Blackline Travel
ESENPT
RGPD / GDPR

Privacy and personal data

How Blackline Travel uses, protects and retains data needed to manage private tours in Madeira.

Notice version 2026-07-24

2. Data and purposes

  • Contact, booking, date, tour, party size and pickup details to review availability and perform the contract.
  • Traveller identity and encrypted document numbers where operationally necessary.
  • Voluntary dietary, accessibility or health notes to adapt the service safely.
  • Payment method, amount, status and encrypted transfer receipt to confirm and account for the service.
  • Security, audit and fraud-prevention records.

3. Lawful bases

  • Pre-contractual steps and contract performance for requests and bookings.
  • Legal obligations for accounting, claims and competent authorities where applicable.
  • Legitimate interests for system security, abuse prevention and operational audit, balanced against your rights.
  • Explicit consent for voluntary special-category travel information; it may be withdrawn.

4. Recipients and transfers

Access is limited to authorised Blackline personnel and service providers necessary to perform the service. Data is not sold. International transfers outside the EEA require an adequacy decision or documented safeguards.

5. Retention

Booking records are configured for up to 60 months, payment records for up to 60 months, and identity documents for deletion 30 days after they are no longer operationally required, subject to Portuguese tax, claims and legal-hold requirements.

6. Security and automated decisions

The system uses encrypted sensitive values, one-time links, role-based access, logged document access, CSRF protection, rate limits and secure session controls. No decision with legal or similarly significant effects is made solely by automated processing; availability approval is reviewed by an administrator.

7. Cookies and local storage

The site currently uses only session mechanisms required for login, security and forms, plus local storage for the language preference. Non-essential analytics or advertising technologies must not be enabled without prior consent and an updated notice.

8. Your rights and complaints

You may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Requests are normally answered within one month. You may complain to the Portuguese data-protection authority, CNPD. www.cnpd.pt

9. Identity copies and alternatives

An identity copy is requested only when operationally justified. A Portuguese Citizen Card copy requires freely given, specific consent unless another legal basis applies. Refusal does not block the service when an effective verification alternative is available.

Available alternative: You may verify your identity in person by showing the document without providing a copy. Contact privacy to arrange it.

Official policies and notices

Additional privacy documents

Versioned texts reviewed and made public by Blackline Travel.

Privacy · v1.0Data and document protection
Blackline Travel processes data needed to manage the account, booking, trip safety and, where applicable, identity verification. Documents are encrypted and are not exposed through a direct public URL. Access is limited to authorised staff and is logged. Only necessary data will be requested and retention periods must be defined before this policy is activated. Clients may request access, correction, erasure, restriction or portability and may complain to the CNPD. Complete the controller, contact, legal basis, recipients, transfers and retention periods with legal advice before publication.