Legal

Privacy Policy

Last updated: 28 October 2026

1. Introduction

Cabo Tours LDA, operating under the brand name No Limits Adventure (“we”, “us” or “our”), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our website, make a booking, participate in our activities, contact our team or otherwise interact with our services.

Our activities are operated in Cape Verde, including on Sal Island and Boa Vista. We welcome customers from Cape Verde and other countries, including the European Union and the United Kingdom.

We process personal data in accordance with applicable data protection legislation in Cape Verde and, where applicable, other relevant privacy laws, including the General Data Protection Regulation (GDPR) and the UK GDPR.

This Privacy Policy explains our data processing practices. Where consent is legally required, we will request it separately. Using our website or making a booking does not, by itself, constitute consent to optional data processing.

2. Who We Are

The entity responsible for the processing of personal data described in this Privacy Policy is:

Legal name: Cabo Tours LDA

Trading name: No Limits Adventure

Registered address: Djadsal Moradias, Block A (Blue Block), Santa Maria, Sal Island, Cape Verde

Privacy contact: privacy@nolimitsadventure.com

Website: https://nolimitsadventure.com

For privacy-related questions, requests concerning your personal data or concerns about how we handle your information, please contact us using the email address above.

For the purposes of applicable data protection legislation, Cabo Tours LDA acts as the data controller when it determines the purposes and means of processing personal data.

3. Personal Data We Collect

The personal data we collect depends on how you interact with our website and services.

3.1. Booking Information

When you make a booking through our website, we collect or process information necessary to manage your reservation, including:

First and last name.
Email address.
Telephone number.
Booking details, including the activity booked, scheduled date, number of participants and reservation status.
Information necessary to coordinate your activity, including transfer arrangements and other operational details.
Payment-related information and transaction status, as processed through our payment provider.

Our booking system, Rezdy, processes customer information necessary to manage reservations and maintain booking records.

We generally collect the details of the lead traveller rather than the personal information of every participant.

3.2. Payment Information

Payments are processed through Trust My Travel, which provides a payment interface integrated into our booking process.

Depending on the transaction, Trust My Travel may process your name, email address, telephone number, home address and information necessary to complete, verify and manage your payment.

Payment processing may also involve financial institutions, payment service providers and other parties necessary to complete a transaction.

Payment information is handled through the relevant payment provider's systems, subject to its own security arrangements and privacy policy. We do not intend to collect or store full payment card details directly through our own website.

For payment-specific questions, you may also need to consult the relevant payment provider.

3.3. Contact Forms and Customer Support

If you contact us through our website's contact form or live chat, we may collect:

First and last name.
Email address.
The contents of your message or conversation.
Any additional information you voluntarily provide in connection with your enquiry.

We use this information to respond to your questions, provide assistance and, where appropriate, help you arrange or manage a booking.

Our current live chat platform is Respond.io. We may migrate to an internally developed customer-support system in the future. If the technical arrangements for processing or storing conversation data change, we will update this Privacy Policy where necessary.

3.4. Health and Safety Declarations

For certain activities, we ask participants to complete health and safety declarations as part of our digital waiver process. These declarations relate specifically to pregnancy and existing back problems or back-related medical conditions that the activity could aggravate.

Our waiver explains that participation is not recommended during pregnancy because of the physical demands, vibrations and possible impacts involved. It also warns that the activity may aggravate existing back problems or other back-related medical conditions.

Participants are asked to confirm whether the relevant condition applies to them and, where applicable, acknowledge the warning and their decision to participate.

The purpose of collecting this information is to communicate relevant safety warnings, document the participant's acknowledgment of those warnings and support the safe organisation of our activities.

How this information is handled

Health declarations are recorded as part of the participant's signed waiver.

A copy of the completed waiver is emailed to the participant after signing.

The information is used for the waiver, safety and associated operational or legal purposes.

We do not use these health declarations for advertising, marketing or unrelated business analytics.

Access to these records should be restricted to authorised personnel who need the information for legitimate purposes.

