Privacy Policy (GDPR)

MADEIRA CAMPER

Preamble

MadeiraCamper ("MadeiraCamper", "we", "our" or "us") respects the privacy of all individuals who visit our website, make bookings through our platform or otherwise interact with our services. We recognise the importance of protecting personal data and are committed to processing such data lawfully, fairly and transparently.

This Privacy Policy explains how MadeiraCamper collects, uses, stores, shares and otherwise processes personal data obtained through the MadeiraCamper website, during the booking process, throughout the administration of campervan rentals and in connection with communications with Customers, Owners and other users of our services.

The purpose of this Privacy Policy is to provide clear information regarding:

• the categories of personal data we collect;
• the purposes for which personal data is processed;
• the legal bases relied upon for processing;
• the circumstances in which personal data may be shared with third parties;
• the safeguards implemented to protect personal data;
• the period for which personal data is retained;
• the rights available to individuals under applicable data protection legislation; and
• the procedures for exercising those rights.

MadeiraCamper processes personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR);
• applicable Portuguese data protection legislation;
• applicable legislation concerning electronic communications and online services; and
• any other laws governing the processing and protection of personal data that may apply from time to time.

MadeiraCamper is committed to ensuring that personal data is processed only where there is a lawful basis for doing so, that appropriate technical and organisational measures are implemented to protect such data, and that individuals are able to exercise their rights in accordance with applicable law.

This Privacy Policy applies to all visitors to the Website, prospective Customers, Customers, vehicle Owners, business partners and any other individuals whose personal data is processed by MadeiraCamper in connection with the services offered through the Website.

Where MadeiraCamper provides links to third-party websites, services or platforms, this Privacy Policy applies solely to the processing of personal data carried out by MadeiraCamper. Third-party websites and services operate under their own privacy policies, and MadeiraCamper accepts no responsibility for their privacy practices.

By accessing the Website or using the services provided by MadeiraCamper, you acknowledge that you have read and understood this Privacy Policy. Where processing is based on consent, such consent will be obtained separately whenever required by applicable law and may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

1. Who We Are

1.1. MadeiraCamper ("MadeiraCamper", "we", "our" or "us") operates an online platform that facilitates the promotion, booking and administration of campervan rentals offered by independent campervan Owners in Portugal.

1.2. MadeiraCamper acts as the commercial intermediary between Customers and independent Owners, providing services that include, among others:

• a) the operation and management of the MadeiraCamper website;
• b) the promotion and advertising of campervans;
• c) the administration of booking requests and reservations;
• d) customer and owner communications;
• e) payment administration and related support services; and
• f) general administrative assistance connected with the booking process.

1.3. For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), MadeiraCamper acts as the Data Controller in respect of the personal data processed for the operation of its Website, the administration of bookings, customer support, payment administration, legal compliance and other activities described in this Privacy Policy.

1.4. Independent campervan Owners may also process personal data in connection with the performance of the Rental Agreement entered into directly with the Customer. Where Owners determine the purposes and means of processing such personal data independently, they act as separate Data Controllers and are individually responsible for complying with their own legal obligations under applicable data protection legislation.

1.5. MadeiraCamper is committed to processing personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability established under the GDPR.

Contact Details

For any questions relating to this Privacy Policy or the processing of personal data, you may contact MadeiraCamper using the following details:

1.6. If MadeiraCamper appoints a Data Protection Officer ("DPO") or a designated privacy representative in the future, the relevant contact details will be published on the Website and updated in this Privacy Policy.

2. Personal Data We Collect

2.1. MadeiraCamper collects and processes personal data only to the extent necessary for the operation of the Website, the administration of bookings, compliance with legal obligations and the provision of related services.

2.2. Depending on your interaction with MadeiraCamper, we may collect the following categories of personal data:

A. Identity Information

This may include:

• full name;
• date of birth, where required;
• nationality, where required;
• government-issued identification details, including passport or national identity card, where required by law or the applicable Rental Agreement;
• driving licence information, including licence number, issuing country, expiry date and any other information reasonably required to verify eligibility to rent or drive a campervan.

B. Contact Information

This may include:

• residential address;
• billing address;
• email address;
• telephone or mobile number;
• emergency contact details, where voluntarily provided or required for the rental.

C. Booking Information

This may include:

• selected campervan;
• booking reference number;
• rental dates;
• collection and return locations;
• booking status;
• optional services requested;
• communications relating to the booking;
• cancellation or amendment information.

D. Payment Information

This may include:

• billing information;
• payment confirmations;
• transaction reference numbers;
• refund information;
• security deposit information;
• a reference token identifying a securely saved payment method, where the Customer has consented to this at the time of booking, used solely to enable the security deposit process described in our Terms & Conditions.

MadeiraCamper does not collect or store complete payment card numbers, CVV codes or other sensitive payment credentials. Payment card transactions are processed securely by our authorised payment service provider, currently Stripe, in accordance with its own privacy and security standards.

E. Communications

We may collect records of communications exchanged with MadeiraCamper, including:

• emails;
• contact form submissions;
• customer support enquiries;
• complaints;
• feedback;
• correspondence relating to bookings;
• communications necessary to administer rentals.

