Last updated: 31 August 2026
Who this policy concerns
This policy covers the initial processing carried out through the FPB Private Tours Madeira website, which presents a shared commercial brand used by independent operators. Privacy enquiries may be sent to info.fpbmadeira@gmail.com.
Information we may process
An availability request may include name, email, phone or WhatsApp, country, requested experience, requested date and time, adults, children and their ages, pickup and drop-off, preferred language, practical accessibility needs, flight information, notes and a request reference.
A contact message may include name, email, optional phone or WhatsApp, subject and message. A review may include name, country or nationality, review text, experience, experience date and voluntarily submitted images.
Where actually processed for operation or security, technical data may include IP address, date and time, browser or device-related information, anti-spam results and necessary logs.
Why and on what basis we use data
Data may be used to respond to requests, prepare proposals, arrange and perform bookings, communicate with customers, assign an operator, prepare child seats or accessibility arrangements, organise airport transfers, respond to contact messages, moderate and publish authorised reviews, prevent spam, meet legal obligations and establish, exercise or defend rights.
Depending on the context, processing is based on steps requested before a contract, performance of a contract, legal obligations, legitimate interests or consent where appropriate. Consent is not used as a general basis for every activity.
Accessibility and children
Please provide only the practical accessibility information relevant to your transport. There is no need to provide medical information or diagnoses. A child’s age is requested only to organise transport and the appropriate child seat. Forms concerning children must be completed by a responsible adult.
Sharing with the responsible operator
Once a service is assigned, only the data reasonably necessary to provide it is shared with the independent operator responsible for that service.
Service providers and international transfers
The technical architecture may use Supabase for database, authentication and storage; Vercel for hosting; Resend for transactional email; and Cloudflare Turnstile for anti-spam protection. Their precise roles depend on the configured feature. We do not state unverified processing regions or subprocessor arrangements.
Where processing involves an international transfer, safeguards required by applicable data-protection law will be used where relevant.
Retention, reviews and photographs
Personal data is kept only for as long as necessary for the relevant purpose and applicable legal obligations. Concrete retention periods will be documented before definitive commercial launch.
Reviews remain pending until moderation. Email addresses, WhatsApp numbers and other private contact details are not published as part of a review. Photographs are voluntary and are submitted subject to the required authorisation.
Security and automated decisions
Reasonable measures include access controls, authentication, database row-level security, separation between public and administrative areas, anti-spam checks and secure connections. No system can promise absolute security.
Availability requests are reviewed manually. No relevant decision based solely on automated processing is currently intended.
Marketing and your rights
Submitting a booking or contact form does not subscribe the sender to marketing, and no newsletter is currently offered.
Where applicable, individuals may request access, rectification, erasure, restriction, portability, object to processing, withdraw consent without affecting earlier lawful processing, and lodge a complaint with a supervisory authority. In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD). Contact info.fpbmadeira@gmail.com to exercise a right or ask a privacy question.