Privacy policy

OSL — Où Sortir à Lisbonne is the controller for the processing described here when it determines its purposes and means.

TANIA DOMINGAS FERREIRA BARROS, self-employed professional registered in Portugal · NIF 280054785
Business address: Rua Nossa Senhora de Fátima, 30, 4770-690 Sezures, Portugal
General and data-protection contact: contact@ousortiralisbonne.com
Phone: +351 966 998 827

This policy covers data processed through the OSL website, enquiry forms, email and WhatsApp communications, preparation and delivery of services, customer relationships, CRM, newsletters, and the document or operational tools actually used by OSL.

Depending on the channel and request, OSL may process:

• identity and contact data;
• dates, experience type, group size, preferences, budget and information needed to prepare a proposal;
• communications and attachments you voluntarily provide;
• data related to a service, booking, quotation or customer follow-up;
• communication preferences and evidence of consent, withdrawal or objection where relevant;
• technical information strictly necessary for operation, security and diagnosis.

When a Programme is saved, OSL may associate limited first-party acquisition context with the file: source, channel, campaign, landing page, external origin of the referring site and a bounded application-session identifier. The audited design stores neither click IDs nor the referrer query string and does not, by itself, create a marketing cookie or persistent attribution storage on the device.

OSL processes the data needed to answer an enquiry, understand a need and prepare a proposal on the basis of requested pre-contractual measures and, depending on context, the legitimate interest in responding to and managing a genuine enquiry.

Data needed to organise and deliver a service is processed on the basis of the contract, requested pre-contractual measures and applicable legal obligations.

Security and continuity processing relies on OSL’s legitimate interest in protecting its services, users and operations, and on applicable legal obligations where they exist.

Accounting and tax records, or information needed to establish, exercise or defend legal claims, are retained under legal obligations and, where appropriate, legitimate interests.

Communications required to handle an enquiry or service are separate from marketing. Electronic marketing to individuals generally relies on valid consent, subject to any applicable legal exception. Objection remains simple and free.

The limited acquisition context associated with a saved Programme relies on OSL’s legitimate interest in understanding enquiry origins, measuring channel effectiveness and improving the journey, without cross-site tracking, behavioural advertising, a standalone marketing profile or click IDs. A person may object on grounds relating to their situation by writing to contact@ousortiralisbonne.com.

Data is available only to people and providers who need it for the relevant purpose and within their authorised access.

Depending on the processing actually active, OSL may use CRM, messaging, hosting, cloud infrastructure, email, productivity, document storage, security or customer-communication providers. OSL also shares with an independent provider involved in a project only the information needed to obtain availability, prepare or deliver the requested service.

Some providers may process data outside the European Economic Area. In that case, OSL checks the applicable transfer mechanism and safeguards, such as an adequacy decision, the Data Privacy Framework where relevant, standard contractual clauses or another lawful mechanism. Public information is kept aligned with the suppliers and configurations actually active.

Using the site does not authorise non-essential cookies or trackers. Where consent is legally required to store or access information on the device, the technology is not enabled before a valid choice; refusal must be reasonably as accessible as acceptance and withdrawal must remain possible.

The limited first-party attribution mechanism described above does not, by itself, create a marketing cookie or persistent attribution storage on the device.

OSL keeps data only for as long as the purpose requires, unless a legal obligation or legitimate need related to legal claims applies.

• accounting and tax records subject to the relevant Portuguese rule are retained for 10 years where that rule applies;
• unconverted enquiries are kept while a genuine commercial or service purpose remains active, after which unnecessary data is deleted or anonymised unless another legal basis applies;
• customer files, quotations, bookings and services follow their contractual, operational, legal and dispute-related needs;
• evidence of consent, withdrawal and objection is reduced to the minimum needed;
• email, WhatsApp, CRM and documents inherit the retention criterion of the file they belong to;
• technical logs are kept for a period proportionate to their security or diagnostic purpose;
• raw PR32 attribution data is retained until the file is first closed as completed, cancelled or archived, after which session and acquisition context is deleted.

OSL applies measures proportionate to risk, including access control, least privilege, stronger authentication where available, limited sharing, separation of public and private information, incident handling, secret rotation where needed and pre-deployment checks. A non-indexed URL is not, by itself, access control.

Subject to the GDPR and applicable law, a person may request access, rectification, deletion, restriction or portability, object to certain processing and withdraw consent when consent is the legal basis.

Requests may be sent to contact@ousortiralisbonne.com. OSL responds without undue delay and generally within one month; this may be extended by two months under the GDPR, with notice during the first month.

A complaint may also be made to Portugal’s Comissão Nacional de Proteção de Dados — CNPD.

OSL may organise activities for school groups, but commercial forms should not collect children’s personal data directly where an adult organiser’s details are sufficient. Any new processing specifically aimed at children is assessed separately before launch.

This policy is reviewed when purposes, systems, providers, retention criteria or the legal framework change materially.