Health information is particularly sensitive personal data. Where the GDPR or UK GDPR applies, processing must satisfy an applicable legal basis under Article 6 and a separate condition under Article 9. Where required, we will obtain valid explicit consent or identify another applicable legal condition before processing such information.

The participant's acknowledgment of an activity's risks is distinct from consent to the processing of personal data. Any consent relied upon for data protection purposes must meet the requirements of the applicable law.

3.5. Website Usage and Technical Information

When you visit our website, certain technical information may be processed automatically, depending on your browser settings, cookie preferences and the technologies in use.

This may include:

IP address and technical identifiers.
Browser type and device information.
Pages visited and interactions with website content.
Referring website or traffic source.
Date, time and duration of visits.
Cookie identifiers and related analytics information.

Some of this information is collected through Google Tag Manager, Google Analytics and the Meta Pixel, subject to the relevant consent requirements and the configuration of these services.

Our booking system also generates internal records and statistics relating to customer purchases and business performance. Where those records contain identifiable customer information, they remain subject to the protections described in this Policy. Where feasible, we use aggregated or anonymised information for statistical reporting.

4. Why We Use Your Personal Data

We process personal data for purposes connected with operating our business and providing our services, subject to the requirements of applicable law.

Managing bookings and providing activities. Processing reservations, identifying the lead traveller, communicating booking details, coordinating transfers, delivering tours and handling booking changes.

Processing payments. Facilitating payments, confirming transactions, addressing payment issues and managing refunds where applicable.

Customer communications. Sending booking confirmations, payment-related communications, pre-tour information, operational updates and responses to customer enquiries.

Health and safety. Reviewing relevant declarations, communicating safety requirements and documenting the participant's acknowledgment of relevant risks.

Customer feedback. Sending post-tour emails inviting customers to review their experience and using feedback to improve our services.

Website operation and security. Maintaining website functionality, detecting technical problems, protecting systems and preventing misuse.

Analytics and business performance. Understanding website traffic, measuring marketing performance, evaluating booking trends and analysing sales performance.

Legal and administrative obligations. Maintaining records, responding to lawful requests, addressing disputes and complying with applicable accounting, tax and other legal requirements.

We do not use booking contact information for targeted advertising merely because it is available in our booking records. Advertising and analytics technologies operating on the website are separate processing activities and are subject to applicable cookie and privacy requirements.

5. Legal Bases for Processing

Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases, depending on the processing activity:

Performance of a contract: Processing necessary to manage a reservation, deliver a tour, coordinate transfers and provide booking-related assistance.
Pre-contractual steps: Responding to enquiries and taking steps requested by a customer before entering into a booking.
Legal obligations: Processing necessary to comply with applicable legal, accounting, tax or regulatory requirements.
Legitimate interests: Processing necessary for proportionate business purposes, such as website security, service improvement, internal business analysis and handling customer enquiries, provided those interests are not overridden by the individual's rights and interests.
Consent: Processing for which consent is required, including non-essential cookies and certain forms of health-data processing where no other applicable legal basis is available.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Under Cape Verdean law, processing must also satisfy the applicable requirements governing lawful, fair and proportionate processing of personal data.

6. How We Use Email Communications

We send emails where necessary to manage bookings and provide our services. These communications include:

Booking confirmations sent by No Limits Adventure.
Automatic payment confirmations issued through Trust My Travel.
Follow-up communications from our office containing tour information, transfer details, operational updates or requests for information needed to organise the activity.
Post-tour emails inviting customers to share feedback or submit a review.

Booking-related and operational emails are sent to fulfil the booking, provide the service or communicate information directly related to the customer's reservation.

Post-tour review requests are intended to collect customer feedback and help future travellers make informed decisions. They are not intended to promote unrelated products or services.

If we introduce newsletters, promotional campaigns or other marketing communications in the future, we will apply the consent, objection and other requirements imposed by applicable law.

