Discretion is at the heart of what we do. This policy explains what personal data Portable Afternoon (“PA Concierge”, “we”, “us”) collects when you visit our website, apply for membership or use our members’ app, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and Portuguese data protection law.
1.Who we are
The controller responsible for your personal data is:
Portable Afternoon, Lda. — also trading as PA Concierge
NIPC: 518 915 166
Registered office: Rua Diogo Dias, nº 96, 2870-272 Montijo, Portugal
Email: connect@pa-concierge.com
For any question about this policy or your data, write to us at the address above. We do not currently have a designated Data Protection Officer, as we are not required to appoint one.
2.Data we collect
When you apply for membership
- Full name, email address, phone / WhatsApp number, city and country.
- The option you are interested in (annual membership, monthly membership or pay per request).
- The date and time you gave consent to this policy.
When you become a member
- Account details: name, email, phone, membership tier and status. Your password is stored only in encrypted (hashed) form by our login provider — we never see it.
- Optional personal dates you choose to add, such as a birthday or anniversary, so we can mark them.
- Your requests and bookings: venue, date and time, number of guests, occasion, and any dietary requirements or allergies you tell us about.
- Messages you exchange with our concierge team in the app, and notes our team keeps to serve you well (for example, your preferences).
- Questions you type into the app’s AI-assisted discovery or request features.
- If you allow notifications, a technical push-notification identifier for your device.
- Payment and billing details: billing name and email, invoicing details (such as a tax number, if you provide one), subscription status and payment history. Card details are handled by our payment provider, Stripe, and are never seen or stored by us.
When you visit our website or apps
- Technical data such as IP address, browser type and pages requested, recorded automatically by our hosting provider for security and reliability.
3.Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Reviewing your membership application and contacting you about it | Steps taken at your request before entering into a contract — Art. 6(1)(b) |
| Providing the concierge service: handling requests, making reservations and bookings, communicating with you | Performance of our contract with you — Art. 6(1)(b) |
| Passing dietary requirements or allergies to a venue for your booking | Your explicit consent — Art. 9(2)(a) (see section 4) |
| Remembering your preferences and special dates to personalise the service | Performance of our contract — Art. 6(1)(b); optional dates only with your consent — Art. 6(1)(a) |
| Invoicing, accounting and tax records | Legal obligation — Art. 6(1)(c) |
| Keeping our systems secure, preventing misuse, and handling complaints or legal claims | Our legitimate interests — Art. 6(1)(f) |
| Sending you news or offers (only if we introduce this, and only if you opt in) | Your consent — Art. 6(1)(a) |
Your name and email are needed to apply; without them we cannot consider your application. All other information is provided at your discretion, but some requests cannot be fulfilled without the relevant details. We do not make decisions about you based solely on automated processing, and we do not sell your personal data.
4.Dietary & allergy details
Information about allergies or medical dietary needs is health data, which the law protects with extra care. We only collect it when you choose to enter it with a request. By providing it, you give your explicit consent for us to store it with that request and share it with the relevant venue so they can cater for you safely.
You may withdraw this consent at any time by contacting us. We will then delete the details, though this will not affect sharing that has already taken place, and we may no longer be able to pass your needs on to venues.
6.International transfers
Some of our service providers are based in, or use servers in, the United States and other countries outside the European Economic Area. Where this happens, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses, together with any additional safeguards required. You can ask us for more information about these safeguards.
When we arrange services for you abroad (for example, a restaurant in Dubai or London), we necessarily share booking details with a supplier in that country so that the service you requested can be provided.
7.How long we keep it
- Applications that do not lead to membership: up to 12 months after our decision, then deleted.
- Member account, requests and messages: for as long as you are a member, and up to 2 years afterwards in case of questions or claims.
- Dietary and allergy details: kept with the related request, and deleted on request or when your account data is deleted.
- Invoices and accounting records: 10 years, as required by Portuguese tax law.
- Hosting and security logs: for the limited period set by our hosting provider.
8.Your rights
You have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectify data that is inaccurate or incomplete;
- Erase your data, where there is no legal reason for us to keep it;
- Restrict how we use your data in certain circumstances;
- Object to processing based on our legitimate interests;
- Portability — receive data you gave us in a common, machine-readable format;
- Withdraw consent at any time, where we rely on consent, without affecting earlier processing.
To exercise any right, email connect@pa-concierge.com. We will reply within one month, and may need to confirm your identity first. This is free of charge unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data, you may lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or with the authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.
10.Security
We protect your data with encrypted connections (HTTPS), encrypted password storage, and access controls that limit each member to their own information and restrict internal data to authorised members of our team. No system is completely secure, but we review our safeguards regularly and will notify you and the authorities of a personal data breach where the law requires.
11.Age
Our services are intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18.
12.Changes & contact
We may update this policy from time to time. The date at the top shows the latest version, and we will tell members about significant changes through the app or by email.
Questions or requests: connect@pa-concierge.com
See also our Terms of Service.