Privacy policy

1. Data controller

The controller is Bruno Manuel Claro, owner of the Correr Lisboa brand and operator of Running Experiences Lisbon. Associação Correr Lisboa may support certain community or administrative operations without changing the responsibility stated for this service.

2. Data we collect

We collect only data appropriate to the request and activity.

• Identity and contact details: name, email, telephone, country and hotel when provided.
• Booking details: experience, proposed date and time, participants, language, level, pace and notes.
• Health and safety: only physical restrictions or voluntarily supplied information relevant to delivering the activity safely.
• Technical data: IP address, browser, security logs, consent choices and website use.
• Payment and invoicing: reference, status and legally required details; we do not store full card details.

3. Purposes and legal bases

We use data to answer requests, check availability, enter into and perform bookings, communicate changes, protect safety, provide support, meet tax and legal duties, and prevent abuse. The legal bases include contract and pre-contractual steps, legal obligations, legitimate security and improvement interests and, where required, consent.

4. Health data

Health information is optional, limited to what is relevant to safety and access restricted. By providing it in the relevant field, the participant consents to its use to prepare and deliver the activity and may withdraw that consent, without affecting prior processing or information needed to defend legal rights.

5. Recipients and suppliers

Data may be handled by hosting, email, payment, accounting, guides, insurers where applicable and strictly necessary technical providers. We require confidentiality, security and processing under instructions. We do not sell personal data.

6. International transfers

If a supplier processes data outside the European Economic Area, we will use an applicable safeguard, such as an adequacy decision or standard contractual clauses, with additional measures when required.

7. Retention

Enquiries without a booking are kept only for follow-up, normally up to 24 months; booking, payment and invoice data for statutory periods; consent records for as long as needed to demonstrate compliance; and marketing data until consent is withdrawn. We then erase or anonymise data unless law or legal claims require retention.

8. Your rights

You may request access, rectification, erasure, restriction, objection or portability, withdraw consent and complain to the Portuguese Data Protection Authority. We may ask you to verify your identity, and limits apply where retention is required by law or to defend legal rights.

Portuguese Data Protection Authority

9. Photographs, marketing and minors

Identifiable photographs and marketing depend on separate, optional choices. Refusal does not prevent booking. Bookings for minors must be made or authorised by their legal representative, who must accompany the minor or agree the arrangements in advance.

10. Security and changes

We apply access controls, secure communications, session protection, backups and data minimisation. No system is infallible; incidents will be handled as required by law. We may update this policy and will always show its version date.