F. Technical Information

When you use the Website, we may automatically collect certain technical information, including:

• IP address;
• browser type and version;
• operating system;
• device information;
• language preferences;
• referring websites;
• pages visited;
• date and time of access;
• approximate geographical location derived from IP address;
• system logs and security information.

G. Cookie and Usage Information

Subject to our Cookie Policy and, where required, your consent, we may collect information through cookies and similar technologies, including:

• website usage patterns;
• session information;
• user preferences;
• analytics information;
• security and fraud prevention information.

H. Information Provided by Owners

Where necessary for the administration of bookings, Owners may provide MadeiraCamper with information relating to:

• vehicle collection and return;
• vehicle inspections;
• reported damage;
• contractual incidents;
• rental completion;
• other information reasonably required for the administration of the booking.

2.3. MadeiraCamper does not intentionally collect special categories of personal data (also known as "sensitive personal data") as defined by Article 9 of the GDPR, unless such processing is strictly necessary to comply with a legal obligation, to establish, exercise or defend legal claims, or another lawful basis applies under applicable law.

2.4. MadeiraCamper requests that users do not provide unnecessary personal data or personal information relating to third parties unless they have the legal authority or consent to do so.

2.5. Where personal data is required to comply with legal obligations or to perform a contract, failure to provide the requested information may prevent MadeiraCamper or the respective Owner from completing a booking, processing a payment or providing the requested services.

3. How We Collect Personal Data

3.1. MadeiraCamper collects personal data through a variety of lawful means, depending on how individuals interact with the Website and our services.

A. Information Provided Directly by You

We collect personal data that you voluntarily provide when you:

• create or submit a booking request;
• complete forms available on the Website;
• contact MadeiraCamper by email, telephone or other communication channels;
• request information about our services;
• subscribe to newsletters or marketing communications, where available;
• submit enquiries, complaints or feedback;
• communicate with us before, during or after a booking.

3.2. You are responsible for ensuring that the personal data you provide is accurate, complete and up to date. Where you provide personal data relating to another individual, you confirm that you have the necessary authority or legal basis to do so.

B. Information Collected Automatically

When you access or use the Website, certain technical and usage information may be collected automatically through cookies, server logs and similar technologies. Such information may include:

• IP address;
• browser type and version;
• operating system;
• device identifiers;
• language settings;
• pages visited;
• date and time of access;
• referral source;
• session information;
• security logs;
• other technical information necessary for the operation and protection of the Website.

The use of cookies and similar technologies is described in our Cookie Policy.

C. Information Collected During the Booking Process

Additional personal data may be collected throughout the administration of a booking, including:

• booking confirmations;
• payment confirmations;
• rental details;
• amendments or cancellations;
• communications relating to the booking;
• customer support records;
• information reasonably required to administer the rental.

D. Information Received from Independent Owners

Where necessary for the administration of bookings and the performance of our intermediary services, MadeiraCamper may receive relevant personal data from the respective Owner, including information relating to:

• vehicle collection and return;
• verification of customer identity or driving licence;
• rental status;
• vehicle inspections;
• reported incidents;
• damage reports;
• contractual matters connected with the Rental Agreement.

E. Information Received from Third-Party Service Providers

Where permitted by law, MadeiraCamper may receive personal data from carefully selected third-party service providers that support the operation of our business, including:

• authorised payment service providers;
• website hosting providers;
• communication service providers;
• fraud prevention and security service providers;
• identity verification providers, where applicable;
• other service providers necessary for the provision of our services.

MadeiraCamper processes such information only where there is an appropriate legal basis under applicable data protection legislation.

3.3. MadeiraCamper does not intentionally collect personal data from publicly available sources unless such collection is necessary for legal compliance, fraud prevention, the establishment, exercise or defence of legal claims, or another lawful purpose permitted by applicable law.

3.4. Where personal data is obtained from sources other than the individual concerned, MadeiraCamper shall provide the information required by applicable data protection legislation within the time limits prescribed by law, unless an exemption applies.

4. Purposes of Processing

4.1. MadeiraCamper processes personal data only for specified, explicit and legitimate purposes. We will not process personal data in a manner that is incompatible with the purposes for which it was originally collected, unless permitted or required by applicable law.

4.2. Depending on the nature of your interaction with MadeiraCamper, your personal data may be processed for one or more of the following purposes:

A. Booking Administration

To administer the booking process and facilitate campervan rentals, including:

• processing booking requests;
• confirming reservations;
• coordinating vehicle collection and return;
• communicating with Customers and Owners;
• administering amendments, cancellations and refunds;
• maintaining booking records.

B. Identity and Eligibility Verification

To verify, where necessary:

• the identity of Customers;
• driving licence validity and eligibility to rent a campervan;
• compliance with legal, contractual or insurance requirements;
• the accuracy of information provided during the booking process.

C. Payment Administration

To administer payments and related financial transactions, including:

• processing booking payments;
• facilitating security deposit procedures;
• processing refunds where applicable;
• maintaining financial records;
• preventing payment fraud.

Payment transactions are processed through our authorised payment service provider. MadeiraCamper does not store complete payment card details.

D. Customer Support and Communications

To communicate with Customers and Owners regarding:

• bookings;
• enquiries;
• customer support;
• complaints;
• dispute resolution;
• operational updates;
• important notices relating to the Website or our services.

