Privacy Policy
This policy explains how we handle your personal data when you visit this website (via-nia.com), contact us through the form or by email, or book our services. It is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and Portuguese Law No. 58/2019.
1. Data controller
Kseniia Kharkovskaia (Sole trader (self-employed)), tax ID (NIF) 323885454, located at Rua Dr. Jorge Sampaio, n.º 21, 4430-945 Vila Nova de Gaia, Portugal, trading as Via Nia.
Email: travel@via-nia.com
We have not appointed a Data Protection Officer. For any question about your personal data, please email us at the address above.
2. What data we process, why, and on what legal basis
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form (the “Contact” page) | Name, email, travel dates, group size, interests, how you heard about us (optional) and the message you write. | To reply to your enquiry and prepare a proposal. | Steps taken at your request before entering into a contract — Art. 6(1)(b) GDPR. |
| Trade enquiry form (the “For travel advisors” page) | Name, work email, company, role, your clients’ source markets and the message you write. | To reply to your enquiry and assess a professional collaboration. | Legitimate interest in business-to-business communication — Art. 6(1)(f) GDPR; steps before a contract — Art. 6(1)(b). |
| Email, WhatsApp and social media | The content of your messages and your email address, phone number (WhatsApp) or username. | To reply to you. | Art. 6(1)(b) GDPR. |
| A booked service (only if you book) | Names and contact details of participants, dates, preferences and — if you tell us — dietary or mobility needs; invoicing details (name, tax ID, address). | To organise and deliver the service; to issue invoices. | Performance of the contract — Art. 6(1)(b); tax and accounting obligations — Art. 6(1)(c) GDPR. |
| Running and securing the website | Technical logs processed by our hosting provider: IP address, date and time, pages requested, browser type. | To deliver the website and protect it from abuse. | Legitimate interest in keeping the site available and secure — Art. 6(1)(f) GDPR. |
| Guest testimonials and photos | First name, country, the text of the testimonial and/or an image. | To show other travellers’ experiences on the website and social media. | Consent — Art. 6(1)(a) GDPR. You can withdraw it at any time. |
| Defending rights | Only the data strictly necessary. | To establish, exercise or defend legal claims. | Legitimate interest — Art. 6(1)(f) GDPR. |
We do not use your data for marketing, we have no newsletter, we do not build profiles and we do not take automated decisions. If we ever start sending promotional messages, we will do so only with your prior consent, as required by Portuguese Law No. 41/2004, as amended.
Providing the form data is voluntary, but without your name and email we cannot reply to you.
3. Sensitive data
The form has a free-text field. Please do not include health, religious or other sensitive details unless they are needed to plan your trip (for example a dietary restriction or a mobility limitation). If you do, you give us your explicit consent to use them only for that purpose, under Art. 9(2)(a) GDPR. You can withdraw that consent at any time.
4. Who receives your data
- Netlify, Inc. (USA) — hosts this website and receives the messages sent through the form, which stay stored on the platform until we delete them. It acts as our processor. Netlify uses a third-party anti-spam service (Akismet) to screen form submissions.
- Hostinger (Cyprus (European Union)) — the email service where we receive your messages. It acts as our processor.
- Service providers for your experience (for example restaurants, producers, accommodation or transport), only if you book, and only with the data strictly necessary.
- Public authorities (for example the Portuguese Tax and Customs Authority, to which we report the invoices we issue) and a certified accountant, where applicable.
We do not sell your data.
5. Transfers outside the European Union
Netlify, Inc. is based in the United States. Transfers rely on appropriate safeguards, in particular the European Commission’s standard contractual clauses included in Netlify’s data processing agreement. Our email provider is based in Cyprus (European Union). You can ask us for more information about these safeguards at the email address above.
6. How long we keep your data
- Enquiries that do not lead to a booking: 12 months after our last contact, then deleted.
- Clients: for the duration of the contract and, for invoicing and accounting records, for the period required by law (generally 10 years).
- Testimonials and photos: until you withdraw your consent.
- Website technical logs: for the period set by our hosting provider.
- If there is a dispute, the necessary data is kept until it is resolved.
7. Your rights
You can at any time ask us for:
- Access to your data and a copy;
- Rectification of inaccurate or incomplete data;
- Erasure of your data;
- Restriction of processing;
- Portability of the data you gave us, where processing is based on consent or a contract and is carried out by automated means;
- Objection to processing based on legitimate interests;
- Withdrawal of consent wherever processing is based on it, without affecting the lawfulness of earlier processing.
How to exercise them: email travel@via-nia.com telling us what you would like. We may ask for information to confirm your identity. We reply within one month; for complex or numerous requests this may be extended by up to two further months, in which case we will tell you. Exercising your rights is free of charge.
Complaints: if you believe your rights have not been respected, you may lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt/cidadaos/participacoes. If you live in another EU Member State, you can complain to your local supervisory authority. You may also go to court.
8. Cookies
This website does not use cookies or similar analytics or advertising technologies. See our Cookie Policy.
9. Links to other websites
This website links to Instagram and to the Electronic Complaints Book. Once you click those links, the privacy policy of those services applies, and we have no control over it.
10. Security
We use appropriate technical and organisational measures, including an encrypted connection (HTTPS) across the whole website and restricted access to the messages we receive.
11. Children
This website is intended for adults. We do not knowingly collect data from children under 13.
12. Changes to this policy
We may update this policy. The date of the last update is at the top of the page.