Privacy Policy & Cookies

Last updated: June 2025

1. Who we are

TIME OFF – Tours & Events, Lda. Cumieira, Santa Marta de Penaguião, Douro Valley, Portugal Email: geral@timeoff.pt Phone: +351 918 813 459

TIME OFF is a licensed tourism and nature activity company registered in Portugal, holding registration RNATAAT no. 154/2019 with the National Registry of Tourism and Nature Activity Operators, and RNAVT no. 9608/2021 with the National Registry of Travel and Tourism Agencies.

As the data controller responsible for your personal data, TIME OFF is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and applicable Portuguese law.

2. What data we collect

We only collect the data necessary to provide our services and respond to your requests. Depending on how you interact with us, we may collect:

Data you provide directly:

• First and last name
• Email address
• Phone number (including WhatsApp)
• Preferred date and group size
• Dietary preferences or special requirements (when voluntarily provided)
• Messages and communications sent through our contact forms or channels

Data collected automatically:

• IP address
• Browser type and device information
• Pages visited and time spent on the site
• Traffic source (organic search, social media, etc.)
• Cookie data (see section 6)

We do not collect sensitive data (such as health information, ethnic origin, or religious beliefs) unless you voluntarily share it — for example, by mentioning a dietary restriction in your message.

3. How we use your data

Your data is used exclusively for the following purposes:

We never use your data for automated decision-making or profiling with legal effects.

4. Who we share your data with

TIME OFF does not sell or transfer your personal data to third parties for commercial purposes. We may share data only with:

• Essential service providers — transport companies, partner wine estates, and restaurants involved in delivering the experience you booked, only to the extent necessary
• Digital tools — platforms such as Google Analytics, Meta (Instagram/Facebook), email services, and WhatsApp Business, used for operations and communication
• Competent authorities — when required by law or judicial order

All subcontractors are bound by contractual obligations of confidentiality and data protection.

5. How long we keep your data

We retain your data only for as long as strictly necessary:

• Enquiries without a booking: up to 12 months after the last contact
• Bookings and completed experiences: 5 years, to comply with Portuguese fiscal and commercial law obligations
• Marketing data (newsletter): until you withdraw your consent
• Cookie and analytics data: as set out in the retention periods in section 6

Once the applicable period ends, data is securely deleted or anonymised.

6. Cookie Policy

What are cookies

Cookies are small text files that your browser stores on your device when you visit our website. They allow the site to function correctly, remember your preferences, and help us understand how visitors use the site.

What cookies we use

Strictly necessary cookies Essential for the website to function. They cannot be disabled. They do not collect personally identifiable information.

Examples: user session, cookie preferences, form security.

Analytical / performance cookies Help us understand how visitors interact with the site (most visited pages, time on site, traffic sources). Information is aggregated and anonymous.

Tool used: Google Analytics 4 Data transferred to: Google LLC (USA) — under Standard Contractual Clauses approved by the European Commission. Retention: up to 14 months.

You can opt out at: Google Analytics Opt-out

Marketing / social media cookies Used to personalise content and ads on social media (Instagram, Facebook). Only activated with your consent.

Tools: Meta Pixel (Instagram/Facebook) Data transferred to: Meta Platforms, Inc. (USA) — under Standard Contractual Clauses approved by the European Commission.

Managing your cookies

When you first visit our website, a cookie notice will appear where you can accept or decline non-essential categories.

You can also manage or delete cookies directly in your browser:

• Chrome: Settings → Privacy and security → Cookies
• Safari: Preferences → Privacy
• Firefox: Options → Privacy and Security
• Edge: Settings → Cookies and site permissions

Please note that disabling certain cookies may affect the functionality of the website.

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — to know what data we hold about you
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure (“right to be forgotten”) — to request deletion of your data, where applicable
• Right to restriction of processing — to limit how we process your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to processing based on legitimate interest or for direct marketing purposes
• Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out prior to withdrawal

To exercise any of these rights, please contact us at: Email: geral@timeoff.pt Post: TIME OFF, Cumieira, Santa Marta de Penaguião, Douro Valley, Portugal

We will respond within 30 days. In complex cases, we may extend this by a further 60 days, notifying you in advance.

You also have the right to lodge a complaint with the Portuguese data protection authority:

Comissão Nacional de Proteção de Dados (CNPD) Website: www.cnpd.pt Phone: +351 213 928 400

8. Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or disclosure. Our website uses HTTPS (SSL/TLS encryption) across all communications.

While we make every effort to protect your data, no internet transmission is 100% secure. In the event of a data breach that may affect your rights, we will notify the relevant authorities and, where applicable, the affected individuals within the legally required timeframes.

9. International data transfers

Some of the tools we use (Google, Meta) involve transfers of data outside the European Economic Area, in particular to the United States of America. These transfers are carried out under appropriate legal mechanisms, namely the Standard Contractual Clauses approved by the European Commission, in accordance with Article 46 of the GDPR.

10. Changes to this policy

We may update this Privacy Policy & Cookie Policy periodically, particularly in response to legal changes or updates to our services. The “last updated” date at the top of this page always reflects the most recent version.

In the event of significant changes, we will notify registered users by email or through a prominent notice on the website.

11. Contact

For any questions about this policy or the processing of your personal data, please contact us:

TIME OFF – Tours & Events Email: geral@timeoff.pt Phone / WhatsApp: +351 918 813 459 Cumieira, Santa Marta de Penaguião, Douro Valley, Portugal

This document was prepared in accordance with Regulation (EU) 2016/679 (GDPR), Portuguese Law no. 58/2019 of 8 August (implementing the GDPR in Portugal), and Law no. 41/2004 of 18 August (on the processing of personal data in electronic communications), as amended by Decree-Law no. 48/2020.