Privacy Policy

The PASS Algarve platform is operated by GORGEOUS BLOSSOM TOURISM LDA, registered under tax number (NIF/NIPC) 517 954 095, with registered office in Lagos, Algarve, Portugal (hereinafter "PASS Algarve").

PASS Algarve is the controller of the personal data collected through the passalgarve.com website and associated services.

For any question relating to the processing of personal data, users may contact us at info@passalgarve.com.

In the context of using the platform, the following personal data may be collected:

• identification data: first and last name;
• contact data: email address;
• account data: access credentials (the password is stored in encrypted form);
• purchase data: passports purchased, quantity, holder names provided, purchase and usage history;
• payment data: processed directly by Stripe — PASS Algarve does not store card numbers;
• PASS usage data: QR Code validations, date, time and attraction visited;
• technical data: IP address, device type and browser, where necessary for the security and operation of the platform.

Personal data is processed for the following purposes:

• creation and management of the customer account;
• processing of purchases and issuance of digital passports and QR Codes;
• sending communications necessary for the performance of the service (purchase confirmations, QR Codes, changes and cancellations);
• validation of passports at partner attractions;
• management of bookings, where applicable;
• customer support;
• prevention and detection of fraud and misuse;
• compliance with legal, tax and accounting obligations.

Data processing is based on the following grounds provided for in the GDPR:

• performance of a contract (art. 6(1)(b)): account management, purchases, issuance and validation of passports;
• compliance with legal obligations (art. 6(1)(c)): invoicing and tax obligations;
• legitimate interest (art. 6(1)(f)): platform security and fraud prevention;
• consent (art. 6(1)(a)): commercial communications, where applicable.

Personal data may be shared, to the extent strictly necessary, with:

• partners and suppliers of the attractions, exclusively for PASS validation and delivery of the experience (holder name and passport status);
• Stripe (payment processing and Stripe Connect);
• technology service providers that support the platform (hosting, transactional email sending and image storage);
• public authorities, where legally required.

PASS Algarve does not sell personal data to third parties.

Some service providers may be located outside the European Economic Area. In such cases, PASS Algarve ensures that transfers are carried out with appropriate safeguards, namely standard contractual clauses approved by the European Commission.

Personal data is kept only for the period necessary for the purposes for which it was collected:

• account data: while the account remains active;
• purchase and invoicing data: for the applicable legal periods (as a general rule, 10 years for tax purposes);
• PASS validation data: during the passport's validity period and for the periods necessary to manage any complaints;
• data processed on the basis of consent: until consent is withdrawn.

Under the GDPR, users have the right to:

• access their personal data;
• request the rectification of inaccurate data;
• request the erasure of data, where applicable;
• request the restriction of processing;
• object to processing, in the cases provided for by law;
• request data portability;
• withdraw consent at any time, without affecting the lawfulness of the processing carried out until that date.

To exercise their rights, users should contact info@passalgarve.com. PASS Algarve will respond within a maximum of one month, extendable under the law.

Users also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt.

PASS Algarve adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or improper disclosure, including encrypted communications (HTTPS), encrypted credential storage and role-based access control.

Payments are processed by Stripe, a PCI-DSS certified entity; full card details never pass through PASS Algarve's servers.

The platform uses cookies and similar technologies strictly necessary for its operation, namely for session management and language preferences.

Where non-essential cookies are used (for example, for analytics or marketing purposes), they will only be activated with the user's consent.

The platform is not intended for the creation of accounts by minors under 16 years of age. Purchases must be made by adults, who may indicate the names of the passport holders, including minors under their responsibility.

PASS Algarve may update this Privacy Policy whenever necessary. The updated version will be published on the platform with an indication of the date of the last update.

We recommend checking this page periodically.