Last updated: 10 August 2026
This Privacy Policy explains how PLATEIA HABITUAL LDA (“we”, “us” or “our”) collects, uses, shares and protects your personal data when you use the Pocket Theatre audio walking application and website (together, the “Service”).
We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), Portuguese Law No. 58/2019 and other applicable data protection laws.
This summary highlights the main points of our privacy practices. The full Policy below provides more detailed information.
The controller responsible for your personal data is:
PLATEIA HABITUAL LDA
Avenida Manuel Violas, 476
São Félix da Marinha
4410-137 Portugal
NIF: 519005813
Email: info@notbad.show
Privacy enquiries and data protection requests: dpo@notbad.show
Phone: +351 915 529 055
The email address dpo@notbad.show is our privacy contact. It does not indicate that we have formally appointed a Data Protection Officer under Articles 37–39 GDPR.
We process personal data lawfully, fairly and transparently. We collect only the data reasonably necessary for the purposes described in this Policy, take reasonable steps to keep it accurate and secure, and retain it only for as long as necessary or legally required.
Depending on how you use the Service, we may collect the following categories of personal data.
Your email address, including an address you enter to unlock or purchase a tour or that we receive from our payment provider in connection with a purchase.
An email address may be required to complete a purchase, receive an access code, restore access or save progress across devices. If you do not provide it, some of these features may not be available.
Access and promotional codes, purchase references, transaction amounts and statuses, refund information, tour entitlements and whether you have used a free demonstration.
The tour, show and stop you are using; audio start, pause, resume and completion events; listening time; playback speed and position; pop-up interactions; autoplay failures; saved progress; and survey or feedback responses, including NPS scores and any free text you submit.
Some of this information is processed as essential session or progress data needed to provide and restore the Service. More detailed behavioural analytics are processed only as described under “Analytics data” below.
If you choose GPS mode and grant location permission, we process your device’s latitude, longitude and reported accuracy while a tour is running.
Depending on your device and settings, coordinates may be sampled approximately every 15 seconds or after about 15 metres of movement. They may be used to:
Current coordinates are processed as needed to provide the live GPS functionality. Where a walking route needs to be calculated, the origin and destination coordinates necessary for that calculation are sent by our server to a routing provider.
Unless you have separately consented to optional route analytics, we do not retain your current GPS coordinates in our own analytics records as a history of the route you walked.
GPS mode is optional. If you do not grant location permission, you can complete the tour in manual mode.
You can withdraw your device’s location permission through its operating-system settings. This prevents future access to your location but does not automatically delete information already lawfully collected. You may contact us to request deletion, subject to applicable legal exceptions.
IP address, request date and time, browser and device type, operating system, cookies and similar identifiers, page and route paths, error information and security logs.
Some technical information is generated automatically when your device communicates with our hosting, content-delivery, map, routing or other infrastructure providers.
If you consent, we may collect additional detailed information about how you interact with the Service, including feature and pop-up interactions, interface and autoplay diagnostics, listening behaviour and, where separately enabled, GPS route points used to analyse walked routes.
Whether or not you consent to optional analytics, we may process limited operational information needed to provide, restore, maintain and protect the Service. This may include tour and session state, stops reached or completed, audio start and completion status, listening time, saved playback position and speed, route-calculation status and necessary security, error and request-log information.
We do not use these essential operational records to retain a history of your GPS route unless you have given the relevant consent.
If you refuse analytics consent, we do not use optional analytics cookies or retain optional behavioural analytics or GPS route histories.
If you consent, we may collect and store UTM parameters, campaign, advertisement or ad-set identifiers, source information, referring website and landing-page information, including information used to distinguish first- and last-touch attribution.
Payments are processed by Stripe. Stripe collects and processes payment details such as card information directly. We do not receive or store complete card numbers.
We receive limited transaction information needed to confirm and administer a purchase, such as the payment reference, amount, currency, status and associated email address.
We do not ask for passport information, personal tax identification numbers, dates of birth, nationality, photographs or videos.
We do not intentionally request personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric information, health information, or information concerning a person’s sex life or sexual orientation.
Please do not include sensitive personal information in free-text feedback. If such information is provided unexpectedly, we will process or delete it as appropriate and in accordance with applicable law.
We obtain personal data:
We process personal data for the following purposes and legal bases.
