Privacy Policy

1. Who we are and who processes the data

Brunu Travel is a brand operated by Bruno Miguel Oliveira, based in Lisbon, Portugal. It creates, promotes and accompanies travel, content and tourism-related services.

Brunu Travel works with partner travel agencies registered with the Portuguese RNAVT. The agency responsible for each trip is identified on the relevant page and registration form.

2. Scope of this policy

This policy applies to the Brunu Travel website, Tally forms, contact and registration requests, trip interest records, destination suggestions, updates subscriptions, bookings made through Cal.com/Cal.eu, and communications by email, WhatsApp, Instagram or Facebook.

It also covers marketing communications and other pages or services directly associated with the brand. When users follow a link to an external service, that provider's policy also applies.

3. Personal data we may collect

Depending on the request and form used, we may process:

• full name, date of birth, gender, phone number and email;
• the names and gender of other participants;
• room preferences and allocation, number of participants, preferred contact method and departure airport;
• dietary requirements, allergies, mobility or other special requirements;
• information freely provided by the user;
• suggested destination, selected trip and estimated number of participants;
• marketing preferences and a record of choices made;
• call-booking information and communications by email, WhatsApp or social media.

The site and its technical providers may also process IP address, device type, operating system, browser, pages visited, referral source and identifiers associated with cookies or local storage. Analytics and marketing are only activated after the relevant permission.

Information about allergies, health, mobility or special requirements may reveal health data. Processing relies on explicit consent and must be limited to what is needed to prepare and organise the trip.

4. Purposes and legal bases

Contact and information requests

We process data to answer questions, provide trip information and follow up on requests. The legal bases are steps requested before entering into a contract and our legitimate interest in responding to received contacts.

Registration requests

We process data to check availability, confirm participants, organise rooms, confirm the airport, prepare a booking and send necessary information to the partner agency. The legal bases are pre-contractual steps, carrying out the user's request and consent where applicable.

Expressions of interest

We process the name, preferred contact method, contact details, estimated number of participants and selected trip to provide updates about new dates, booking access and relevant information. An expression of interest is not a booking and does not guarantee a place. Without marketing consent, the data are used only for the selected trip or destination.

Trip interest and destination suggestions

When “Show interest” is used, we record the selected trip and a random technical identifier associated with the browser and trip solely to reduce duplicate records. This first step does not request a name, phone number or email, and only aggregated totals are published. If the user asks to receive updates or be contacted, those details are collected in a separate form. For suggestions, we process the submitted details to assess the idea and, where requested, follow up with the user.

Health data and special requirements

These data are used solely to prepare the trip and inform relevant agencies or providers. The legal basis is the data subject's explicit consent.

Marketing

With consent, we may send news, future trips, campaigns and priority access by email or WhatsApp. Consent can be withdrawn at any time without affecting earlier lawful processing.

Site analysis, security and operation

Technical data are processed to deliver and secure the site, identify problems and improve pages and services. Strictly necessary functions rely on technical necessity and legitimate interests; optional analytics and marketing technologies rely on consent.

5. Partner travel agencies

Data related to registration requests may be shared with the partner travel agency identified in the form and on the relevant trip page.

Expressions of interest initially remain under Brunu Travel's management and are not shared with a partner agency merely because they were submitted. If the user later proceeds with a registration request, the conditions of that new request apply.

The agency may use registration data to confirm availability, contact the customer, prepare proposals or bookings, process payments, organise flights, accommodation, insurance and other services, and comply with legal obligations.

Trip payments are made directly to the partner travel agency responsible for the trip. Brunu Travel supports the participant throughout the process.

6. Providers and platforms

Brunu Travel uses technology providers as needed for hosting, forms, communications, scheduling, content and site analysis:

• Netlify, for site hosting and delivery. Privacy policy.
• Tally, for registration, trip interest records, contact requests, suggestions and updates subscriptions. Privacy policy.
• Cal.com/Cal.eu, when a meeting is requested. Privacy policy.
• Google, for public sheets supplying site content and aggregated interest totals, Google Analytics, Google Ads, Google Fonts and YouTube. Analytics and Ads require consent. Privacy policy.
• Travelpayouts and operators shown in its widgets, for comparison tools and affiliate links, activated only with marketing consent. Privacy policy.
• WhatsApp, Instagram and Facebook, when users choose to communicate or visit those platforms. The policy displayed by the relevant service applies.
• Email services, to receive and answer messages sent to Brunu Travel's public address.

The site's code is maintained on GitHub, but production is currently served by Netlify. The site does not use Meta Pixel.

7. International transfers

Some providers may store or process data outside the European Economic Area. Where this occurs, processing must rely on an applicable legal mechanism, such as an adequacy decision, Standard Contractual Clauses or another safeguard recognised by the GDPR.

The specific safeguards depend on the provider, service and location used at the relevant time. The official policies linked above provide current information about their transfer mechanisms.

8. Data retention

• Registration requests that do not proceed: up to 3 months.
• Expressions of interest without marketing consent: until the trip launches or is cancelled, and no longer than 12 months after the last interaction.
• Suggestions without marketing consent: up to 12 months after the last interaction.
• Anonymous interest records: for the period needed to measure trip interest, with only aggregated counts made public.
• Confirmed requests: for the period required to organise the trip and meet applicable legal obligations.
• Contact requests: up to 12 months after the last interaction.
• Marketing: until consent is withdrawn.
• Technical data and preferences: according to the periods in the Cookie Policy.

Data may be retained longer where required to comply with legal obligations, resolve disputes or defend rights.

9. Marketing and unsubscribing

Communications may be sent manually by email or WhatsApp. Users can unsubscribe through the link in an email, when available, by replying to a WhatsApp message or by emailing info@brunutravel.pt.

Withdrawal of consent does not affect the lawfulness of processing carried out beforehand.

10. Minors

Minors must travel with the accompaniment and authorisation of a parent or legal guardian. A minor's data must be provided by that representative. Brunu Travel forms are not directed at minors.

11. Your rights

Where applicable, data subjects may request access, rectification, erasure, restriction, objection, portability and withdrawal of consent. They may also lodge a complaint with Portugal's National Data Protection Commission.

Requests can be sent to info@brunutravel.pt. We may request only the information needed to verify the requester's identity.

12. Security

Brunu Travel adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or improper disclosure. No system can, however, guarantee absolute security.

13. Changes to this policy

This policy may be updated following legal, technical or operational changes. The date of the latest version is shown at the beginning of the page.

14. Contact