Privacy Policy

Destinations of Wonder (“we”, “us”, “our”) operates the website located at destinationsofwonder.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, create an account, or subscribe to our newsletter. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese data protection law.

Please read this policy carefully. If you do not agree with its terms, please discontinue use of the site.

1. Data Controller

The data controller responsible for your personal data is:

Destinations of Wonder

Lisbon, Portugal

Email: hello@destinationsofwonder.com

Website: destinationsofwonder.com

2. What Data We Collect

We may collect the following categories of personal data:

a) Data you provide directly:

• Contact form: name, email address, and the content of your message.
• Newsletter subscription: email address and communication preferences.
• Account registration: name, email address, and password (stored in hashed form).

b) Data collected automatically:

• Usage data: pages visited, time on page, referral URLs, browser type, device type, and IP address.
• Cookie and tracking data: see our Cookie Policy for full details.

3. How We Use Your Data

We process your personal data on the following legal bases and for the following purposes:

• Performance of a contract (Art. 6(1)(b) GDPR): to manage your account and provide requested services.
• Legitimate interests (Art. 6(1)(f) GDPR): to analyse site performance, prevent fraud, and improve our editorial content.
• Consent (Art. 6(1)(a) GDPR): to send you our newsletter and to place non-essential cookies. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c) GDPR): where required by Portuguese or EU law.

4. Third-Party Services

We use the following third-party services that may process your personal data:

Google Analytics

We use Google Analytics to understand how visitors use our site. Google may transfer data to servers outside the EU/EEA. Data is pseudonymised and processed under Google’s standard contractual clauses. You can opt out via the Google Analytics Opt-out Browser Add-on.

Meta Pixel

We use the Meta Pixel to measure the effectiveness of our content and, if applicable, advertising on Facebook and Instagram platforms. Data is processed by Meta Platforms Ireland Ltd under their Data Processing Terms. You may manage your preferences via your Facebook/Instagram ad settings.

Booking.com Affiliate

Our site contains affiliate links to Booking.com. When you click these links, Booking.com may place cookies on your device to track referrals and process any resulting bookings. Booking.com acts as an independent data controller for data processed through their platform. Please refer to Booking.com’s Privacy Policy for details.

5. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy:

• Account data: retained for the duration of the account and up to 3 years after deletion.
• Newsletter data: until you unsubscribe or withdraw consent.
• Contact form data: up to 2 years from the date of your message.
• Analytics data: as configured in Google Analytics (default: 26 months).

6. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data (“right to be forgotten”).
• Right to restriction of processing — request that we limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at hello@destinationsofwonder.com. We will respond within 30 days. If you believe we have not complied with your rights, you have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Portugal’s data protection supervisory authority, at www.cnpd.pt.

7. International Transfers

Some third-party services we use (including Google Analytics and Meta) may transfer data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, in accordance with Chapter V of the GDPR.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include HTTPS encryption, access controls, and regular security reviews. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Children’s Privacy

Our website is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page will reflect any revisions. Continued use of the site after changes constitutes acceptance of the updated policy.

11. Contact

For any questions, concerns, or requests regarding this Privacy Policy, please contact us at: hello@destinationsofwonder.com