Privacy Policy.

We may collect the following personal data:

• Identification data: name, email, phone number and address;
• Booking data: hike date, number of participants and preferences;
• Payment data: the information needed to process payment, where applicable;
• Health and special conditions: medical conditions, allergies, mobility limitations or other information relevant to the safety of the activity, when voluntarily provided by the customer;
• Other data: any information you voluntarily send us through contact forms, email or WhatsApp.

We do not ask for health data that is not needed to assess whether it is safe for you to take part. When provided, it is used only for that purpose and on the appropriate legal basis.

We process your personal data to:

• Manage, confirm and organise bookings;
• Provide the guided hikes you booked;
• Send confirmations, instructions and necessary information about the activity;
• Ensure participants’ safety;
• Comply with legal, tax, accounting and insurance-related obligations;
• Reply to requests, questions or complaints;
• Improve our services and customer support;
• Send newsletters or marketing communications, only where valid consent exists.

We process personal data based, as applicable, on:

• Performance of a contract: to manage your booking and provide the service;
• Legal obligation: for example tax, accounting or insurance-related obligations;
• Legitimate interest: to ensure safety, improve our services, prevent abuse and defend rights;
• Consent: for example for marketing communications or for the voluntary processing of certain health information, where required by law.

Where necessary, personal data may be shared with:

• Payment platforms;
• Booking management systems;
• Email services, website hosting and data storage;
• Insurers, where needed for insurance or accident purposes;
• Accountants, advisers or service providers acting on our behalf;
• Public authorities, where required by law.

These providers may only process data in line with our instructions and applicable law. We do not sell your personal data.

Some service providers may process data outside the European Economic Area. When that happens, we aim to ensure the transfer complies with the GDPR, in particular through a European Commission adequacy decision or standard contractual clauses approved by the European Commission.

If we use specific providers that involve international transfers, the relevant information will be updated in this Policy.

We keep personal data only for as long as needed for the purposes for which it was collected.

• Booking data is kept for the period needed to organise the activity and handle any later questions;
• Data that must be kept to meet tax, accounting, insurance or other legal obligations is kept for the period required by law;
• Data used for marketing is kept until you withdraw consent or there is no longer a legal basis for processing;
• Health or special-condition data is deleted as soon as it is no longer needed to ensure the safety of the activity, unless another legal obligation requires it to be kept.

Under the GDPR, you may, where applicable:

• Request access to your personal data;
• Ask for inaccurate or incomplete data to be corrected;
• Request deletion of your data;
• Request restriction of processing;
• Object to certain processing;
• Request data portability;
• Withdraw consent, where processing is based on consent;
• Not be subject to a decision based solely on automated processing, where applicable.

Exercising these rights may be subject to the limits set by law, in particular where keeping the data is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

To exercise your rights, contact us at bookings@lostinmadeira.pt or on WhatsApp (+351 926 795 659). We will reply within the applicable legal deadline.

You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD) at www.cnpd.pt.

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or improper disclosure. Access to data is limited to the people and organisations that need it for the purposes described.

The website may use cookies and similar technologies to make it work, improve the user experience, analyse traffic and, where applicable, carry out marketing.

Non-essential cookies are only used according to the choices you make in the cookie banner. For more information, see our Cookie Policy.

Identifiable photos or videos of participants are used for promotion or marketing only with valid authorisation, where required. You may refuse this use without affecting your participation in the hike.

We may update this Privacy Policy to reflect legal or regulatory changes or changes to our practices. The version in force is the one published on the website at the time you read it.

For questions about privacy or data protection:

• Email: bookings@lostinmadeira.pt
• Phone / WhatsApp: +351 926 795 659
• Address: Rua Levada de Santa Luzia, Funchal, Madeira, Portugal