Privacy Policy

1. Who operates Golf Passport Algarve

Golf Passport Algarve is operated by:

• Lazaro de Souza Neto
• Rua da Misericórdia, Lote B2, Edifício Colina
• 8500-510 Portimão
• Portugal
• NIF: PT306.904.640
• Email: info@algarveofficial.com
• Telephone: +351 965 762 205

For the purposes of applicable data-protection law, the operator acts as the controller for the personal data described in this Policy, except where a different legal role is required by the circumstances of a particular processing activity.

2. What information we process

Depending on how you use the service, we may process:

• name;
• email address;
• account and authentication information;
• information supplied when creating or maintaining an account;
• information received through an optional social sign-in provider;
• Golf Passport and account activity necessary to provide the service;
• information submitted through contact or advertiser-inquiry forms;
• messages and other information you voluntarily provide;
• technical and security information associated with requests to our systems;
• language preference where you explicitly select a language;
• information required to investigate security incidents or abuse.

We do not intentionally collect information that is not necessary for the relevant purpose.

3. Information received through Google Sign-In

If you choose to sign in using Google, Google provides authentication information to us.

Our application requests the following Google OAuth scopes:

• openid
• email
• profile

The information we receive and use for the Golf Passport account includes the Google subject identifier, name, email address, profile image and email-verification status.

Google Sign-In is used for authentication and account creation. Golf Passport does not request access to Google Drive, Calendar, Contacts or other Google services through additional OAuth scopes.

Google's precise legal characterization in relation to this authentication integration, including applicable international-transfer arrangements and Google-side retention or post-revocation treatment, is subject to the applicable contractual and legal framework and is not represented in this Policy beyond the factual description above.

4. Information from contact and advertiser inquiries

If you submit a contact or advertiser inquiry, we may process the name, email address and message or other information you provide.

This information is used to respond to the inquiry, administer the request, investigate or resolve issues, and communicate with you regarding the matter you raised.

The forms may include a consent-style confirmation relating to being contacted about the inquiry. The legal basis and precise treatment of such communications are subject to the applicable legal requirements.

5. How we use personal information

Personal information may be used for the following purposes:

• creating and maintaining user accounts;
• authenticating users;
• providing the Golf Passport service;
• providing golf-directory and related website functionality;
• maintaining user-requested preferences;
• responding to contact and business inquiries;
• sending necessary transactional or service communications;
• maintaining the security and integrity of the website and infrastructure;
• preventing abuse, fraud or unauthorized access;
• complying with applicable legal obligations;
• investigating incidents and enforcing applicable terms;
• carrying out other processing where a lawful basis has been established and disclosed.

The legal bases on which we carry out these purposes are described in the following section.

6. Legal bases

We do not rely on a single legal basis for every processing activity.

Depending on the purpose and circumstances, processing may be based on the performance of a contract or steps taken at your request, compliance with a legal obligation, legitimate interests, consent, or another lawful basis available under applicable law.

If you need to know the specific legal basis we rely on for a particular processing purpose, you can request that information using the contact details in section 21.

Where consent is used, it will be obtained in accordance with applicable requirements and will be capable of being withdrawn where required.

7. Cookies and similar technologies

Golf Passport currently has a deliberately limited storage footprint.

An unauthenticated visitor browsing the public website receives no analytics or advertising cookies until they have granted the corresponding consent category. Before any choice is made, none are set.

Depending on how the service is used, the website may use:

• authentication/session cookies when you sign in;
• a short-lived security cookie during an active multi-factor authentication process;
• a gpa_locale cookie when you explicitly select a language;
• browser local storage for functional interface preferences;
• browser local storage for the locally maintained recent-course functionality;
• browser local storage for scorecard hole scores that have not been saved to your account yet;
• Google Analytics cookies (_ga and _ga_<container-id>) once you have granted Analytics consent.

No advertising or cross-site tracking technology is installed. Google Analytics' own advertising features are disabled on our property, and the site additionally instructs Google's tag to deny advertising storage and personalization on every page load.

Further information is provided in our Cookie Policy.

8. Analytics

Golf Passport operates Google Analytics 4, and only for visitors who have granted Analytics consent. Nothing analytics-related loads before that: no script is added to the page, and no analytics cookie is set.

Once loaded, Google Analytics 4 measures how the site is used — pages viewed, session and device basics, and standard GA4 events — and sets the _ga and _ga_<container-id> cookies in your browser. The measurement data is sent to Google.

Google Analytics' advertising features, which would allow Google to build remarketing audiences from your visit, are disabled — both on our Google Analytics property and, independently, by the consent signals the site sends with every page load. Our Cookie Policy describes this in full, including how to withdraw analytics consent at any time.

No further non-essential analytics technology will be introduced until the applicable legal and consent requirements have been determined and the relevant disclosures have been updated.