We process data as necessary to:
We process and retain information where necessary for invoicing, accounting, tax compliance, fraud reporting, responses to lawful authority requests and other legal obligations.
We process limited personal data where necessary for our legitimate interests in:
When relying on legitimate interests, we consider the necessity and proportionality of the processing and its possible impact on your rights and freedoms.
Where required, we rely on your consent for:
You can withdraw consent at any time through “Cookie settings” in the website footer, through the settings made available in the Service, by using the unsubscribe link in a marketing email, or by contacting dpo@notbad.show.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.
We disclose personal data only where reasonably necessary to operate the Service, complete transactions, comply with the law or protect our rights.
Recipients may include:
We do not sell your personal data.
We do not install advertising pixels solely because you arrive through an advertising or referral link. Where campaign identifiers or referring information are available from a link, we retain that information for marketing attribution only where the required consent has been obtained.
Our providers and the infrastructure used by the Service may change as the Service develops. You may contact dpo@notbad.show for further information about the providers currently used and the data they process in connection with the Service.
Some service providers or their affiliates may process personal data outside the European Economic Area.
The location in which a particular provider processes data depends on the service and, where applicable, the region configured for our account. The use of an EEA primary hosting or database region does not necessarily mean that all supporting infrastructure, technical logs, backups, edge services or subprocessors are located exclusively within the EEA.
Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, we use an applicable lawful transfer mechanism. This may include:
The mechanism applicable to a particular transfer may depend on the provider, service, processing location and the provider’s current contractual arrangements.
You may contact dpo@notbad.show for further information about the transfer mechanism and safeguards applicable to a particular provider.
Unless a longer period is required by law or reasonably necessary for legal claims, we apply the following retention periods:
At the end of the applicable period, personal data is deleted or irreversibly anonymised unless continued retention is required by law or necessary to establish, exercise or defend legal claims.
Backups may retain deleted information for a limited additional period until they are securely overwritten. Access to backup data is restricted and it is not used for ordinary business purposes.
Subject to the conditions and exceptions provided by applicable law, you may have the right to:
These rights are not absolute. For example, we may retain information that we are legally required to keep or that is necessary to establish, exercise or defend legal claims.
To exercise your rights, contact dpo@notbad.show. We may request information reasonably necessary to verify your identity, such as confirmation from the email address used for the tour.
We respond without undue delay and normally within one month. Where permitted by law, this period may be extended by a further two months, taking into account the complexity and number of requests. We will inform you of any extension and the reasons for it within the initial one-month period.
Exercising your data protection rights is normally free of charge. Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or refuse to act, as permitted by the GDPR.
You can stop marketing emails at any time by using the unsubscribe link included in each marketing message.
You have the right to lodge a complaint with the Portuguese supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD)
Avenida D. Carlos I, 134, 1.º
1200-651 Lisboa
Portugal
You can find the CNPD’s official website by searching for “Comissão Nacional de Proteção de Dados Portugal”.
You may also have the right to complain to the competent supervisory authority in the EEA country where you live, work or believe an infringement occurred.
The Service is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16.
If you believe that a person under 16 has provided us with personal data, please contact dpo@notbad.show. We will investigate and delete the information where appropriate.
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures include access controls, restricted administrative access, row-level database security where applicable, encrypted network connections and security monitoring.
No method of electronic transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we regularly review our measures and seek to improve them as the Service develops.
We use a consent interface that separates cookies and similar technologies into categories such as necessary, analytics and marketing.
Necessary technologies are used to provide and secure the Service and do not require consent where permitted by law. Analytics and marketing technologies are activated only after any legally required consent has been obtained.
For information about the cookies and similar technologies used, including local and session storage, their purposes and durations, see our Cookie Policy.
You can review or change your choices at any time through “Cookie settings” in the website footer. Withdrawal does not affect processing carried out before your preferences were changed.
We may update this Privacy Policy to reflect changes to the Service, our providers, our data practices or applicable law.
The current version will be published on this page with a revised “Last updated” date. If changes materially affect how we use personal data or your rights, we will provide additional notice where appropriate.
For questions about this Privacy Policy or our handling of personal data, contact:
Email: dpo@notbad.show
General enquiries: info@notbad.show
Phone: +351 915 529 055
© 2026 PLATEIA HABITUAL LDA