Privacy Policy

Last updated: 1 September 2026

This Privacy Policy explains how we collect, use, store and protect your personal data when you visit madeiraguide.xtravel.world, subscribe to our free travel guide, or contact us through Instagram.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Portuguese data protection law.

1. Who we are

The data controller responsible for your personal data is:

OUTEIRO ÉPICO UNIPESSOAL LDA VAT / NIPC: PT518341046 Estrada Monumental n.º 259, 9000-250 Funchal, Madeira, Portugal Email: privacy@xtravel.world Website: xtravel.world

For any question about this policy or about your personal data, write to the address above.

2. What data we collect

When you subscribe to the free guide:

  • Your email address

  • Your first name, if you choose to provide it

  • The source of your subscription — for example whether you arrived from Instagram, from our landing page, or from a shared copy of our PDF guide. This is recorded through a short parameter in the web address and stored alongside your subscription.

When you interact with our emails and website:

  • Whether an email was opened and which links were clicked

  • IP address, browser type, device type and approximate location

  • Pages viewed and time spent on our landing page

When you write to us on Instagram:

  • Your Instagram username and the content of the messages you send us

  • The email address you provide in the conversation, if you request the free guide

We do not collect payment details on this website. Our paid travel guides are sold through Rexby, a separate platform that acts as its own data controller for purchases made there.

3. Why we use your data, and on what legal basis

To send you the free guide and further emails about Madeira. Legal basis: your consent, given when you submit your email address. You can withdraw it at any time.

To understand which channels bring subscribers. We record whether a subscription came from Instagram, from the landing page or from a forwarded copy of our PDF, and we measure opens and clicks in our emails. Legal basis: legitimate interest in understanding and improving what we publish, balanced against your rights.

To answer your messages and enquiries. Legal basis: legitimate interest, or steps taken at your request before entering into a contract.

To comply with the law. Legal basis: legal obligation.

4. Who processes your data on our behalf

We use the following service providers. They act as data processors and may only process your data to provide their service to us:

ProviderPurposeLocationMailerLitestoring subscriptions, sending emails, hosting this landing pageEuropean Union (Lithuania)BooSendInstagram direct message automation and collecting your email in chatsee provider's documentationManyChatInstagram direct message automationUnited States

We do not sell or rent your personal data. We may disclose data where required by law or where necessary to establish, exercise or defend legal claims.

5. Cookies

Our landing page uses only cookies that are strictly necessary for it to work — for example to keep the subscription form functioning and to protect against abuse.

We do not use advertising cookies or third-party tracking pixels on this page, and we do not build advertising audiences from your visit here.

6. International transfers

MailerLite stores subscriber data within the European Union.

Some of our providers, including ManyChat, may process data in the United States. Where data leaves the European Economic Area, the transfer relies on an appropriate legal mechanism under the GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

7. How long we keep your data

We keep your email address and subscription details until you unsubscribe, or until you ask us to delete them.

If you unsubscribe, we retain a minimal record of the unsubscription so that we do not email you again by mistake.

Instagram conversations are retained for as long as the conversation remains in the platform's inbox.

Aggregated statistics that no longer identify you may be kept indefinitely.

8. Your rights

Under the GDPR you have the right to:

  • Access — obtain a copy of the personal data we hold about you

  • Rectification — have inaccurate or incomplete data corrected

  • Erasure — have your personal data deleted in certain circumstances

  • Restriction — ask us to limit how we process your data

  • Portability — receive your data in a structured, commonly used, machine-readable format

  • Object — object to processing based on legitimate interests, including direct marketing

  • Withdraw consent — at any time, without affecting the lawfulness of processing carried out beforehand

To exercise any of these rights, write to privacy@xtravel.world. We may ask you to confirm your identity before we act on a request.

Every email we send also contains a one-click unsubscribe link.

9. Data security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. No method of transmitting or storing data online is completely secure, and we cannot guarantee absolute security.

10. Children

Our website and guides are not directed at children under 16. We do not knowingly collect personal data from children.

11. Complaints

If you believe your personal data has been handled unlawfully, you may lodge a complaint with the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD) Details for submitting a complaint are available on the CNPD's official website.

12. Changes to this policy

We may update this Privacy Policy to reflect changes in our services, technology or legal requirements. When we do, we will update the "Last updated" date at the top of this page.

13. Contact

OUTEIRO ÉPICO UNIPESSOAL LDA Estrada Monumental n.º 259, 9000-250 Funchal, Madeira, Portugal VAT / NIPC: PT518341046 Email: privacy@xtravel.world