Clear choices, no surprises
Privacy &
cookies.
What we collect, why we use it, who receives it and how you can stay in control.
Last updated: 23 August 202601 · Overview
Who is responsible?
Semana Ousada, Lda., Portuguese company no. 515302996, operates the Porto Crawl brand and is the controller for the personal data described in this policy unless another provider is identified as an independent controller.
Travessa da Cara, no. 14, 2nd Left1200-089 Lisbon, Portugal
Privacy questions and requests: info@discoverlisbon.org. General enquiries: info@portocrawl.com.
Optional analytics and marketing tools are off until you choose them. Rejecting optional cookies does not restrict the site or booking links. You can reopen “Privacy choices” at any time.
02 · How data is used
Purposes, legal bases and retention
We follow the principles of purpose limitation, data minimisation and storage limitation. The details below cover this website and the direct interactions it starts.
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Site delivery and security | IP address, request time, browser/device and security logs | Provide the site, prevent abuse and diagnose faults | Legitimate interests and security obligations | Only as long as operationally necessary, subject to provider security schedules |
| Privacy choices | Your analytics and marketing selections and their date | Remember and demonstrate your choice | Necessary to honour the choice and legal obligations | 6 months, then you are asked again |
| Analytics | Page views, device/browser information, approximate location and interactions | Understand use and improve the site | Consent | Up to 13 months in our analytics-only configuration |
| Marketing measurement | Campaign identifiers, page views, booking-button events and device/browser information | Measure advertising and campaign effectiveness | Consent | Typically 3–24 months depending on the provider identifier |
| Bookings | Details you enter on TuriTop, including identity, contact, booking and payment information | Take reservations, process payment and operate the experience | Contract and pre-contractual steps; legal obligations | According to booking, accounting and legal retention requirements |
| Enquiries and private-event briefs | Name, email, phone/WhatsApp details, date, group size and message | Reply and prepare or perform a service | Pre-contractual steps, contract or legitimate interests | Normally up to 6 months after the enquiry closes unless it becomes a booking |
| Job applications | Name, email, city, application text and any CV you send | Assess and contact applicants | Pre-contractual steps and legitimate interests | Normally up to 6 months after recruitment closes unless you agree to longer retention |
We do not sell personal data. We do not use solely automated decisions that produce legal or similarly significant effects.
03 · Providers & transfers
Who may receive data?
- TuriTop, S.L. provides the booking and payment interface and acts as an independent controller for information entered there. Its service opens only when you choose a booking link.
- Google provides Analytics, Ads and Tag Manager. Analytics or advertising storage is activated only according to your selection.
- Meta provides campaign-measurement technology, activated only with marketing consent. WhatsApp is also an independent service when you choose to send a message through it.
- Hosting, security, communications and professional-service providers may process the minimum information needed to deliver their services under contractual confidentiality and security duties.
- Authorities and advisers may receive information where required by law or necessary to establish, exercise or defend legal claims.
Some providers may process information outside the European Economic Area. Where Porto Crawl is responsible for such a transfer, it relies on an adequacy decision, approved contractual safeguards or another lawful GDPR transfer mechanism. Independent providers explain their own transfers in their privacy notices.
05 · Your rights
Access, correction and control
Subject to the GDPR’s conditions, you may request access, correction, deletion, restriction, objection or portability of your personal data. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Direct-marketing objections are honoured without requiring reasons.
Email info@discoverlisbon.org. We may request information needed to verify identity and normally respond within one month. You may also complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD) ↗ or another competent supervisory authority.
This policy may be updated when services or legal requirements change. Material changes will be highlighted where appropriate, and the date at the top will be updated.