Privacy Policy

1. Identification of the Data Controller

The entity responsible for processing personal data collected through Porchbuddyshuffle.surf is:

Our operations comply with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or GDPR) and Law n.º 58/2019 of the Portuguese Republic.

2. Categories of Personal Data Collected

We restrict data processing to what is strictly necessary to deliver informative travel editorial content and respond to correspondence. Categories collected include:

• Contact Information: When you complete our contact form, we collect your full name, email address, topic interest, and the specific text of your message.
• Technical & Log Data: Internet Protocol (IP) addresses, browser brand and version, operating system, referring URL, time stamps, and server response codes generated automatically during server requests.
• Cookie & Preference Telemetry: Records of your explicit consent choices via our cookie control system, as well as aggregated metrics regarding read duration and navigation paths.

3. Legal Bases and Purposes of Processing

Under Article 6 of the GDPR, we process personal data under the following legitimate grounds:

• Consent (Art. 6(1)(a)): For optional performance cookies and voluntary communications transmitted through our contact forms.
• Legitimate Interests (Art. 6(1)(f)): To maintain network security, prevent fraudulent server attacks, diagnose server outages, and improve editorial clarity across our Madeira destination guides.
• Legal Obligation (Art. 6(1)(c)): To comply with Portuguese commercial and accounting statutory duties where formal business correspondence occurs.

4. Third-Party Processors and International Transfers

We do not sell, rent, or trade your personal information to marketing brokers. We employ carefully audited third-party service providers (processors) under binding Data Processing Agreements (DPAs):

• Hosting Infrastructure: Dedicated secure servers located within the European Economic Area (EEA).
• Email Delivery Services: Encrypted SMTP gateways ensuring end-to-end transport security (TLS 1.3).
• Anonymous Metrics: Strictly aggregated European server-side analytics stripped of direct personal identifiers.

Should any technical operational transfer occur outside the EEA, we enforce European Commission Standard Contractual Clauses (SCCs) to ensure equivalent protection standards.

5. Data Retention Schedules

We retain personal data only for the period necessary to achieve the designated purposes:

• Contact Form Inquiries: Retained for a maximum period of twelve (12) months following the resolution of your inquiry, after which records are permanently purged.
• Server Security Logs: Retained on rolling cycles for thirty (30) days for intrusion detection before automatic erasure.
• Cookie Consent Preferences: Preserved locally in your browser storage for twelve (12) months or until you manually clear your browsing cache.

6. Your Rights Under GDPR and CCPA

Under European and applicable international data protection statutes, you possess unequivocal rights regarding your information:

• Right of Access (Art. 15 GDPR): Request a copy of all personal records we maintain regarding your identity.
• Right to Rectification (Art. 16 GDPR): Request the immediate correction of inaccurate or incomplete contact records.
• Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request the permanent deletion of your personal records where statutory retention mandates do not supersede.
• Right to Restriction of Processing (Art. 18 GDPR): Limit how we process your records during pending verification disputes.
• Right to Data Portability (Art. 20 GDPR): Receive your submitted contact information in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21 GDPR): Object to any processing justified under legitimate interests.
• California Consumer Privacy Act (CCPA) Rights: Residents of California possess the right to know what personal categories are collected, request non-discrimination, and request erasure. Porchbuddyshuffle does not sell personal information.

To exercise any of these rights, contact our Data Protection Officer at [email protected]. You also hold the right to lodge a formal regulatory complaint with Portugal's national supervisory authority: the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa (www.cnpd.pt).

7. Security Safeguards

We deploy modern technical and organizational measures, including TLS 1.3 data-in-transit encryption, hardened Linux web hosts, strict access controls, and regular patch cycles to safeguard information against unauthorized disclosure, loss, or alteration.

8. Policy Amendments

We may periodically revise this Privacy Policy to reflect evolving regulatory directives or operational updates. All changes will be published here with an updated effective date timestamp.