Privacy Policy

The controller responsible for personal data collected through this website is:

Legal name

[TO BE COMPLETED] LEGAL NAME OF THE DATA CONTROLLER

Tax identification number

[TO BE COMPLETED] TAX NUMBER OF THE DATA CONTROLLER

Address

[TO BE COMPLETED] FULL ADDRESS OF THE DATA CONTROLLER

Privacy contact

[TO BE COMPLETED] PRIVACY EMAIL

The booking request form collects only the following data:

• the name of the person who wishes to make the booking;
• email address and telephone number;
• number of guests, including adults and children;
• requested arrival and departure dates;
• the contents of the booking request.

Visitors should avoid including sensitive data or information that is not needed to handle the request.

Providing this data is not a legal obligation. However, it is needed to answer the enquiry, check availability, prepare a proposal and, where applicable, proceed with a booking. Without it, the booking request cannot be handled fully.

After the booking request is confirmed, the data is sent to the dedicated booking management system and stored in a database controlled by the data controller. It is used solely to handle the request, check availability, prepare the proposal and, if confirmed, administer the booking.

The data is processed, as applicable to the particular request, to:

1. respond to contact and booking requests;
2. check availability;
3. send a proposal or quotation;
4. take pre-contractual steps requested by the visitor;
5. manage the booking when it is confirmed;
6. comply with applicable legal obligations after the booking is confirmed;
7. protect the form and website from spam, fraud or abuse, only where such a mechanism exists.

The main legal basis is Article 6(1)(b) GDPR where processing is necessary to take pre-contractual steps at the visitor’s request or to perform a contract. Where applicable, Article 6(1)(c) may also apply to compliance with a legal obligation.

Article 6(1)(f) will be used only where there is a specific, necessary and duly balanced legitimate interest, such as website security or preventing fraud and abuse. It will not be used as a general basis for every purpose.

The data is stored in the dedicated booking management database and may be accessed only by the controller and authorised people who need it to respond to the request, check availability or manage a booking.

Request data is not sold, assigned, shared or transferred to third parties in Portugal or abroad. Processing and booking management take place exclusively in the controller’s own system.

Data will be retained only for as long as necessary for the purposes for which it was collected. If the request does not lead to a booking, it should be deleted or anonymised when there is no longer a legitimate purpose or retention obligation.

The controller must complete the specific retention periods, including those for enquiries, proposals, confirmed bookings and legal obligations: [TO BE COMPLETED] APPLICABLE RETENTION PERIODS

No national or international transfers of personal data are made outside the dedicated booking management system. In particular, the form and processing described in this policy do not transfer data outside Portugal or the European Economic Area. If this changes, the policy will be updated before the new processing is used.

Under the GDPR, data subjects may exercise the following rights within the applicable legal limits:

• access to their personal data and information about its processing;
• rectification of inaccurate or incomplete data;
• erasure of data, where applicable;
• restriction of processing in the circumstances provided by law;
• objection to processing based on legitimate interests, where applicable;
• data portability, where the right applies;
• withdrawal of consent where processing is based on consent.

To exercise these rights, the data subject should contact the controller at [TO BE COMPLETED] PRIVACY EMAIL. The request may require reasonable confirmation of identity. As a rule, a response should be provided within one month, which may be extended in the cases provided for by the GDPR.

Without prejudice to any other administrative or judicial remedy, the data subject may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority.

Visit the CNPD website

The controller should apply technical and organisational measures appropriate to the risk to protect data against unauthorised access, loss, destruction, alteration or improper disclosure. These may include access controls, confidentiality, backups and protected communication channels, according to the infrastructure actually used.

No solely automated decisions or profiling are carried out using data submitted through this form. The form also does not use automated spam-prevention mechanisms.

This policy may be updated to reflect changes to the website, processing or applicable law. The date of the latest update should be stated here: [TO BE COMPLETED] DATE OF LAST UPDATE.