Privacy Policy

This website belongs to Book 'N Pin, a brand of H2F Empreendimentos, Unipessoal Lda, tax number PT514952440, registered at Rua Marquês de Pombal 18, 1.º Esq., 2735-312 Agualva-Cacém, Sintra, Portugal. We are a tourist entertainment company registered with Turismo de Portugal under RNAAT no. 2178/2018.

For any question about your personal data, write to booknpin@booknpin.com or message us on WhatsApp at +351 912 222 253. We reply in Portuguese and in English.

This policy was last updated in July 2026.

When you request a quote or write to us. We collect your name, email, phone or WhatsApp number, group size, tour, dates and whatever message you write. We use this only to reply and prepare your proposal. The legal basis is the pre-contractual steps taken at your request.

When you subscribe to the newsletter. We collect your name and email with your explicit consent, given through the box you tick on the form. You can withdraw that consent at any time, without giving a reason.

When you talk to us on WhatsApp. The conversation moves into the app and is also covered by Meta's privacy policy. We keep the history we need to look after you before, during and after your trip.

When you browse the site. If you allow it, we use Google Analytics to understand which pages get read, from which country and on which device. The data is aggregated and is not used to identify you.

Preferences stored in your browser. The language you chose and the euro to real exchange rate live in your device's local storage so the site does not ask twice. They never leave your browser.

We collect no payment data on this site. We ask for no advance payment and we will never ask for card details by email or WhatsApp. We also carry out no automated decision making or profiling.

We never sell or rent your data. We share only what is strictly necessary, and only with the services that support us:

• Netlify, which hosts the site and receives the forms.
• Google, for visit statistics (Analytics) and for the site's typefaces. When the fonts load, your IP address is disclosed to Google.
• Meta (WhatsApp), if you choose to talk to us there.
• api.frankfurter.app, a public exchange rate service we query only to show indicative prices in Brazilian reais to visitors from Brazil. No personal data is sent to it.

Some of these providers may process data outside the European Union, under the safeguards set out in the GDPR, such as the European Commission's standard contractual clauses.

Until you accept, we store no analytics cookies. Google Analytics starts in restricted mode and only begins using cookies once you press Accept on the notice shown on your first visit.

• _ga and _ga_<ID>, from Google Analytics, up to two years, to tell visitors and sessions apart. Only with your consent.
• bnp_lang, the language you picked.
• bnp_brl_rate, the day's exchange rate used to show indicative prices in reais.
• bnp_consent, your answer to the cookie notice.

We use no advertising cookies and share no data with ad networks.

You can change your mind whenever you like: review my cookie choice.

• Enquiries and contacts: for as long as your interest is live, and up to three years after the last contact.
• Newsletter: until you unsubscribe.
• Invoicing and accounting: ten years, as required by Portuguese law.
• Visit statistics: a maximum of fourteen months in the Google Analytics account.

After these periods the data is deleted or anonymised.

Regarding your personal data, you may ask us at any time for:

• access to a copy of what we hold about you;
• correction of anything wrong or out of date;
• erasure, when there is no longer a reason to keep it;
• restriction of, or objection to, the processing;
• portability, to take your data elsewhere;
• withdrawal of consent, without affecting what was done before.

A message to booknpin@booknpin.com is enough. The request is free and we answer within one month at the latest.

If you feel we have not handled it properly, you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados, at www.cnpd.pt.

The site runs entirely over an encrypted connection (HTTPS) and access to submitted forms is limited to the people handling your request. Even so, no system is infallible: should a data breach ever occur with a risk to you, we will notify the people affected and the competent authority, as the law requires.

If this policy changes, we publish the new version here and update the date at the top. Material changes will be communicated to newsletter subscribers.