This policy explains what personal data porto.tours handles, and it is written to match how the site works, not a template. The short version: we do not run analytics, advertising or tracking of any kind, we set no cookies of our own, and the only personal details we receive are the ones you type into the contact form or send us by email.
Who is responsible. The website porto.tours is published by Porto Tours, R. São João 110, esc. 1.2, 4100-118 Porto, Portugal. For anything about this policy or your data, write to [email protected] or use the contact page.
This policy applies to the website in all of its languages. It was last updated on 19 September 2026.
What happens when you read a page
Delivery through Cloudflare. Every request to the site passes through Cloudflare, which delivers the pages from a location near you and protects the site against attacks. To do that, Cloudflare processes your IP address, the page requested and your browser's user agent, and may set a strictly necessary security cookie that is not used for tracking. See Cloudflare's privacy policy.
Our server. The site is hosted on a virtual server rented from a hosting provider. It writes a short access log of each request: IP address, date and time, the address requested, the response and the browser's user agent. The logs keep the site running and secure, and they are deleted automatically after 91 days.
No analytics, no advertising. The site uses no analytics or advertising service, no social media pixels and no tracking scripts. Fonts, maps and most pictures are served from our own server.
Partner photographs. On pages about places to stay and multi-day trips, the photographs of each listing are loaded from the image servers of Booking.com and TourRadar. When your browser fetches such a picture, that company receives your IP address and browser details, under its own privacy policy.
The legal basis is our legitimate interest in delivering a secure, working website (Article 6(1)(f) GDPR).
Settings stored in your browser
Two small preferences are kept in your browser's own storage, never on our server:
- the currency you pick for prices, saved only when you choose one; - a note that you closed the offer bar, kept for the current browser session only.
Neither identifies you, and neither is a cookie. You can remove both by clearing your browser's site data.
When you follow a link to a partner
Many pages recommend tours, transfers, trips, places to stay and travel gear, and link to the partners who sell them: GetYourGuide, Stay22, TourRadar, Viator and Amazon. The links carry a code that tells the partner the visit came from this site and page, not who you are. Once you are on a partner's site, that partner decides what it collects under its own privacy policy. We receive commission reports without your name or contact details. See the affiliate disclosure.
When you write to us
The contact form asks for your email address and your message, and optionally your name and a topic; the page also records the language and page you wrote from. To keep spam out, the form uses Cloudflare Turnstile, which sends technical signals and your IP address to Cloudflare to confirm a person is sending; see the Turnstile privacy addendum. The Turnstile script is loaded on the contact page only.
The message is stored on our server and delivered to our inbox through FormSubmit (formsubmit.co). Emails you send to [email protected] are received by our email provider, Purelymail. We keep a message for as long as the conversation needs, and for no longer than 12 months after the last message. The legal basis is our legitimate interest in answering you (Article 6(1)(f) GDPR).
Who else sees the data
We do not sell, rent or trade personal data. The only parties that process it for us are the ones named above: Cloudflare (delivery, security and spam protection), our hosting provider, FormSubmit and our email provider Purelymail; Booking.com and TourRadar receive the technical details of a request for the partner photographs they serve. Some of them may process data outside the European Economic Area; where they do, the transfer relies on the safeguards the GDPR provides for it, such as the EU Standard Contractual Clauses.
Your rights
Under the GDPR you have the right to ask what personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable form. Write to [email protected]; we answer within one month.
You also have the right to complain to a data protection authority. In Portugal that is the Comissão Nacional de Proteção de Dados, and elsewhere in the European Union the authority of the country where you live. If you live in the United Kingdom, the UK GDPR gives you the same rights, and you can complain to the Information Commissioner's Office.
Children. The site is not directed at children under 13 and we do not knowingly collect their data.
Changes to this policy
If the way the site handles data changes, this page is updated first and the date at the top changes with it. Where a change needs your consent, we ask for it before it applies.