Privacy Policy

1. Who we are (data controller)

The controller of your personal data is Subway Skaters Lisbon, with registered address at Lisboa, Portugal. For privacy matters, contact us at bookings@subwayskaters.pt.

Given the size of the business, we are not required to appoint a Data Protection Officer.

2. What data we collect

We collect only the data you give us when you book a lesson through the booking form:

• /Name
• /Email
• /Phone number
• /Booking details: discipline, plan, and the date and time you choose.

3. Payments

We do not collect or store any payment or card data. Payment is made in person. We do not use analytics, advertising or tracking cookies.

4. Why we use your data and our legal basis

• /To manage your booking and contact you about it (confirm, reschedule, cancel) and send your confirmation email. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• /To meet legal obligations (e.g. tax and accounting). Legal basis: legal obligation (Article 6(1)(c)).
• /To answer messages you send us. Legal basis: our legitimate interest in responding (Article 6(1)(f)).

5. Cookies

The site uses only one cookie: a strictly-necessary session cookie that keeps the business owner logged in to the private admin dashboard. It is not set for ordinary visitors and is not used for tracking. Because it is strictly necessary, it does not require consent.

6. The map on our site

Our location section can load a map from OpenStreetMap, operated by the OpenStreetMap Foundation (United Kingdom). The map only loads when you click to load it. When it loads, your IP address is sent to the OpenStreetMap Foundation so the map can be displayed. See osmfoundation.org/wiki/Privacy_Policy.

7. Who we share your data with

We do not sell your data. We share it only with service providers who help us run the booking service, acting on our instructions:

• /Vercel Inc. (USA) — hosts our website. Processor.
• /Neon (database hosting, EU region — London, UK) — stores our booking database. Processor.
• /Resend (USA) — sends your confirmation email. Processor.
• /OpenStreetMap Foundation (UK) — provides the map and, when it loads, receives your IP (see above).
• /We may also disclose data to public authorities where the law requires it.

8. International data transfers

• /Vercel and Resend (USA): both certified under the EU–US Data Privacy Framework, recognised as adequate by the European Commission. As an additional safeguard, our agreements include Standard Contractual Clauses.
• /Neon (London) and OpenStreetMap Foundation (UK): the UK benefits from a European Commission adequacy decision.
• /You can request a copy of the relevant safeguards by emailing bookings@subwayskaters.pt.

9. How long we keep your data

• /Contact data and booking details: kept for the duration of our relationship and deleted within 12 months after your last lesson or booking, unless needed to handle a complaint or claim.
• /Data we must keep for tax/accounting law: for the period required by Portuguese law (generally 10 years).
• /Email enquiries: deleted within 12 months of the matter being resolved.

10. Your rights

Under the GDPR you have the right to:

• /access your data and get a copy;
• /rectify inaccurate or incomplete data;
• /erase your data (right to be forgotten);
• /restrict processing in certain cases;
• /data portability, in a structured, machine-readable format;
• /object to processing based on our legitimate interests.

11. How to exercise your rights

Email us at bookings@subwayskaters.pt. We respond within one month. There is normally no charge.

12. Complaints

If you believe we have not handled your data properly, you have the right to complain to the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa · Tel: +351 213 928 400 · Email: geral@cnpd.pt · www.cnpd.pt

13. Changes to this policy

We may update this policy. The current version is always on this page, with its last-updated date.