At Carnivalrankrippl (operated by Carnivalrankrippl Expeditions Lda., registered in Portugal under registration PT-519824901), we recognize that your privacy and the security of your personal data are paramount. This comprehensive Privacy Policy sets out how we collect, process, store, and protect your information when you interact with our 3D spatial web platform, our destination directories, and our bespoke expedition reservation services.
1. Data Controller Identification
The legal data controller responsible for the processing of your personal data on this platform is:
- Legal Entity: Carnivalrankrippl Expeditions Lda.
- Commercial Registration No: PT-519824901
- Registered Headquarters: Avenida da Liberdade 245, 4º Andar, 1250-142 Lisboa, Portugal
- Designated Data Protection Officer (DPO): [email protected]
2. Categories of Data Collected
We may collect and process the following categories of personal information:
- Direct Contact Data: Name, professional title, email address, telephone number, and postal address submitted via our concierge inquiry forms or newsletter subscriptions.
- Expedition & Travel Preferences: Destination choices, seasonal travel dates, physical fitness indicators for coastal trekking, private charter requirements, and dietary requirements for marine retreats.
- Technical & 3D WebGL Telemetry: IP addresses, browser types and versions, operating system details, device GPU characteristics (used strictly to render WebGL ocean shaders at appropriate frame rates), screen resolution, and referring URLs.
- Interactive Analytics & Cookies: Session duration, page navigation patterns, clickstream events, and cookie consent preferences stored locally in your browser.
3. Legal Bases for Processing Under GDPR
We process your data strictly under the lawful provisions established in Article 6 of the General Data Protection Regulation:
- Contractual Necessity (Art. 6(1)(b)): To prepare, organize, quote, and execute private coastal retreat bookings and expedition itineraries requested by you.
- Legitimate Interests (Art. 6(1)(f)): To maintain web platform security, diagnose WebGL rendering issues across various client hardware, prevent fraud, and enhance spatial UI usability.
- User Consent (Art. 6(1)(a)): For sending our quarterly Atlantic Digest newsletter and running non-essential analytics cookies, which you may revoke at any moment.
- Legal Obligation (Art. 6(1)(c)): To maintain Portuguese tax, accounting, and maritime safety compliance records.
4. Third-Party Data Processors & Sub-contractors
We never sell, rent, or trade your personal data. We only disclose data to trusted third-party service providers bound by strict Data Processing Agreements (DPAs) compliant with EU standard contractual clauses, including:
- Cloud hosting providers and edge CDN networks within the European Economic Area (EEA).
- Licensed maritime charter operators and certified mountain/cliff guides in Portugal (only data essential to executing booked expeditions).
- Transactional email delivery and CRM systems with zero-knowledge encryption protocols.
5. International Transfers & Data Retention
All primary databases are physically hosted within high-security data centers located inside the European Union. In any circumstance where data is transferred outside the EEA, we enforce European Commission Standard Contractual Clauses (SCCs).
We retain personal inquiry data for no longer than 24 months from the date of your last interaction with us, unless ongoing contractual obligations or Portuguese commercial statutes mandate a longer statutory retention window (such as 10-year retention for fiscal invoicing).
6. Your Statutory Rights Under GDPR & CCPA
As a data subject, you possess full statutory rights under applicable privacy legislation, including:
- Right of Access: Request a complete digital copy of all personal data held about you.
- Right to Rectification: Request correction of inaccurate or incomplete personal records.
- Right to Erasure ('Right to be Forgotten'): Request permanent deletion of your records when data is no longer necessary for original processing purposes.
- Right to Restriction of Processing: Request temporary freezing of data processing during dispute resolutions.
- Right to Data Portability: Obtain your data in a structured, machine-readable format (e.g., JSON or CSV).
- Right to Object: Object to processing based on legitimate interest or direct marketing.
To exercise any of these rights, please submit a verified request to our Data Protection Officer at [email protected]. We respond to all verified inquiries within 30 calendar days. You also have the right to lodge a formal complaint with the Portuguese National Data Protection Commission (CNPD - Comissão Nacional de Proteção de Dados) at www.cnpd.pt.