Your information.
Handled with care.

01

Who is responsible

BLU CORA BESPOKE TRAVEL SOCIEDADE UNIPESSOAL LDA, trading as BLU COSTA TRAVEL CURATION (“BLU”, “we”, “us”), is the controller responsible for the personal information described in this policy.

Privacy requests may be sent directly to the email address above.

02

What information we collect

Depending on your relationship with BLU and what is needed for the requested service, we may collect:

• Identity and contact details: name, email address, telephone number, address and preferred means of contact.
• Journey information: dates, destinations, interests, group composition, accommodation or pickup details, preferences, celebrations and correspondence.
• Traveler information: names and ages of children, emergency contacts and the names or relevant details of other people included in a booking.
• Service requirements: mobility or accessibility needs, food allergies, dietary requirements and limited health information relevant to safe participation.
• Identification information: passport or identity-document details only where genuinely required by law or by a confirmed provider. BLU avoids retaining copies unless necessary.
• Booking and financial information: booking references, services purchased, amounts, invoices, payment status and transaction references. BLU does not receive or store full payment-card details processed by SumUp or Revolut.
• Marketing information: newsletter subscription, consent record, communication preferences and unsubscribe status.
• Technical information: limited device, browser, IP-address and security-log data generated when the website is delivered or protected.
• Privacy-choice information: the cookie-policy version, categories selected and date of your choice, stored locally on your device.

03

Why we use information

Where BLU relies on legitimate interests, we consider the necessity of the processing and its effect on the people concerned. You may object where the GDPR provides that right.

04

Sensitive information and children

Mobility needs, allergies, dietary requirements or health information can reveal sensitive information. BLU requests only what is relevant to safe and suitable delivery of a journey and normally processes it with the traveler’s explicit consent. In a genuine emergency, information may also be used to protect vital interests or meet another applicable legal basis.

You may withdraw consent at any time. This will not affect processing already carried out lawfully, but it may mean BLU or a provider cannot safely deliver a requested element of the service.

Information about children must be supplied by a parent, guardian or authorised booking contact. BLU uses it only to plan and deliver the family’s service, meet safety requirements and comply with the law. BLU does not knowingly send direct marketing to children.

05

Where information comes from

We receive information directly from you through email, telephone, WhatsApp, Google Forms, the website, payment communications and conversations before or during a journey.

We may also receive information from the person making a group booking, a travel advisor, a family member, a guide or driver, a venue or another provider involved in the service. Anyone giving BLU information about another traveler should have authority to do so and should direct that traveler to this policy.

The current Plan Your Journey form prepares information in your own email application. Nothing is transmitted to BLU until you choose to send that email.

06

Who may receive information

BLU does not sell personal information. We share only what is reasonably necessary with:

• guides, drivers, venues and other providers delivering a confirmed service;
• Google Workspace, Google Drive and Google Forms for communication and controlled working records;
• Notion for customer-relationship and operational records;
• MailerLite for newsletter subscriptions and delivery;
• SumUp and Revolut for secure payment processing;
• WhatsApp and other communication services when you choose those channels;
• the current ChatGPT Sites hosting service and related network providers; and, when the production website is migrated, WordPress, Elementor and the selected hosting, security and technical providers;
• BLU’s accountant, insurer, lawyers and other professional advisers; and
• public authorities, regulators, courts or emergency services where required or justified by law.

Some journey providers act as independent controllers for information they need to provide their own service. Their privacy information will apply to that processing.

07

International data transfers

Some technology and communication providers may process information outside Portugal or the European Economic Area. Where EU data-protection law requires safeguards, BLU will rely on an adequacy decision, approved standard contractual clauses or another lawful transfer mechanism, together with appropriate supplementary measures where necessary.

The privacy terms of Google, Notion, MailerLite, SumUp, Revolut, Meta/WhatsApp and the website host provide further information about their processing locations and safeguards. BLU reviews the settings and contractual terms relevant to the services it uses.

08

How long we keep information

At the end of the relevant period, information is deleted, anonymised or securely restricted unless a longer period is required for a legal dispute, investigation or other legal obligation.

09

Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may ask BLU to:

• confirm whether we process your information and provide access to it;
• correct inaccurate or incomplete information;
• delete information or restrict how it is used;
• provide eligible information in a portable format;
• stop direct marketing at any time;
• consider an objection to processing based on legitimate interests; or
• record the withdrawal of consent where consent is the legal basis.

Send a request to hello@blucostatravel.com. BLU may ask for reasonable information to verify identity and will respond within the period required by law.

You may also lodge a complaint with Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD). We would welcome the opportunity to address your concern first.

BLU does not make decisions producing legal or similarly significant effects solely through automated processing.

10

Security, links and changes

BLU uses proportionate organisational and technical measures intended to protect personal information, including access controls, account security, data minimisation and carefully selected service providers. No method of transmission or storage can be guaranteed completely secure.

External websites and services have their own privacy practices. Please review their notices when leaving the BLU website. Information about website storage technologies appears in our Cookie Preferences.

We may update this policy when BLU’s services, providers or legal requirements change. Material changes will be highlighted where appropriate, and the effective date above will be revised.