Legal
Privacy Policy
How we handle personal data before, during, and after every journey.
Our commitment
R.O Tailored Travel, operated by Romantic Odyssey Lda., treats privacy as part of the service itself. We collect only the information reasonably required to quote, organise, deliver, support, and account for a journey, and we expect the same discretion from every chauffeur and service partner working with us.
Data controller
Romantic Odyssey Lda., NIF 517261480, with registered office at Rua de Chibuto, Lote 410, R/C Esq., 1800-057 Lisboa, Portugal, is the controller of personal data processed through this website and the R.O Tailored Travel service. Privacy requests may be sent to booking@rotailoredtravel.pt or made by telephone on +351 919 732 224.
Information we collect
Depending on the service, this may include names, contact details, billing and tax details, booking references, pickup and destination addresses, dates and times, flight or train details, passenger and luggage counts, vehicle preferences, accessibility or child-seat requests, itinerary notes, correspondence, consent records, payment status, invoice references, and technical security logs.
Sensitive journey details
A client may voluntarily provide information concerning mobility, health, dietary, religious, security, or privacy requirements. We use such information only where necessary to fulfil the request, on an appropriate legal basis, and with access limited to the people who need it for the service.
Purposes and legal bases
We process data to prepare quotations and take pre-contractual steps; perform bookings and coordinate chauffeurs under the contract; issue invoices and meet tax, accounting, insurance, and regulatory duties; protect clients, staff, vehicles, payments, and systems on the basis of legitimate interests; and operate optional analytics or marketing only with valid consent where required.
Chauffeurs and partners
Relevant booking information may be shared with the assigned chauffeur, dispatch team, licensed transport partner, tour guide, venue, concierge supplier, or other provider necessary to deliver the itinerary. Partners receive only the information reasonably required for their role and are expected to protect it contractually and operationally.
Payments
Payment card details are collected directly by SumUp through its secure payment interface and do not pass through Romantic Odyssey Lda. systems. Strong Customer Authentication may be requested by SumUp or the card issuer. We do not store full card numbers or card security codes. We retain only the booking amount, currency, SumUp checkout and transaction identifiers, payment status, timestamps, refunds, chargebacks, fraud or reconciliation records, and invoice information required to perform the contract and meet legal obligations.
Technology providers
Romantic Odyssey Lda. may use carefully selected hosting, email, messaging, accounting, payment, security, mapping, autocomplete, and flight-information providers where required to operate the service. Providers act under appropriate contractual and security controls, and optional analytics or marketing tools are not activated without the consent required by law.
Virtual concierge
Common questions are answered in the browser from a limited R.O Tailored Travel knowledge base. If that local help cannot answer and the optional artificial-intelligence service is configured, only the most recent and limited chat messages are sent to the selected provider to draft a short reply. The concierge does not make legally significant automated decisions, confirm bookings, or request payment-card data. Visitors should not include sensitive documents or special-category personal data and may contact our human team instead.
International transfers
If a provider processes personal data outside the European Economic Area, we will use a lawful transfer mechanism where required, such as an adequacy decision or Standard Contractual Clauses, together with proportionate supplier and transfer-risk assessments.
Retention
Enquiries that do not become bookings are kept only for a reasonable follow-up period. Booking, payment, invoice, complaint, and tax records are retained for the periods required by Portuguese law or while a legal claim may reasonably arise. Operational notes and location details are minimised and removed when no longer necessary. Marketing records are kept until consent is withdrawn or the record becomes obsolete.
Your rights
Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing and may ask for human review of any legally significant automated decision. We may request proportionate proof of identity before acting on a request.
Complaints and response time
We aim to respond to a valid rights request within one month, subject to any lawful extension for complex requests. You may also lodge a complaint with the Comissão Nacional de Proteção de Dados in Portugal or, where applicable, another EEA supervisory authority.
Security and incidents
We apply technical and organisational measures appropriate to the service, including restricted administrative access, separation of browser-visible and server-only credentials, secure transmission in production, data minimisation, staff confidentiality, and proportionate supplier controls. These measures are reviewed as the service and its infrastructure evolve. If a personal-data breach presents a legally reportable risk, we will notify the competent authority and affected individuals as required.
Children and bookings for others
Services involving minors must be booked by a responsible adult. A person booking for other passengers must be authorised to provide their information and should direct them to this policy where appropriate.
Policy changes
We may update this policy when the service, suppliers, or law changes. Material changes will be identified by a revised date and, where appropriate, brought to the attention of registered clients.