E. Legal and Regulatory Compliance

To comply with applicable legal and regulatory obligations, including:

• accounting and tax requirements;
• consumer protection legislation;
• data protection obligations;
• anti-fraud measures;
• requests from competent public authorities where legally required;
• the establishment, exercise or defence of legal claims.

F. Website Operation and Improvement

To operate, maintain and improve the Website and our services, including:

• analysing Website performance;
• identifying technical issues;
• improving functionality and user experience;
• maintaining system security;
• preventing unauthorised access or misuse;
• developing new features and services.

G. Fraud Prevention and Security

To protect MadeiraCamper, Customers and Owners against fraud, abuse and unlawful activity by:

• detecting suspicious transactions;
• preventing unauthorised access;
• maintaining system logs;
• investigating security incidents;
• protecting the integrity of the Website and our services.

H. Legitimate Business Interests

Where appropriate and permitted by law, MadeiraCamper may process personal data for its legitimate business interests, including:

• protecting its legal rights and contractual interests;
• administering its business operations;
• improving customer service;
• maintaining internal records;
• managing business risks;
• enforcing contractual terms;
• protecting the security and reputation of the MadeiraCamper platform.

4.3. MadeiraCamper will not use personal data for automated decision-making or profiling that produces legal effects or similarly significant effects on individuals, unless such processing is authorised by applicable law or carried out with the individual's explicit consent.

4.4. Where MadeiraCamper wishes to process personal data for a purpose that is materially different from the purpose for which it was originally collected, we will provide additional information where required by applicable law before carrying out such processing.

5. Legal Basis for Processing

5.1. MadeiraCamper processes personal data only where there is a lawful basis for doing so under Article 6 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

5.2. Depending on the circumstances, the processing of personal data may be based on one or more of the following legal grounds:

A. Performance of a Contract

We process personal data where such processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.

This includes, for example:

• administering booking requests;
• confirming reservations;
• facilitating communications between Customers and Owners;
• processing payments and refunds;
• providing customer support;
• administering services requested by the Customer.

B. Compliance with Legal Obligations

We process personal data where necessary to comply with legal obligations imposed upon MadeiraCamper, including obligations arising under:

• tax and accounting legislation;
• consumer protection legislation;
• data protection legislation;
• anti-fraud requirements;
• judicial or administrative requests;
• any other applicable legal or regulatory requirement.

C. Legitimate Interests

Where appropriate, MadeiraCamper processes personal data where such processing is necessary for its legitimate interests or those of a third party, provided that those interests are not overridden by the rights and freedoms of the individual.

Such legitimate interests may include:

• operating and improving the Website;
• administering bookings efficiently;
• protecting the security of the Website and our systems;
• preventing fraud and unauthorised use;
• maintaining business records;
• defending legal claims;
• enforcing contractual rights;
• improving customer service;
• ensuring the proper administration of our business.

Whenever processing is based on legitimate interests, MadeiraCamper carefully considers and balances its interests against the rights and freedoms of the individuals concerned.

D. Consent

Where required by applicable law, MadeiraCamper will process personal data on the basis of the individual's freely given, specific, informed and unambiguous consent.

Consent may be requested, for example, for:

• sending marketing communications where required by law;
• placing non-essential cookies or similar technologies;
• other processing activities for which consent is the appropriate legal basis.

Where processing is based on consent, individuals may withdraw that consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

5.3. MadeiraCamper will not process personal data for purposes incompatible with those described in this Privacy Policy unless a new lawful basis exists or the processing is otherwise permitted or required by applicable law.

5.4. Where more than one legal basis applies to a particular processing activity, MadeiraCamper may rely on the legal basis that is most appropriate in the circumstances and permitted by applicable law.

6. Payment Processing

6.1. MadeiraCamper facilitates the administration of payments relating to bookings made through the Website by using an authorised third-party payment service provider.

6.2. At the date of publication of this Privacy Policy, payment services are provided by Stripe. MadeiraCamper may replace or appoint an alternative authorised payment service provider where reasonably necessary for operational, commercial or legal reasons. The most current payment provider will be identified on the Website where appropriate.

6.3. Payment transactions are processed directly through the payment service provider using secure payment technologies and industry-standard encryption designed to protect payment information during transmission.

6.4. MadeiraCamper does not receive, collect or store complete payment card numbers, Card Verification Value (CVV/CVC) codes or other sensitive payment authentication credentials entered during the payment process.

6.5. Where a booking requires a security deposit, and with the Customer's consent obtained at the time of booking, MadeiraCamper may instruct the payment service provider to securely save the Customer's payment method for the purpose of placing a pre-authorisation for the security deposit closer to the scheduled vehicle collection date and, where necessary, renewing that pre-authorisation for the duration of the rental, as described in our Terms & Conditions. The saved payment method is held and processed exclusively by the payment service provider in accordance with its own security standards; MadeiraCamper does not itself store the underlying card details, and only receives a reference token identifying the saved payment method.

6.6. MadeiraCamper may receive limited transaction-related information from the payment service provider where necessary for the administration of bookings, including, where applicable:

• payment confirmation;
• transaction reference numbers;
• payment status;
• refund status;
• partial payment information (such as the last four digits of a payment card, where provided);
• billing information necessary for accounting, customer support or fraud prevention.