7. Cookies, Analytics and Advertising Technologies

Our website uses cookies and similar technologies to support functionality, understand website performance and measure advertising effectiveness.

7.1. Cookie Consent

We use a cookie consent mechanism provided through Pressidium to manage visitors' preferences.

Our cookie consent mechanism is configured to block Google Tag Manager and associated optional tracking technologies when a visitor refuses consent. Where consent is required, non-essential analytics and advertising technologies remain inactive until the visitor gives the relevant consent.

Visitors can refuse optional cookies without being required to consent to them in order to access the ordinary content of our website.

You may change your cookie preferences through the available cookie settings mechanism, where provided.

Certain technical cookies or similar technologies may be necessary for the website or booking process to function. These are treated separately from optional analytics and advertising technologies where permitted by applicable law.

7.2. Google Tag Manager and Google Analytics

We use Google Tag Manager to manage website tracking technologies and Google Analytics to understand website usage and performance.

When the relevant consent has been provided, information about your interactions with our website may be processed by Google.

This information helps us understand traffic sources, identify popular pages, measure performance and improve our website.

7.3. Meta Pixel

We use the Meta Pixel to measure the effectiveness of advertising and understand interactions with our website.

When the relevant consent has been provided, Meta may receive information relating to website activity and associated technical identifiers.

The use of the Meta Pixel does not mean that we automatically upload customer booking records or provide customers' email addresses or other booking contact details to Meta for advertising purposes.

7.4. Internal Booking Analytics

Our booking system also generates records and statistics relating to customer purchases and business performance.

These records may be used internally to analyse sales, reservations and operational performance. This processing is separate from optional website advertising cookies, although it remains subject to applicable personal data protection requirements whenever identifiable information is involved.

7.5. Third-Party Privacy Information

Google, Meta and other providers may process information under their own privacy policies and contractual arrangements.

For further information, please consult the privacy documentation provided by the relevant service provider.

8. Who May Receive Your Personal Data?

We do not sell personal data to third parties.

However, providing our services requires us to use certain external providers and, where necessary, disclose personal data to them.

These recipients may include:

Rezdy: Our booking system, used to manage reservations and associated customer information.
Trust My Travel: Our payment provider, used to process payments and associated transaction information.
Respond.io: Our current customer-support platform, which may process contact details and customer conversations. If we migrate to an internally developed support system, the relevant processing arrangements will be updated as necessary.
Website hosting and technical service providers: Providers involved in hosting, maintaining, securing and operating our website and related systems.
Google: In connection with the website analytics and tag-management services described in this Policy.
Meta: In connection with the website advertising measurement technology described in this Policy.
Professional advisers and public authorities: Where necessary for legal compliance, accounting, dispute resolution or a lawful request from a competent authority.

We aim to limit the information shared with each provider to what is necessary for its relevant function.

Depending on the provider and the service involved, a third party may act as our processor, an independent controller or another type of recipient under applicable law. The precise role depends on the actual contractual and technical arrangements.

9. International Transfers of Personal Data

Cabo Tours LDA operates in Cape Verde and uses services that may be provided by organisations located in other countries.

As a result, personal data may be transferred to or accessed from jurisdictions outside Cape Verde, including jurisdictions outside the European Economic Area or the United Kingdom.

The locations in which information is processed depend on the providers involved, their infrastructure and their contractual arrangements.

Where the GDPR or UK GDPR applies, transfers of personal data to countries outside the relevant protected area must comply with the applicable international-transfer requirements. Depending on the circumstances, this may require an adequacy decision, appropriate safeguards or another lawful transfer mechanism.

We aim to use providers and contractual arrangements that provide an appropriate level of protection for personal data.

For information about a specific international transfer, you may contact us at privacy@nolimitsadventure.com.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal obligations and the need to establish, exercise or defend legal claims.

Our standard retention period is one year from the relevant booking, activity or interaction, depending on the category of information and the purpose for which it was collected.

