Last updated: 07/06/2026
This Privacy Policy explains how Upwelling Boat collects, uses, and protects your personal data when you visit our website or book one of our boat tours. We are committed to handling your information responsibly and in line with the EU General Data Protection Regulation (GDPR) and Portuguese data protection law.
Who we are
The data controller is:
Legal/trading name: UPWELLING BOAT UNIPESSOAL LDA
Tax number (NIF): 519300491
Tourism registration (RNAAT): [RNAAT number]
Email: info@upwellingboat.com · Phone: +351 917 333 335
If you have any questions about this policy or your data, contact us at info@upwellingboat.com.
What data we collect
Information you give us directly
Contact form: your name, email address, phone number (optional), preferred contact method, and the content of your message.
WhatsApp, email, or phone: your contact details and whatever you choose to tell us.
Booking: your name, contact details, number of guests, and booking preferences. Bookings and payments are handled by Bókun (see “Third parties” below) — we do not store your card or payment details.
Information collected automatically
Basic technical data when you visit the site (IP address, browser type, pages viewed), via server logs and cookies, used to keep the site secure and working.
Why we use your data
To respond to your enquiries and prepare a quote — on the basis of taking steps at your request before entering a contract, and our legitimate interest in answering you.
To manage your booking and provide the tour — to perform our contract with you.
To meet legal and tax obligations (e.g. invoicing, accounting) — to comply with a legal obligation.
To keep the website secure and improve it — on the basis of our legitimate interests.
To send marketing (only if you ask us to) — on the basis of your consent, which you can withdraw at any time.
Cookies and third-party services
Our site uses a small number of cookies and embeds services from third parties, who may process your data as part of providing their service:
Polylang — an essential cookie that remembers your chosen language.
Bókun (a TripAdvisor company) — powers our booking widget and processes booking and payment data.
Google Maps (Google) — displays our location map.
WhatsApp (Meta) — only used if you choose to message us through it.
Google Analytics 4 (Google) — measures how visitors use the site so we can improve it. Set only if you accept analytics cookies.
Non-essential cookies are only set with your consent. You can manage your preferences at any time via the cookie banner.
Who we share your data with
We do not sell your personal data. We share it only with:
- our crew, as needed to run your tour;
- our service providers (booking platform, payment processor, hosting, IT, and accounting);
- public authorities, where we are legally required to.
International transfers
Some of our providers (such as Google, Meta, and Bókun) may process data outside the European Economic Area. Where they do, the transfer is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.
How long we keep your data
Enquiries that don’t lead to a booking: up to 12 months.
Booking and customer records: for the duration of our relationship and as required afterwards.
Invoicing and accounting records: for the period required by Portuguese tax law (currently 10 years).
Your rights
Under the GDPR you have the right to access, correct, delete, restrict, or object to our use of your personal data, and the right to data portability. Where processing is based on consent, you can withdraw it at any time.
To exercise any of these, email us at info@upwellingboat.com. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.
Children
Our website and bookings are intended for adults. Bookings that include children must be made by a parent or guardian.
Security
We take reasonable technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the “last updated” date above.