6.7. Personal data processed in connection with payment transactions is handled in accordance with this Privacy Policy and the privacy policy of the relevant payment service provider. Users are encouraged to review the privacy information published by the applicable payment service provider before completing a payment.

6.8. The payment service provider acts as an independent Data Controller or Data Processor, as applicable under data protection legislation, in relation to the payment processing services it provides. The processing of payment information by the payment service provider is governed by its own terms, privacy policy and applicable legal obligations.

6.9. MadeiraCamper may process payment-related information for the purposes of:

• administering bookings;
• confirming successful payments;
• processing refunds;
• facilitating security deposit procedures, including the saving of a payment method and the placing and, where necessary, renewal of a security deposit pre-authorisation as described above;
• complying with accounting and tax obligations;
• preventing fraud and unauthorised transactions;
• resolving payment-related enquiries and disputes.

6.10. MadeiraCamper implements appropriate organisational and technical measures to protect payment-related information within its control. However, the security of payment card information transmitted directly to the payment service provider, including saved payment methods, is primarily the responsibility of that provider.

6.11. Where payment transactions cannot be completed successfully due to technical failures, insufficient funds, security checks, incorrect payment information or other circumstances beyond MadeiraCamper's reasonable control, MadeiraCamper shall not be responsible for any resulting delays or failed transactions, although we will make reasonable efforts to assist Customers in resolving payment-related issues where appropriate.

7. Sharing of Personal Data

7.1. MadeiraCamper treats personal data as confidential and does not sell, rent or otherwise disclose personal data to third parties for their own marketing purposes.

7.2. Personal data will only be shared where necessary for the operation of the Website, the administration of bookings, the performance of contractual obligations, compliance with legal requirements or the protection of MadeiraCamper's legitimate interests, and always in accordance with applicable data protection legislation.

7.3. Depending on the circumstances, MadeiraCamper may share personal data with the following categories of recipients:

A. Independent Campervan Owners

Where necessary to facilitate and administer a booking, MadeiraCamper may share relevant personal data with the respective Owner, including information reasonably required to:

• confirm the booking;
• verify the Customer's identity and eligibility to rent;
• arrange vehicle collection and return;
• perform the Rental Agreement;
• communicate with the Customer during the rental period;
• comply with legal, insurance or contractual obligations.

Each Owner is independently responsible for the personal data they process in connection with the Rental Agreement and must comply with applicable data protection legislation.

B. Payment Service Providers

Personal data necessary to process payments may be shared with MadeiraCamper's authorised payment service provider, currently Stripe, or any replacement provider appointed in the future.

Payment providers process personal data in accordance with their own privacy policies and applicable legal obligations.

C. Professional Advisers

Where reasonably necessary, personal data may be disclosed to MadeiraCamper's professional advisers, including:

• accountants;
• auditors;
• legal advisers;
• tax advisers;
• insurance advisers;
• other professional consultants engaged by MadeiraCamper.

Such disclosures are limited to what is reasonably necessary for the provision of professional services and are subject to appropriate confidentiality obligations.

D. Technology and Service Providers

MadeiraCamper may engage carefully selected third-party service providers to support the operation of the Website and our business, including providers of:

• website hosting;
• cloud storage;
• email and communication services;
• information technology support;
• cybersecurity services;
• fraud prevention;
• customer support tools;
• website maintenance.

Where such providers process personal data on MadeiraCamper's behalf, they do so under written agreements requiring them to process personal data only in accordance with MadeiraCamper's instructions and applicable data protection legislation.

E. Insurance Providers

Where necessary in connection with an insurance claim, accident, damage report or legal requirement arising from a rental, relevant personal data may be shared with insurers, insurance brokers or claims administrators involved in the matter.

F. Competent Authorities

MadeiraCamper may disclose personal data where required or permitted by applicable law, including to:

• courts;
• law enforcement authorities;
• tax authorities;
• regulatory bodies;
• judicial authorities;
• other competent public authorities.

Such disclosures will be limited to what is required or permitted under applicable law.

7.4. MadeiraCamper may also disclose personal data where reasonably necessary to:

• establish, exercise or defend legal claims;
• investigate suspected fraud or unlawful activity;
• protect the rights, property or safety of MadeiraCamper, Customers, Owners or other persons;
• enforce our contractual rights and legal obligations.

7.5. MadeiraCamper requires third parties processing personal data on its behalf to implement appropriate technical and organisational measures to safeguard personal data and to comply with applicable data protection legislation.

7.6. MadeiraCamper does not permit third-party service providers to use personal data for their own independent commercial purposes unless they act as independent Data Controllers under applicable law and have their own lawful basis for processing.

8. International Transfers of Personal Data

8.1. MadeiraCamper primarily processes and stores personal data within the European Economic Area ("EEA"). However, certain service providers engaged by MadeiraCamper may process personal data in countries outside the EEA where this is necessary for the provision of their services.

8.2. International transfers of personal data may occur where MadeiraCamper uses carefully selected third-party service providers for functions including, but not limited to:

• payment processing;
• cloud hosting and data storage;
• website infrastructure;
• email and communication services;
• cybersecurity and fraud prevention;
• technical support;
• other business support services.