This standard period applies to the following categories, where appropriate:

Booking records: Retained for one year to manage reservations, provide customer support and maintain relevant operational records.
Customer enquiries and support conversations: Retained for one year to respond to enquiries, manage resulting bookings and address related issues.
Health and safety declarations: Retained as part of the signed waiver for one year, subject to applicable legal obligations and legitimate requirements relating to liability or legal claims.
Website analytics: Retained according to the retention settings of the relevant analytics service.
Consent and security records: Retained for as long as reasonably necessary to demonstrate consent choices, maintain security and meet applicable legal requirements.

Payment, accounting and tax records may need to be retained for longer than one year where required by applicable law. Similarly, information relevant to an actual or reasonably anticipated legal claim may be retained for a longer period where legally justified.

Where a longer retention period is necessary or legally required, we will retain only the information needed for that purpose and restrict its use accordingly.

When personal data is no longer required, we will take appropriate steps to delete or anonymise it, subject to applicable legal requirements and the technical capabilities of the systems involved.

11. How We Protect Personal Data

We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction.

These measures may include access restrictions, appropriate account permissions, security controls, secure data transmission and the use of service providers with relevant security protections.

Access to personal data should be limited to personnel and service providers who need it for legitimate business purposes.

No website, online service or electronic storage system can be guaranteed to be completely secure. Nevertheless, we seek to maintain safeguards appropriate to the nature of the information processed and the risks involved.

12. Your Privacy Rights

Depending on the applicable law and the circumstances of the processing, you may have the right to:

Request confirmation of whether we process your personal data.
Request access to personal data we hold about you.
Request correction of inaccurate or incomplete information.
Request deletion of personal data where the applicable legal conditions are met.
Request restriction of processing in circumstances provided by law.
Object to certain processing activities, particularly those based on legitimate interests.
Withdraw consent where processing is based on consent.
Request a copy of certain personal data in a portable format where the applicable law provides this right.
Lodge a complaint with the competent data protection authority.

These rights are not absolute. For example, we may need to retain certain booking, payment or accounting records to comply with legal obligations or establish, exercise or defend legal claims.

To exercise your rights, please email privacy@nolimitsadventure.com and describe your request. We may need to verify your identity before disclosing or changing personal data.

We will respond within the time limits imposed by applicable law.

12.1. Complaints

If you have concerns about our handling of your personal data, we encourage you to contact us first so that we can investigate the matter.

You may also have the right to lodge a complaint with the competent supervisory authority.

In Cape Verde, the relevant authority is the Comissão Nacional de Protecção de Dados (CNPD). If the GDPR or UK GDPR applies to the processing, you may also have rights to complain to a competent supervisory authority in the EU or the United Kingdom, as applicable.

13. Children's Personal Data

Our booking process generally collects the details of the lead traveller rather than the personal information of every participant.

We do not routinely request children's personal information through our standard booking process. However, children may participate in activities booked by a lead traveller, and limited information may be required to organise the activity safely.

Where personal data relating to a child is collected, we will process it only for appropriate booking, operational, safety or legal purposes and apply any additional protections required by applicable law.

Where consent is required for a child's personal data, the applicable legal requirements concerning age and parental or guardian authorisation will be followed.

14. Third-Party Websites and Services

Our website may contain links to third-party websites or services.

When you access a third-party service, its own privacy policy and terms may apply. We do not control the independent privacy practices of third parties, and we encourage you to review their documentation before providing information directly to them.

Our use of third-party providers for bookings, payments, analytics and customer support is described in this Policy, but their own services may also involve processing under their separate legal obligations.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business operations, the services we use, our data processing practices or applicable legislation.

The latest version will be published on our website with its updated revision date.

Where required by applicable law, we will provide additional notice or obtain consent for material changes affecting processing activities for which consent is required.

16. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact:

Cabo Tours LDA — No Limits Adventure

Djadsal Moradias, Block A (Blue Block)

Santa Maria, Sal Island, Cape Verde

Email: privacy@nolimitsadventure.com