Privacy Policy

This website belongs to Book 'N Pin, a brand of H2F Empreendimentos, Unipessoal Lda, tax number PT514952440, registered at Rua Marquês de Pombal 18, 1.º Esq., 2735-312 Agualva-Cacém, Sintra, Portugal. We are a tourist entertainment company registered with Turismo de Portugal under RNAAT no. 2178/2018.

For any question about your personal data, write to booknpin@booknpin.com or message us on WhatsApp at +351 912 222 253. We reply in Portuguese, Spanish and English.

This policy was last updated in September 2026.

When you request a quote or write to us. We collect your name, email, phone or WhatsApp number, group size, tour, dates and whatever message you write. We use this only to reply and prepare your proposal. The legal basis is the pre-contractual steps taken at your request.

When you subscribe to the newsletter. We collect your name and email with your explicit consent, given through the box you tick on the form. You can withdraw that consent at any time, without giving a reason.

When you talk to us on WhatsApp. The conversation moves into the app and is also covered by Meta's privacy policy. We keep the history we need to look after you before, during and after your trip.

When you browse the site. If you allow it, we use Google Analytics to understand which pages get read, from which country and on which device, how far down you scroll on each page, which buttons and links you click (WhatsApp, email, phone, tours), which questions you open, whether you start filling in a form (not what you type), how fast the page loads and which technical errors occur. The data is aggregated, carries no name and is not used to identify you.

Usage recordings (Microsoft Clarity). With the same permission, we use Microsoft Clarity to record how pages are used (clicks, scrolling, mouse movement) and to build heat maps. Clarity automatically hides what you type into forms and records no payment data. When you write to us through the form, the request also carries the source of your visit (for example Google or a direct link) and the page you entered through, so we know which channels work.

Preferences stored in your browser. The language you chose, the euro to real exchange rate, the version of the opening text you saw and the source of your visit live in your device's local storage so the site does not ask twice. The exchange rate never leaves your browser; the language, the text version and the source are sent to Google Analytics (and to Clarity, if you accept) as context for the statistics, without identifying you.

We collect no payment data on this site. We ask for no advance payment and we will never ask for card details by email or WhatsApp. We also carry out no automated decision making or profiling.

We never sell or rent your data. We share only what is strictly necessary, and only with the services that support us:

• Netlify, which hosts the site and receives the forms.
• Google, for visit statistics (Analytics) and for the site's typefaces. When the fonts load, your IP address is disclosed to Google.
• Microsoft (Clarity), for usage recordings and heat maps, only after you accept the cookie notice. Your IP address and how you use the pages are processed by Microsoft, including in the United States.
• Meta (WhatsApp), if you choose to talk to us there.
• api.frankfurter.app, a public exchange rate service we query only to show indicative prices in Brazilian reais to visitors from Brazil. No personal data is sent to it.

Some of these providers may process data outside the European Union, under the safeguards set out in the GDPR, such as the European Commission's standard contractual clauses.

Until you accept, we store no analytics cookies. Google Analytics starts in restricted mode and only begins using cookies once you press Accept on the notice shown on your first visit. Microsoft Clarity follows the same rule and does not load before that. Before that, and also if you choose Essential only, Google Analytics receives only counts without cookies or identifiers (page viewed, language, type of interaction), which cannot follow the same visitor across visits; in that request your IP address reaches Google, as in any internet request.

• _ga and _ga_<ID>, from Google Analytics, up to two years, to tell visitors and sessions apart. Only with your consent.
• bnp_lang, the language you picked.
• bnp_brl_rate, the day's exchange rate used to show indicative prices in reais.
• bnp_consent, your answer to the cookie notice.
• _clck and _clsk, from Microsoft Clarity, up to one year and up to one day, to tell visitors and sessions apart in the recordings. Clarity may also set cookies on Microsoft domains (CLID, ANONCHK, MR, MUID, SM), which Microsoft uses to run the service and, in the case of MUID, also across its other products. Only with your consent.
• bnp_hero_v, the version of the opening text you were shown (we test two lines).
• bnp_src, the source of your first visit and of your latest arrival from outside (channel, entry page, referring site, campaign parameters and date), so we know how you found us when you write. It stays in your browser until you clear it.
• bnp_ss, the source of the current visit, deleted when you close the tab.
• bnp_internal, a flag used only by our team to exclude our own visits from the statistics.

We use no advertising cookies and share no data with ad networks.

You can change your mind whenever you like: review my cookie choice. When you withdraw consent, the site stops using analytics cookies from that moment on and deletes the ones it had set.

• Enquiries and contacts: for as long as your interest is live, and up to three years after the last contact.
• Newsletter: until you unsubscribe.
• Invoicing and accounting: ten years, as required by Portuguese law.
• Visit statistics: a maximum of fourteen months in the Google Analytics account.
• Recordings and heat maps: thirty days for recordings and thirteen months for heat maps, in Microsoft Clarity.

After these periods the data is deleted or anonymised.

Regarding your personal data, you may ask us at any time for:

• access to a copy of what we hold about you;
• correction of anything wrong or out of date;
• erasure, when there is no longer a reason to keep it;
• restriction of, or objection to, the processing;
• portability, to take your data elsewhere;
• withdrawal of consent, without affecting what was done before.

A message to booknpin@booknpin.com is enough. The request is free and we answer within one month at the latest.

If you feel we have not handled it properly, you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados, at www.cnpd.pt.

The site runs entirely over an encrypted connection (HTTPS) and access to submitted forms is limited to the people handling your request. Even so, no system is infallible: should a data breach ever occur with a risk to you, we will notify the people affected and the competent authority, as the law requires.

If this policy changes, we publish the new version here and update the date at the top. Material changes will be communicated to newsletter subscribers.