8.3. Where personal data is transferred to a country outside the EEA that has not been recognised by the European Commission as providing an adequate level of data protection, MadeiraCamper shall ensure that appropriate safeguards are implemented in accordance with Chapter V of the GDPR.

Such safeguards may include, where applicable:

• the European Commission's Standard Contractual Clauses ("SCCs");
• an adequacy decision adopted by the European Commission;
• approved codes of conduct or certification mechanisms;
• binding corporate rules; or
• any other transfer mechanism recognised under applicable data protection legislation.

8.4. MadeiraCamper takes reasonable steps to ensure that any recipient of personal data outside the EEA provides an appropriate level of protection and processes personal data in accordance with applicable data protection legislation.

8.5. Where legally required, MadeiraCamper will provide additional information regarding international data transfers upon request, including information about the applicable safeguards relied upon for a particular transfer, subject to legal and commercial confidentiality obligations.

8.6. MadeiraCamper periodically reviews its relationships with third-party service providers to help ensure that international transfers of personal data continue to comply with applicable data protection legislation and evolving regulatory requirements.

9. Data Retention

9.1. MadeiraCamper retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including the performance of contractual obligations, compliance with legal and regulatory requirements, the protection of legitimate business interests and the establishment, exercise or defence of legal claims.

9.2. The retention period applicable to personal data will depend on the nature of the information, the purpose for which it was collected and the legal obligations applicable to MadeiraCamper.

9.3. Personal data may be retained for purposes including, but not limited to:

• administering bookings and customer accounts;
• processing payments and refunds;
• maintaining accounting and financial records;
• complying with tax and fiscal legislation;
• responding to complaints, disputes or legal proceedings;
• preventing fraud and protecting the security of the Website;
• complying with requests from competent public authorities where required by law.

9.4. Certain records, including accounting, financial and tax documentation, may be retained for the minimum periods required under applicable Portuguese legislation, even where the contractual relationship has ended.

9.5. Where personal data is no longer required for the purposes for which it was collected and no legal obligation or legitimate interest justifies its continued retention, MadeiraCamper will securely delete, anonymise or otherwise dispose of the personal data in accordance with its internal data retention procedures and applicable law.

9.6. Where legal proceedings, investigations, regulatory enquiries or disputes are ongoing or reasonably anticipated, MadeiraCamper may retain relevant personal data for a longer period where necessary to establish, exercise or defend legal claims or to comply with legal obligations.

9.7. MadeiraCamper periodically reviews the personal data it holds to ensure that information is not retained for longer than is necessary or permitted under applicable data protection legislation.

10. Security of Personal Data

10.1. MadeiraCamper is committed to protecting the security, confidentiality and integrity of the personal data entrusted to us. We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to personal data.

10.2. The security measures implemented by MadeiraCamper are designed having regard to the nature of the personal data processed, the risks associated with the processing, the state of the art, the costs of implementation and the requirements of applicable data protection legislation.

10.3. Depending on the circumstances, such measures may include:

• secure encrypted communications (including HTTPS where appropriate);
• access controls and user authentication;
• restricted access to personal data on a need-to-know basis;
• secure password management procedures;
• firewalls and network security measures;
• regular software updates and security maintenance;
• data backup and recovery procedures;
• monitoring and logging of system activity where appropriate;
• secure storage of electronic records;
• confidentiality obligations applicable to personnel and service providers.

10.4. MadeiraCamper also requires third-party service providers processing personal data on its behalf to implement appropriate technical and organisational security measures consistent with applicable data protection legislation.

10.5. Although MadeiraCamper takes reasonable steps to protect personal data, no method of electronic transmission, internet communication or electronic storage can be guaranteed to be completely secure. Accordingly, MadeiraCamper cannot guarantee absolute security and users provide personal data at their own risk, subject always to our legal obligations under applicable law.

10.6. In the event of a personal data breach, MadeiraCamper will assess the incident without undue delay and, where required by applicable law, will notify the competent supervisory authority and affected individuals in accordance with the GDPR and applicable Portuguese legislation.

10.7. MadeiraCamper periodically reviews and updates its security measures to help ensure that they remain appropriate to the nature of the personal data processed, technological developments and evolving security risks.

11. Your Rights Under the GDPR

11.1. Subject to the conditions and limitations set out in the General Data Protection Regulation ("GDPR") and other applicable legislation, individuals whose personal data is processed by MadeiraCamper have the following rights.

A. Right of Access

You have the right to request confirmation as to whether MadeiraCamper processes your personal data and, where that is the case, to obtain access to that personal data together with certain information about how it is processed.

B. Right to Rectification

You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data held by MadeiraCamper.

C. Right to Erasure ("Right to be Forgotten")

In certain circumstances, you have the right to request the deletion of your personal data where there is no legal basis requiring its continued retention.

This right is not absolute and may be limited where MadeiraCamper is required by law to retain certain information or where retention is necessary for the establishment, exercise or defence of legal claims.

D. Right to Restriction of Processing

You may request that MadeiraCamper restrict the processing of your personal data in certain circumstances provided for under the GDPR.

E. Right to Data Portability

Where processing is based on consent or the performance of a contract and carried out by automated means, you may request to receive your personal data in a structured, commonly used and machine-readable format or request that it be transmitted directly to another data controller where technically feasible.

F. Right to Object

You have the right to object, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on MadeiraCamper's legitimate interests or other legal grounds provided for under applicable law.

Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.

G. Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. The withdrawal of consent shall not affect the lawfulness of any processing carried out before consent was withdrawn.

H. Rights Relating to Automated Decision-Making

Where applicable under the GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where permitted by applicable law.

As stated in this Privacy Policy, MadeiraCamper does not currently carry out automated decision-making or profiling that produces such legal or similarly significant effects.

11.2. Requests concerning the exercise of any of the above rights may be submitted using the contact details provided in this Privacy Policy.

MadeiraCamper may request reasonable information to verify the identity of the individual before responding to a request in order to protect personal data against unauthorised disclosure.

11.3. MadeiraCamper will respond to valid requests within the time limits established by the GDPR. Where permitted by law, the response period may be extended where a request is particularly complex or where multiple requests have been submitted.

11.4. The exercise of these rights is generally free of charge. However, MadeiraCamper reserves the right to charge a reasonable administrative fee or refuse to act on requests that are manifestly unfounded, excessive or repetitive, to the extent permitted by applicable law.

11.5. If you believe that MadeiraCamper has processed your personal data in breach of applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

In Portugal, the competent supervisory authority is the Comissão Nacional de Proteção de Dados ("CNPD"), without prejudice to your right to seek judicial remedies or to lodge a complaint with another competent supervisory authority within the European Union.

11.6. MadeiraCamper encourages individuals to contact us first regarding any concerns about the processing of their personal data so that we may have the opportunity to address the matter promptly and fairly.

12. Cookies

12.1. MadeiraCamper uses cookies and similar technologies on the Website to ensure its proper operation, improve functionality, enhance security, analyse Website performance and, where applicable, personalise the user experience.

12.2. Depending on the circumstances, the Website may use the following categories of cookies:

• Essential Cookies, which are necessary for the operation, security and core functionality of the Website and cannot be disabled through our cookie preferences;
• Functional Cookies, which remember user preferences and improve the usability of the Website;
• Analytical Cookies, which help us understand how visitors interact with the Website and enable us to improve its performance and services;
• Security Cookies, which assist in detecting fraudulent activity, protecting user accounts and maintaining the integrity and security of the Website.

12.3. Where required by applicable law, non-essential cookies will only be placed on your device after you have provided your consent through the Website's cookie consent mechanism.

12.4. You may manage or withdraw your cookie preferences at any time through the cookie settings available on the Website or by adjusting your web browser settings. Please note that disabling certain cookies may affect the functionality and performance of the Website.

12.5. Further information regarding the cookies used by MadeiraCamper, including their purposes, retention periods and how you may manage your preferences, is available in our separate Cookie Policy, which forms part of this Privacy Policy and should be read together with it.

13. Third-Party Services

13.1. The Website may incorporate or make available certain third-party services that support the operation of MadeiraCamper's platform and the services offered to Customers and Owners.

13.2. Such third-party services may include, where applicable:

• payment service providers;
• interactive maps and location services;
• website analytics and performance tools;
• website hosting and cloud infrastructure services;
• communication and email platforms;
• customer support tools;
• fraud prevention and security services;
• other technology providers reasonably required for the operation of the Website.

13.3. Certain third-party services may collect or process personal data independently of MadeiraCamper. In such cases, those providers act as independent Data Controllers or otherwise process personal data in accordance with their own privacy policies, terms of service and applicable legal obligations.

13.4. MadeiraCamper carefully selects its third-party service providers and, where they process personal data on MadeiraCamper's behalf, requires them to implement appropriate technical and organisational measures to protect personal data and comply with applicable data protection legislation.

13.5. The Website may contain links to third-party websites, applications or services that are not owned or controlled by MadeiraCamper. MadeiraCamper is not responsible for the privacy practices, security measures or content of such third-party services. Users are encouraged to review the privacy policies and terms of use of any third-party service they access.

13.6. MadeiraCamper may replace, remove or introduce third-party service providers from time to time as necessary for operational, commercial, technical or legal reasons. Such changes will not affect MadeiraCamper's commitment to processing personal data in accordance with applicable data protection legislation.

13.7. References within this Privacy Policy to particular third-party service providers, including payment providers or technology partners, are provided for transparency only and do not constitute an endorsement of those services.

14. Children's Privacy

14.1. The Website and the services offered by MadeiraCamper are intended solely for individuals who are legally entitled to enter into a binding campervan rental agreement under the applicable laws governing the rental.

14.2. MadeiraCamper does not knowingly collect or process personal data directly from children who are below the legal age required to enter into a campervan rental agreement or who otherwise lack the legal capacity to enter into such an agreement.

14.3. If MadeiraCamper becomes aware that personal data has been collected directly from a child in circumstances where such processing is not lawful, appropriate steps will be taken, without undue delay, to delete the personal data or otherwise comply with applicable legal obligations.

14.4. Parents, legal guardians or other persons with parental responsibility who believe that a child has provided personal data to MadeiraCamper are encouraged to contact us using the contact details provided in this Privacy Policy so that the matter may be investigated and, where appropriate, the personal data removed.

14.5. This provision does not prevent the processing of limited personal information relating to minors where such information is lawfully provided by a parent, legal guardian or the Customer and is strictly necessary for the administration of a booking, compliance with legal obligations, insurance requirements or the performance of the rental arrangements.