9. Transactional email

Golf Passport uses Resend to deliver transactional and service-related email.

Depending on the message, Resend may process recipient information, message content, delivery information and related technical data necessary to deliver the email.

Resend states that it acts as a processor for customer-sent data and maintains its own contractual and privacy framework. Resend's current documentation states that message content, delivery logs, webhook payloads and account records are stored in the United States, and that international transfers may rely on mechanisms including EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

Resend's documented retention periods and subprocessor arrangements may change. The applicable vendor documentation and contractual terms should be consulted where necessary.

10. Hosting and infrastructure

Golf Passport is hosted on a VPS provided by Hostinger International Ltd.

The relevant hosting information currently recorded for the service is:

• Hostinger International Ltd.
• 61 Lordou Vironos Street
• Larnaca 6023
• Cyprus
• VAT Reg. CY10301365E

The Golf Passport VPS is located in Paris, France.

The VPS hosts the application and its self-managed PostgreSQL database and related infrastructure.

Hostinger acts as a hosting infrastructure provider and, under its applicable data-processing framework, as a processor where it processes customer data on behalf of the customer.

Hostinger's contractual documentation provides mechanisms for international transfers, including Standard Contractual Clauses where applicable.

11. Database and self-hosted storage

Golf Passport uses a self-hosted PostgreSQL database on its dedicated VPS infrastructure.

Application and CMS data are stored on that infrastructure rather than being stored in the unrelated Supabase infrastructure used by another project.

Uploaded media is stored on the Golf Passport infrastructure.

12. Malware scanning

Uploaded files may be processed by ClamAV running on the Golf Passport infrastructure for malware and security scanning.

ClamAV operates locally on the same infrastructure and is not used as an external commercial data-processing service.

13. Security

We use technical and organisational measures designed to protect personal information against unauthorized access, alteration, disclosure or destruction.

These measures include, as applicable:

• access controls;
• authentication and multi-factor authentication;
• administrative IP allowlisting;
• hardened SSH access;
• firewall controls;
• intrusion/brute-force protection;
• encrypted HTTPS connections;
• protected server credentials and environment configuration;
• container isolation;
• database access controls;
• malware scanning of uploaded files;
• monitoring and operational security procedures.

No security measure can guarantee absolute security.

14. Retention

We retain information only for as long as necessary for the relevant purpose, subject to applicable legal obligations.

Our retention framework is:

These periods apply except where a mandatory retention or deletion requirement under applicable law requires a different period for particular records.

This is distinct from the technical lifetime of the authentication session cookie itself, which is approximately 30 days on a rolling basis — how long a sign-in stays active, not how long account data is retained afterward.

15. International transfers

Some service providers used by Golf Passport may process information outside the European Economic Area.

Where an international transfer occurs, the applicable transfer mechanism will depend on the provider and processing activity and may include an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism.

For example, Resend's current documentation identifies the United States as a storage location for certain service data and refers to EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

The precise legal assessment of each transfer will be maintained against the applicable vendor terms and legal requirements.

16. Your rights

Subject to applicable law, you may have rights including:

• access to your personal data;
• correction of inaccurate data;
• deletion of personal data;
• restriction of processing;
• objection to certain processing;
• data portability where applicable;
• withdrawal of consent where processing is based on consent;
• the right to complain to a competent data-protection authority.

Requests may be submitted using:

info@algarveofficial.com

We may need sufficient information to verify your identity before completing a request.

17. Account deletion

If you wish to stop using your Golf Passport account, you may request account deletion using the available account functionality or by contacting us.

Deletion is subject to applicable legal, security and operational retention requirements.

18. Third-party services and links

The website may contain links to third-party websites, golf clubs, businesses, destinations, booking services or other external services.

Golf Passport does not control the privacy practices of third parties.

You should review the privacy information of any third-party service before providing it with personal information.

19. Changes to this Privacy Policy

We may update this Privacy Policy when our services, processing activities, legal requirements or operational practices change.

The current version number and last-updated date will appear at the beginning of this Policy.

Material changes will be reflected in a new version where appropriate.

20. Governing law

This Policy is intended to operate in accordance with applicable Portuguese and European data-protection law.

Portuguese law governs this Policy to the extent permitted by applicable law.

Nothing in this Policy is intended to remove or restrict mandatory rights that cannot lawfully be excluded or limited.

21. Contact

For questions about privacy or personal-data processing, contact:

• Lazaro de Souza Neto
• AlgarveOfficial.com / Golf Passport Algarve
• Rua da Misericórdia, Lote B2, Edifício Colina
• 8500-510 Portimão
• Portugal
• NIF: PT306.904.640
• Email: info@algarveofficial.com
• Telephone: +351 965 762 205