Privacy Policy

Vida Leiria ("we", "us", or "our") operates the website at vidaleiria.com (the "Site"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Site, purchase digital photography, register for tours, or contact us. Please read it carefully.

By using the Site you acknowledge that you have read and understood this policy. If you do not agree, please stop using the Site.

1. Information We Collect

Information you provide directly

• Account registration — email address and password when you create an account to book tours.
• Tour bookings — full name, email address, phone number, and party size.
• Contact form — name, email address, subject, and message.
• Shop purchases — billing details and payment information handled by our third-party payment processor (see Section 7).

Information collected automatically

• Log data — IP address, browser type, operating system, referring URL, pages visited, and timestamps.
• Cookies and similar technologies — session cookies necessary for shopping-cart functionality and authentication (see Section 6).

2. How We Use Your Information

• Fulfil and manage your digital photo purchases and tour bookings.
• Send order confirmations, booking confirmations, and essential service emails.
• Send email-verification messages when you create an account.
• Respond to your contact-form enquiries.
• Detect, investigate, and prevent fraudulent or unauthorised activity.
• Comply with legal obligations.
• Improve the Site's content, performance, and usability.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

4. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction (Rectification) — request that we correct inaccurate or incomplete data.
• Deletion (Erasure) — request that we delete your personal data where there is no overriding legal basis for retention.
• Portability — receive your data in a structured, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where processing is consent-based, withdraw consent at any time without affecting the lawfulness of prior processing.
• Non-discrimination (CCPA/US) — we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at the address in Section 9. We will respond within 30 days (or the period required by applicable law). We may need to verify your identity before fulfilling requests.

EEA/UK residents also have the right to lodge a complaint with a supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD) at cnpd.pt.

5. Cookies and Tracking Technologies

We use the following types of cookies:

• Strictly necessary cookies — session cookies that maintain your shopping cart, authentication state, and CSRF protection. These cannot be disabled without breaking Site functionality.
• Preference cookies — remember settings such as language or display preferences.

We do not currently use advertising cookies or third-party tracking pixels. You can control or delete cookies through your browser settings; disabling strictly necessary cookies may affect checkout and login functionality.

6. Third-Party Services

• Hostinger — web hosting and e-commerce infrastructure. Data may be stored on servers within the EU. See Hostinger Privacy Policy.
• Payment processor — payment card data is collected and processed directly by our payment processor. We do not store full card numbers. Their privacy policy governs payment data.
• Google Maps — the Quick Finds page opens Google Maps links in a new tab. Google's privacy policy applies when you visit those links.
• Google Fonts — fonts are loaded from Google's CDN; Google may collect IP addresses as part of serving these files. See Google Privacy Policy.

We only share personal data with third parties to the extent necessary to provide our services, comply with the law, or protect our rights.

7. Data Retention

• Account data — retained for as long as your account is active, plus up to 12 months after account deletion.
• Tour booking records — retained for 3 years to comply with consumer and tax law.
• Contact form submissions — retained for 12 months after the enquiry is resolved.
• Purchase records — retained for 7 years to comply with tax and accounting obligations.
• Log data — typically retained for up to 90 days.

After the applicable retention period, data is securely deleted or anonymised.

8. Children's Privacy

Our Site is not directed to children under the age of 13 (or 16 in the EEA/UK, where a higher threshold applies). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

9. Contact Us

For any privacy-related enquiries, to exercise your rights, or to lodge a complaint, please reach us through:

• Contact form: vidaleiria.com/contact
• Website: vidaleiria.com

We aim to acknowledge all privacy requests within 72 hours and to resolve them within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated via a notice on the Site. Your continued use of the Site after changes take effect constitutes acceptance of the revised policy. We encourage you to review this page periodically.