Privacy policy

1. Categories of personal data collected

• Provided by you: Full name, email, phone number, booking/contact details, and payment information (when required to secure a booking).
• Collected automatically: IP address, device/browser information, pages visited, and date/time of access.
• Other: Photos and videos taken during tours or activities, used for promotional purposes.

2. Purposes of processing

We process personal data to:

• Manage bookings and deliver our services
• Process payments
• Respond to enquiries
• Send promotional communications (with consent)
• Improve our services and website
• Prevent fraud and meet legal obligations
• Use tour photos/videos promotionally (unless you object)

3. Legal basis

We rely on: contract performance (bookings, payments), consent (marketing, photos/videos), legal obligations (tax/accounting), and legitimate interests (security, fraud prevention, permitted marketing).

4. Sharing with third parties

We may share data with payment providers, email/marketing platforms (with consent), analytics providers (if we use them), and booking partners — all under data protection agreements. Mystic Mountain Travelers is not responsible for data collected by third-party booking platforms.

5. International transfers

Where data leaves the EEA, we use GDPR-compliant safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

Data is kept only as long as necessary for its purpose or as legally required. Payment card data is never stored on our servers.

7. Your rights

Under the GDPR, you can access, correct, delete, restrict, or object to processing of your data, and request data portability. Contact info@mysticmountain.pt to exercise these rights. We may verify your identity and decline manifestly unfounded requests.

8. Security

We use appropriate technical and organizational measures to protect your data, including encrypted payment transactions and restricted database access.

9. Photography and filming

We may photograph or film guests during activities for promotional use. No written consent is required, but you may opt out by informing staff or avoiding filming areas. Guests should ask each other's permission before filming one another.

10. Third-party links

Our website may link to external sites. We are not responsible for their privacy practices. See also our Cookie policy.

11. Policy updates

We may update this policy at any time. The current version is always available on our website.