15. Automated Decision-Making

15.1. MadeiraCamper does not intentionally make decisions producing legal effects concerning individuals, or similarly significantly affecting them, based solely on automated processing, including profiling, within the meaning of Article 22 of the General Data Protection Regulation ("GDPR").

15.2. Decisions relating to bookings, customer support, contractual matters, refunds, complaints and other significant aspects of the services provided by MadeiraCamper are not made exclusively by automated means.

15.3. MadeiraCamper may use automated tools to assist with operational activities such as:

• fraud prevention and security monitoring;
• payment verification;
• website analytics and performance monitoring;
• spam detection;
• cybersecurity measures;
• system administration and technical support.

Such tools are used solely to support the efficient and secure operation of the Website and do not, by themselves, make decisions that produce legal or similarly significant effects for individuals.

15.4. If MadeiraCamper introduces automated decision-making or profiling that falls within the scope of Article 22 GDPR in the future, this Privacy Policy will be updated accordingly, and any additional information or safeguards required by applicable law will be provided.

15.5. Where applicable under the GDPR, individuals have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them, except where such processing is authorised by law or otherwise permitted under the GDPR.

16. Marketing Communications

16.1. MadeiraCamper may send marketing or promotional communications relating to its services, special offers, news, updates or other commercial information only where permitted by applicable law and, where required, on the basis of the individual's prior consent.

16.2. Where marketing communications are sent on the basis of consent, such consent shall be freely given, specific, informed and unambiguous, and may be withdrawn at any time.

16.3. Individuals may unsubscribe from marketing communications at any time by:

• clicking the unsubscribe link included in marketing emails;
• updating their communication preferences, where such functionality is available; or
• contacting MadeiraCamper using the contact details provided in this Privacy Policy.

16.4. The withdrawal of consent or the decision to opt out of marketing communications shall not affect the lawfulness of any processing carried out before the withdrawal of consent and will not affect the receipt of non-promotional communications that are necessary for the administration of bookings, contractual performance, customer support, legal compliance or other service-related purposes.

16.5. MadeiraCamper will maintain records of marketing preferences where necessary to ensure compliance with applicable data protection and electronic communications legislation.

16.6. MadeiraCamper does not sell or disclose personal data to third parties for their own direct marketing purposes without an appropriate legal basis and, where required by law, the individual's prior consent.

17. Personal Data Breaches

17.1. MadeiraCamper maintains procedures for identifying, assessing, managing and responding to actual or suspected personal data breaches in accordance with applicable data protection legislation.

17.2. In the event of a personal data breach, MadeiraCamper will assess the nature, scope and potential consequences of the incident without undue delay and will take appropriate measures to contain, investigate and mitigate its effects.

17.3. Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, MadeiraCamper will notify the competent supervisory authority without undue delay and, where required by the GDPR, within the applicable statutory time limits.

17.4. Where a personal data breach is likely to result in a high risk to the rights and freedoms of affected individuals, MadeiraCamper will notify those individuals without undue delay, unless an exception permitted under applicable law applies.

17.5. Notifications concerning personal data breaches will include, where appropriate, information regarding:

• the nature of the breach;
• the categories of personal data concerned;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach;
• recommendations, where appropriate, to help affected individuals reduce potential adverse effects.

17.6. MadeiraCamper maintains internal procedures for documenting personal data breaches, including the facts relating to the incident, its effects and the remedial actions taken, in accordance with applicable legal requirements.

17.7. MadeiraCamper periodically reviews its security measures, internal procedures and incident response processes to reduce the risk of future personal data breaches and to promote the ongoing protection of personal data.

18. Changes to This Privacy Policy

18.1. MadeiraCamper reserves the right to amend, update or revise this Privacy Policy from time to time in order to reflect changes in applicable legislation, regulatory guidance, business operations, technology, the services offered or other legitimate operational requirements.

18.2. Where appropriate, MadeiraCamper will publish the updated version of this Privacy Policy on the Website together with the date on which the revised version becomes effective.

18.3. Material changes affecting the way in which personal data is processed may, where required by applicable law, be communicated to users by appropriate means, including by email, through the Website or by other suitable electronic communications.

18.4. Unless otherwise stated, the most recent version of this Privacy Policy published on the Website shall apply from its stated effective date and shall supersede all previous versions.

18.5. MadeiraCamper encourages users to review this Privacy Policy periodically in order to remain informed about how their personal data is collected, used, protected and processed.

18.6. Any changes to this Privacy Policy shall not affect the lawfulness of personal data processing carried out before the revised version became effective.

19. Contact Details

19.1. If you have any questions about this Privacy Policy, the processing of your personal data, or if you wish to exercise any of your rights under applicable data protection legislation, you may contact MadeiraCamper using the details below:

19.2. MadeiraCamper will make reasonable efforts to respond to enquiries and requests relating to personal data promptly and in accordance with the time limits established by the General Data Protection Regulation ("GDPR") and other applicable legislation.

19.3. Where necessary, MadeiraCamper may request additional information to verify the identity of the individual submitting a request before disclosing or modifying personal data, in order to protect the privacy and security of all individuals.

19.4. If you are not satisfied with the manner in which MadeiraCamper has handled your personal data or responded to your request, you have the right to lodge a complaint with the competent supervisory authority, without prejudice to any other administrative or judicial remedies available under applicable law.

