YOUR DATA
Velo Algarve's privacy policy. How we collect, use, and protect your personal data in line with GDPR and Portuguese data protection law.
1. About This Policy
Velo Algarve ("we," "us," "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have in relation to it.We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and its implementing Portuguese legislation, Lei n.º 58/2019 de 8 de agosto.Please read this policy carefully. If you have any questions, contact us using the details in Section 12.
2. Who We Are
Velo Algarve is a premium road bike rental service operating in the Algarve region of Portugal. We are the data controller for the personal data described in this policy, meaning we determine the purposes and means of processing your data.Our business is operated as: Planaltos Opinativos. LDA, 519261380We do not have a Data Protection Officer (DPO), as we are a small business not engaged in large-scale systematic monitoring or processing of sensitive data. Queries about data protection should be directed to us using the contact details in Section 12.
3. What Personal Data We Collect
We collect the following categories of personal data from you or about you:
3.1 Booking and Rental DataCollected when you make a booking:Full nameEmail addressTelephone number (including WhatsApp)Accommodation address and location for deliveryRental dates and durationBody measurements (height, inseam) and fit preferencesCleat standard preference (Look/Keo or Shimano/SPD-SL)Shoe and helmet size (if add-ons selected)Payment information (processed and stored by Booqable — see Section 6)
3.2 Communications DataCollected when you contact us:Content of email, WhatsApp, or telephone enquiriesYour contact details as provided in those communications
3.3 Website Usage DataCollected automatically when you visit veloalgarve.com:IP addressBrowser type and versionDevice type and operating systemPages visited and time spentReferring URLCookie identifiers (see Section 9)
3.4 Google Business Profile DataIf you contact us or leave a review via Google Business Profile, Google may share relevant data with us in line with their own privacy terms. We do not control Google's data processing.
4. Why We Collect Your Data and Our Legal Basis
Under GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:
| Data type | Purpose | Legal basis |
|---|---|---|
| Booking and rental data | To fulfil your rental booking and provide the service | Performance of a contract (Article 6(1)(b) GDPR) |
| Body measurements and fit preferences | To prepare and deliver your bike fitted to your requirements | Performance of a contract (Article 6(1)(b) GDPR) |
| Payment data | To process payment for your rental | Performance of a contract (Article 6(1)(b) GDPR) |
| Communications data | To respond to your enquiries | Legitimate interests (Article 6(1)(f) GDPR) |
| Website usage data | To understand how our website is used and improve it | Consent, where required (Article 6(1)(a) GDPR) |
| Marketing communications | To send you information about our services, if you have opted in | Consent (Article 6(1)(a) GDPR) |
We do not use your personal data for automated decision-making or profiling.
5. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purposes described in this policy:
| Data type | Retention period |
|---|---|
| Booking and rental records | 7 years from the date of the booking, in compliance with Portuguese accounting and tax law |
| Communications data | 2 years from the date of last contact |
| Website analytics data | As configured in GA4 — maximum 14 months (standard GA4 data retention setting) |
| Cookie data | As set out in Section 9 |
Where we are required by law to retain data for longer periods (for example, for tax compliance), we will do so. After the applicable retention period, data is deleted securely.
6. Who We Share Your Data With
We do not sell your personal data. We share it only with the following third-party processors, each of whom processes data on our behalf under appropriate data processing agreements:
Booqable (Salad Days B.V.)Our booking and rental management software. Booqable processes your booking data, including personal details and payment information, on our behalf as a data processor under GDPR. Booqable is GDPR-compliant and operates under a Data Processing Agreement.Privacy policy: booqable.com/privacy-policy/Booqable's registered address: Kanaalweg 4, 3526 KL Utrecht, Netherlands
Google LLC (Google Analytics 4 / GA4)We use Google Analytics 4 to understand how visitors use our website. GA4 processes anonymised usage data (IP addresses are anonymised) and sets cookies on your device with your consent. Data may be transferred to Google servers in the United States, subject to Google's standard contractual clauses.Google's privacy policy: policies.google.com/privacyTo opt out of GA tracking: tools.google.com/dlpage/gaoptout
Google LLC (Google Business Profile / Google My Business)We use Google Business Profile to manage our business listing and respond to customer reviews. If you interact with our Google Business Profile, your data is subject to Google's privacy terms.
Google LLC (Google Search Console)We use Google Search Console for website performance monitoring. This service processes website and search data but does not handle customer personal data directly.We may also disclose your personal data if required to do so by law, by a court order, or by a regulatory authority.
7. International Data Transfers
Some of our third-party processors (including Google) are based outside the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:
• Standard contractual clauses approved by the European Commission
• Adequacy decisions where applicable
For further information on these safeguards, contact us using the details in Section 12.
8. Your Rights Under GDPR
As a data subject, you have the following rights under GDPR (Articles 15–22):
Right of access — You can request a copy of the personal data we hold about you.
Right to rectification — You can ask us to correct inaccurate or incomplete personal data.
Right to erasure — You can ask us to delete your personal data where there is no longer a lawful basis for us to hold it (subject to our legal retention obligations).
Right to restrict processing — You can ask us to limit how we use your personal data in certain circumstances.
Right to data portability — You can ask us to provide your personal data in a structured, machine-readable format, where technically feasible.
Right to object — You can object to our processing of your personal data where we rely on legitimate interests as our legal basis.
Right to withdraw consent — Where we process your data on the basis of your consent, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
Right not to be subject to automated decisions — We do not use automated decision-making or profiling.To exercise any of these rights, contact us using the details in Section 12. We will respond within one calendar month. We may ask you to verify your identity before processing your request.If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Portuguese supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD) Website: www.cnpd.pt Address: Rua de São Bento, 148-3.º, 1200-821 Lisboa, Portugal
9. Cookies
Our website uses cookies. Cookies are small text files placed on your device by your browser when you visit a website. We use the following types of cookies:
| Cookie type | Purpose | Legal basis |
|---|---|---|
| Strictly necessary | Required for the website to function (e.g. session management) | Legitimate interests — no consent required |
| Analytics (GA4) | Tracks how visitors use our website to help us improve it | Consent required |
| Marketing/advertising | [Not currently used — update if applicable] | Consent required |
When you first visit our website, a cookie consent banner will ask for your consent before any non-essential cookies are set. You can withdraw your consent at any time by adjusting your cookie preferences via the consent tool on our website, or by adjusting your browser settings.
For more information on cookies and how to manage them, visit www.allaboutcookies.org.
10. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:
• Secure payment processing via Booqable (we do not store full payment card details)
• HTTPS encryption on our website
• Restricted access to personal data within our business
No transmission of data over the internet is completely secure. While we do everything reasonably practicable to protect your data, we cannot guarantee the security of data transmitted to or from our website.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours of becoming aware, and will notify you without undue delay if the breach is likely to result in a high risk to your rights.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, the updated version will be posted at veloalgarve.com/privacy-policy/ with an updated "last updated" date. We encourage you to review this policy periodically.
Where changes are material, we will take reasonable steps to notify you (for example, by email if you are an existing customer).
12. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to make a complaint about how we have handled your data, please contact us:
Velo Algarve
Email: hello@veloalgarve.com
Website: veloalgarve.com
We will respond to all data-related requests within one calendar month.
