Privacy Policy

1. Who we are

pantrywonderbnch.living ("the Site", "we", "us", "our") is published by Azulejo Media Publishing Lda., a company registered in Portugal under Company Number 517884302, with its registered office at Rua da Rosa 184, 2.º Esquerdo, 1200-387 Lisboa, Portugal. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese Law No. 58/2019, Azulejo Media Publishing Lda. is the data controller for personal data processed through the Site.

Our supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), Lisbon, Portugal. You may lodge a complaint with the CNPD or with the supervisory authority in your own EU/EEA country of residence at any time.

2. Scope of this policy

This policy applies to all personal data processed when you visit pantrywonderbnch.living, submit the contact form, email any of our published addresses, or interact with embedded third-party content on our pages. It does not apply to the websites of the hotels, museums, transport operators or guides that we link to. Once you follow an outbound link, you are subject to the privacy practices of that third party, which we do not control and are not responsible for.

3. The personal data we collect

3.1 Data you provide voluntarily

• Contact form submissions: full name, email address, optional telephone number, enquiry category, subject line and the content of your message.
• Direct correspondence: any information you choose to include when emailing hello@, editorial@, press@ or [email protected], including your email address and signature block.
• Correction and source submissions: details you provide to support a factual correction, which may include your professional affiliation if you choose to state it.

3.2 Data collected automatically

• Server log data: IP address (truncated where technically possible), user-agent string, requested URL, referring URL, HTTP status code, response size and timestamp. Logs are generated by our hosting provider for security, abuse prevention and diagnostics.
• Consent state: your cookie choice, stored in your browser's local storage under the keys cookieConsent, cookieConsentChoice, cookieConsentDate and cookieConsentPrefs. This information stays on your device and is not transmitted to us.
• Analytics data (only with consent): anonymised page views, approximate region derived from a truncated IP address, device category, referral source, reading depth and session duration.

3.3 Data we do not collect

We do not knowingly collect special category data as defined in Article 9 GDPR (racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation). We do not process payment card data, because the Site sells nothing. We do not knowingly collect data from children under the age of sixteen; if you believe a child has provided personal data to us, contact [email protected] and we will delete it.

4. Purposes and lawful bases

Purpose	Data used	Lawful basis (GDPR Art. 6)
Replying to enquiries and corrections	Name, email, phone, message	Consent (6(1)(a)) and legitimate interests (6(1)(f))
Operating and securing the Site	Server logs, essential cookies	Legitimate interests (6(1)(f))
Measuring audience and improving content	Anonymised analytics	Consent (6(1)(a))
Remembering your cookie preferences	Local storage consent keys	Legal obligation (6(1)(c)) and consent
Defending legal claims and handling complaints	Relevant correspondence	Legitimate interests (6(1)(f)) and legal obligation

Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Cookies and similar technologies

The Site uses a limited set of cookies and browser storage. Strictly necessary items are set without consent because the Site cannot function without them. Analytics and functional items are set only after you accept them through the consent banner. A complete, category-by-category breakdown — including names, providers, purposes and lifespans — is available in our Cookie Policy, which also includes browser-level opt-out instructions.

6. Third-party processors and recipients

We keep the number of processors deliberately small. Current categories are:

• Hosting and content delivery: an EU-based hosting provider operating data centres within the European Economic Area, processing server logs and delivering page assets.
• Email service: a business email provider used to receive and answer messages sent to our published addresses.
• Privacy-oriented analytics (consent only): a cookieless or anonymised analytics service used to count page views and reading depth without building individual profiles.
• Embedded map content (consent only): Google Maps, used on the Contact page. When the map loads, Google may receive your IP address and set its own cookies under its own privacy terms.
• Image delivery: photographic assets are served through a third-party image content delivery network, which receives request metadata such as IP address and user-agent.

All processors act on documented instructions under written agreements that meet Article 28 GDPR requirements. We do not sell, rent or trade personal data, and we do not share it for third-party advertising purposes.

7. International transfers

Our primary infrastructure is located within the EEA. Where a processor transfers personal data outside the EEA — for example to the United States in the case of map or image delivery — that transfer is protected by the European Commission's Standard Contractual Clauses, an adequacy decision, or an equivalent Article 46 safeguard. You may request a copy of the relevant safeguard documentation by writing to [email protected].

8. Data retention

• Contact form and email correspondence: retained for twenty-four (24) months from the last substantive exchange, then deleted, unless the correspondence concerns an ongoing legal matter.
• Server logs: retained for a maximum of ninety (90) days for security and diagnostic purposes, then automatically purged.
• Analytics data: retained in aggregated, non-identifying form for up to twenty-six (26) months.
• Consent records: the consent state stored in your browser persists until you clear your browser storage or withdraw consent; our internal record of consent is retained for twelve (12) months as evidence of compliance.
• Records required by Portuguese commercial and tax law: retained for the statutory period, currently ten (10) years, where applicable.

9. Your rights under the GDPR

If you are in the EU/EEA or the United Kingdom, you have the right to:

• Access — obtain confirmation of whether we process your data and receive a copy of it;
• Rectification — have inaccurate or incomplete data corrected;
• Erasure — request deletion where there is no overriding lawful ground to retain the data;
• Restriction — require that we limit processing in defined circumstances;
• Portability — receive data you provided to us in a structured, machine-readable format;
• Objection — object to processing based on legitimate interests, including profiling;
• Withdraw consent — at any time, without affecting prior lawful processing;
• Complain — to the CNPD or your local supervisory authority.

To exercise any right, email [email protected] with the subject line "GDPR request". We respond within thirty (30) calendar days, extendable by two further months for complex requests, in which case we will tell you within the first month. We may request proof of identity where necessary to prevent unauthorised disclosure.

10. Your rights under the CCPA/CPRA

California residents have the right to know what categories of personal information are collected, the purposes of collection, and the categories of third parties with whom information is shared; the right to request deletion; the right to correct inaccurate information; and the right to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CPRA, and we do not use personal information for cross-context behavioural advertising. You will not be discriminated against for exercising any privacy right. Submit CCPA/CPRA requests to [email protected] with the subject line "California privacy request".

11. Security measures

We apply technical and organisational measures appropriate to the risk, including TLS encryption for all traffic, access control on administrative interfaces, multi-factor authentication for editorial accounts, regular software patching, encrypted backups, and a principle of data minimisation — we simply do not collect what we do not need. No transmission over the internet can be guaranteed absolutely secure, but in the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNPD within seventy-two hours and inform affected individuals without undue delay where the risk is high.

12. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

13. Changes to this policy

We may update this policy to reflect changes in law, technology or our practices. The "last updated" date at the top of this page always reflects the current version. Material changes — for example the introduction of a new processor category — will be announced through a notice on the homepage for at least thirty days.

14. Data Protection Officer and contact details

See also: Cookie Policy · Terms of Service · Contact