Legal
This website collects certain Personal Data from its Users. This document may be printed for reference by using the print command in your browser’s settings.
Data Controller
NGM Experiências Turísticas Lda.
Trading name: Montesa – Mountain & Walking Tours
Corporate Tax Number (NIPC): 516 967 567
Rua Dr. Américo Sequeira, 4970-621 Arcos de Valdevez, Portugal
Contact email: geral@montesa.pt
The company is not required to appoint a Data Protection Officer under Article 37 of the GDPR.
Types of Data Collected
Among the types of Personal Data collected by this website, either directly or through third parties, are: name, surname, email address, telephone number, country of residence, booking data, cookies, and usage data (including IP addresses, technical identifiers, pages visited, and interactions). Data may be provided directly by the User or collected automatically during browsing.
Unless otherwise stated, all Data requested by this website is mandatory. Failure to provide such Data may make it impossible for the website to provide its services. Where certain Data is optional, the User may choose not to provide it without affecting the essential functioning of the website.
Users are responsible for any third-party Personal Data they provide through this website.
Purposes of Processing and Legal Basis
The Data collected is processed by the Controller for the following purposes:
- managing requests, bookings, and enquiries;
- performing contracts for the purchase of services;
- complying with legal obligations (billing, accounting, and tourism sector regulations);
- carrying out statistical analyses and improving website performance;
- sending commercial communications, subject to consent;
- protecting legitimate rights and interests;
- detecting and mitigating fraudulent activities;
- managing subscriptions, newsletters, and operational communications.
Legal bases under Article 6 of the GDPR:
- the User’s consent;
- performance of a contract or pre-contractual steps;
- compliance with a legal obligation;
- the Controller’s legitimate interests;
- protection of vital interests of the User or another person, where applicable.
Data Retention Period
Unless otherwise stated:
- booking and contractual data: 10 years (for tax obligations);
- data processed based on consent: until consent is withdrawn;
- statistical data: up to 26 months;
- contact form submissions: 24 months;
- data related to security and fraud prevention: up to 12 months.
After the retention period expires, the Data is deleted or anonymised, and rights of access, rectification or erasure can no longer be exercised over such Data.
Processors and International Data Transfers
Data may be accessed by authorised personnel (management, technical teams, customer support, marketing, IT systems) and by external entities:
- hosting and website maintenance providers;
- email marketing services (MailerLite – EU);
- analytics services (Google Ireland – EU), with possible transfers to the USA.
International transfers to third countries are carried out based on Standard Contractual Clauses approved by the European Commission and other appropriate safeguards.
Method and Location of Processing
Processing is carried out at the Controller’s premises and at data centres located within the European Union or other adequate jurisdictions. Technical and organisational measures are applied to ensure data security, including encryption, access controls, firewalls, logging of incidents, and response procedures.
Contacting the User
Contact form (this website): By filling in a contact form with their Data, the User authorises this website to use such information to respond to information requests, quotations, or any other request indicated in the form. Personal Data processed: email; name; telephone number; country; surname; website.
Statistics: The services described in this section allow the Controller to monitor and analyse website traffic and may be used to understand User behaviour.
Google Analytics (Google Ireland Limited): Google Analytics is a web analysis service provided by Google Ireland Limited (“Google”). Google uses the Data collected to track and examine website use, compile reports, and share them with other Google services. Google may use the collected Data to personalise ads within its advertising network. Personal Data processed: cookies; usage data. Data location: Ireland.
Contact Management and Message Delivery: These services allow the management of a contact database (email, phone or other) used to communicate with the User. They may also collect data on message viewing times or interactions (such as link clicks).
MailerLite (UAB “MailerLite”): MailerLite is an email management and message delivery service provided by UAB “Mailerlite”. Personal Data processed: email; name. Data location: Lithuania.
Viewing Content from External Platforms: These services allow the display of content hosted on external platforms directly on this website, as well as interaction with such content. They may collect traffic data even when the User does not interact with embedded content.
Google Fonts (Google Ireland Limited): Google Fonts is a font display service provided by Google Ireland Limited, allowing integration of typographic content into this website. Personal Data processed: usage data; various data as specified in the service’s privacy policy. Data location: Ireland.
European Union (or EU): Unless otherwise stated, all references to the European Union in this document include the Member States of the EU and the European Economic Area.
Cookie: Small data files stored in the User’s browser, used as tracking tools (Trackers).
Tracker: Any technology used to track User behaviour — such as cookies, unique identifiers, web beacons, embedded scripts, e-tags or fingerprinting techniques — storing or accessing information on the User’s device.
User Rights
Under the GDPR, Users may exercise the following rights:
- right of access;
- right to rectification;
- right to erasure;
- right to object;
- right to restrict processing;
- right to data portability;
- right to withdraw consent at any time;
- right to lodge a complaint with the Portuguese Data Protection Authority (www.cnpd.pt).
Requests must be sent to: geral@montesa.pt. The Controller will respond within a maximum of 30 days.
Cookies
Full information on the cookies used by this website, their categories, purposes and retention periods is available in the Cookie Policy below.
Legal Actions and Security
Data may be used for legal purposes in case of misuse of the website. The Controller may be required to disclose Personal Data upon request of competent authorities.
Changes to this Privacy Policy
The Controller reserves the right to amend this Policy at any time. Regular consultation of this page is recommended. Significant changes will be communicated, and new consent may be requested where applicable.
Legal Information
This privacy policy applies exclusively to this website, unless stated otherwise in this document.
Latest update: 10 November 2025.
Cookie Policy
This website uses cookies to improve performance, analyse statistics and offer personalised functionality.
What Are Cookies
Cookies are small files stored in the User’s browser that enable recognition and improve browsing experience.
Types of Cookies Used
Strictly Necessary Cookies — Ensure basic website functionality. Do not require consent. Duration: session to 12 months.
Analytical Cookies (Google Analytics) — Used to measure traffic and performance. Require consent. Duration: up to 26 months.
Functional Cookies — Store User preferences. Duration: up to 12 months.
Marketing Cookies — Used to personalise advertising. Require consent. Duration: 1 to 24 months.
Consent Management
Users may:
- accept all cookies;
- reject non-essential cookies;
- configure preferences by category;
- change consent at any time by clicking “Manage Cookies”.
International Transfers
Google cookies may involve data transfers to the USA, safeguarded by Standard Contractual Clauses.