20. Acknowledgement

20.1. By accessing or using the Website, submitting personal data, creating a booking request or completing a booking through MadeiraCamper, users acknowledge that they have read and understood this Privacy Policy.

20.2. Users further acknowledge that their personal data will be collected, used, stored, shared and otherwise processed in accordance with this Privacy Policy and applicable data protection legislation.

20.3. Where the processing of personal data is based on consent, the provision or withdrawal of such consent shall be governed by the relevant provisions of this Privacy Policy and applicable law. Where processing is based on another lawful basis, including the performance of a contract, compliance with legal obligations or MadeiraCamper's legitimate interests, the processing shall be carried out on that basis.

20.4. Continued use of the Website following the publication of an updated version of this Privacy Policy constitutes acknowledgement of the revised Privacy Policy, to the extent permitted by applicable law.

20.5. Nothing in this Acknowledgement shall be interpreted as limiting or excluding any rights granted to individuals under the General Data Protection Regulation ("GDPR"), applicable Portuguese legislation or any other applicable law.

Annex I – Categories of Personal Data

The table below provides an indicative overview of the categories of personal data that MadeiraCamper may process in connection with the operation of the Website and the administration of campervan bookings. The categories listed are illustrative and may vary depending on the nature of the services requested.

Notes

1. The categories described in this Annex are intended to provide a general overview and may not apply to every individual or every booking.
2. MadeiraCamper processes only the personal data that is necessary for the purposes described in this Privacy Policy and in accordance with the principles of data minimisation, purpose limitation and storage limitation established by the General Data Protection Regulation ("GDPR").
3. The categories of personal data processed may change from time to time where necessary to reflect changes in the services provided, applicable legislation or operational requirements. Any material changes will be reflected in an updated version of this Privacy Policy where appropriate.

Annex II – Third-Party Processors and Service Providers

This Annex provides an indicative overview of the categories of third-party service providers that may process personal data on behalf of MadeiraCamper or otherwise receive personal data where necessary for the operation of the Website, the administration of bookings and compliance with applicable legal obligations.

The categories listed below are illustrative and may be updated from time to time as MadeiraCamper's services and operational requirements evolve.

Processing of Personal Data

1. Where third-party service providers process personal data on behalf of MadeiraCamper, they do so only under documented instructions from MadeiraCamper and are required to implement appropriate technical and organisational measures in accordance with the General Data Protection Regulation ("GDPR") and other applicable legislation.
2. Certain third-party providers, including payment service providers and competent public authorities, may process personal data as independent Data Controllers where they determine the purposes and means of processing under applicable law.
3. MadeiraCamper carefully selects its service providers and takes reasonable steps to ensure that they provide appropriate safeguards for the protection of personal data.
4. MadeiraCamper may appoint, replace or discontinue third-party service providers at any time for operational, commercial, technical or legal reasons. This Annex is intended to provide a general overview and does not constitute an exhaustive or permanently fixed list of all service providers used by MadeiraCamper.

Annex III – GDPR Rights Request Procedure

This Annex explains how individuals may exercise their rights under the General Data Protection Regulation ("GDPR") in relation to personal data processed by MadeiraCamper.

1. Submitting a Request

Individuals wishing to exercise any of their rights under the GDPR may submit a request using the following contact details:

Requests should clearly identify:

• the name of the individual making the request;
• the contact details to which the response should be sent;
• the GDPR right being exercised;
• sufficient information to enable MadeiraCamper to identify the relevant personal data; and
• any additional information that may assist in processing the request.

2. Identity Verification

Before responding to a request, MadeiraCamper may request reasonable additional information to verify the identity of the individual making the request where this is necessary to protect personal data from unauthorised access, disclosure, alteration or deletion.

Failure to provide sufficient information to verify identity may delay the processing of the request or prevent MadeiraCamper from fulfilling it where required by applicable law.

3. Response Time

MadeiraCamper will respond to valid requests without undue delay and, in any event, within the time limits established by the GDPR.

Where a request is particularly complex or where multiple requests are submitted by the same individual, the response period may be extended where permitted by applicable law. If an extension is required, MadeiraCamper will inform the individual accordingly.

4. Fees

Requests are generally processed free of charge.

However, MadeiraCamper reserves the right, where permitted by applicable law, to:

• charge a reasonable administrative fee for manifestly unfounded, excessive or repetitive requests; or
• refuse to act on such requests where permitted under the GDPR.

5. Exercising Your Rights

Individuals may exercise any rights available under the GDPR, including the right to:

• access personal data;
• rectify inaccurate or incomplete personal data;
• request the erasure of personal data where applicable;
• request the restriction of processing;
• object to certain processing activities;
• receive personal data in a portable format where applicable;
• withdraw consent where processing is based on consent; and
• exercise rights relating to automated decision-making where applicable.

The availability of these rights depends upon the circumstances of each case and may be subject to the limitations provided for under applicable law.

6. Complaints

If an individual believes that MadeiraCamper has not handled a request appropriately or has processed personal data in breach of applicable data protection legislation, they have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados ("CNPD") or with another competent supervisory authority within the European Union, without prejudice to any other administrative or judicial remedies available under applicable law.