privacy practices and recommend that you read their policies.

Changes to This Policy

We may update this Privacy Policy when our activity or the law changes. The latest version is always available on this page, with the date of the last update.

Last updated: October 2026