Privacy policy

1. Who is responsible for your data

The controller is Casa d'Olivença, Rua de Olivença 10, 7350-075 Elvas, Portugal.

• ·NIF: 271772905
• ·Registration number: AL 102158/AL
• ·Email: casadeolivenca@outlook.com
• ·Phone and WhatsApp: +351 969 821 094

We are not required to appoint a data protection officer. If you have any questions about your data, please contact us directly at the email address above.

2. Data you provide to us

When you fill in the booking form, we process your name, email address, telephone number (optional), preferred arrival and departure dates, the number of guests, the room you have chosen and any message you include.

Purpose: to assess your request, check availability and send you a reply or a confirmation.

Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

If you contact us by email, telephone or WhatsApp, we process the information in your message solely in order to reply to you. Legal basis: our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR) or, where your message concerns a stay, taking pre-contractual steps.

3. Data relating to your stay

If you go on to book with us, we also process the data we need to welcome you and to comply with our legal obligations:

• ·Guest registration: as a registered alojamento local (local lodging establishment), we are required by Portuguese Lei n.º 23/2007 to record our guests' identification details and report them to the competent Portuguese authorities (by submitting the boletim de alojamento, or guest registration form, to AIMA, formerly SEF). Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR). We cannot accommodate you without this information.
• ·Invoicing and accounting: your name, address, NIF or other tax identification number and the details of your stay, so that we can issue a valid invoice. Legal basis: legal obligation (Article 6(1)(c) GDPR).
• ·The tourist tax, where applicable, and any special requests you share with us to make your stay more enjoyable.

4. Data processed automatically

Our website is hosted by Netlify. As with any website, the server logs technical data, including your IP address, the time of your visit, the page requested and your browser type.

Purpose: to make the website available, keep it secure and detect faults or misuse.

Legal basis: our legitimate interest in a secure, properly functioning website (Article 6(1)(f) GDPR).

We do not use analytics software, visitor statistics or tracking technology, and we do not build visitor profiles.

5. Maps and external content

Our contact page includes two maps from Google Maps. We deliberately do not load them automatically: instead, you first see a neutral placeholder with a button. Only when you click that button is the map loaded, at which point your browser connects to Google and sends it, among other things, your IP address.

Legal basis: your explicit consent (Article 6(1)(a) GDPR). If you do not click, no data whatsoever is shared with Google.

You can find out more in our cookie policy.

6. Who we share your data with

We never sell your data, and we share it only where necessary:

• ·Microsoft: we use Outlook for email, so your messages are stored on Microsoft's servers.
• ·Netlify: our hosting provider. Netlify processes the technical server logs, and receives and stores the booking requests you send through the form; we are notified of each request by email.
• ·The competent authorities: AIMA, for the statutory guest registration, and the Portuguese tax authority (Autoridade Tributária), for invoicing.
• ·Our accountant, solely to process your invoice for tax purposes.

We have data processing agreements in place with our processors, which require them to process your data only on our instructions and to keep it secure.

7. Transfers outside the European Economic Area

Microsoft and Netlify are based in, or process data in, the United States. As a result, your data may be processed outside the European Economic Area.

For these transfers we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework or, where a provider is not certified under it, on the standard contractual clauses adopted by the European Commission, supplemented by appropriate safeguards.

If you would rather your data did not pass through the web form, you are welcome to email us or send us a WhatsApp message directly instead.

8. How long we keep your data

• ·Booking requests that do not result in a stay: no more than 12 months after our last contact with you.
• ·Enquiries: no more than 12 months after we have dealt with your question.
• ·Data relating to a stay with us, invoices and accounting records: 10 years, the statutory retention period for tax records in Portugal.
• ·Statutory guest registration data: for as long as the applicable law requires.
• ·Technical server logs: normally no longer than 30 days.

When these periods expire, we delete your data or anonymise it permanently.

9. How we protect your data

The Site can only be accessed over an encrypted connection (HTTPS). Access to our email and our records is restricted to those who need it for their work, and is protected by strong passwords and two-factor authentication.

We keep no more data than necessary and maintain no guest database of our own on the website. Booking requests are stored in Netlify's secure forms area, which only we can access, and deleted in line with the periods above.

10. Your rights

Under the GDPR you have the following rights:

• ·Access to the data we process about you.
• ·Rectification of inaccurate or incomplete data.
• ·Erasure of your data, except where we are legally required to keep it.
• ·Restriction of processing, and the right to object to processing based on our legitimate interest.
• ·Data portability: receiving your data in a commonly used digital format.
• ·Withdrawal of your consent, at any time and without giving a reason. This does not affect the lawfulness of any processing carried out before you withdrew it.

To exercise any of these rights, email us at casadeolivenca@outlook.com. We will respond within one month. To make sure we do not disclose data to the wrong person, we may ask you to verify your identity.

11. Lodging a complaint

If you are unhappy with how we handle your data, please let us know — we will be glad to work with you to put things right.

You also have the right to lodge a complaint at any time with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisbon, Portugal (www.cnpd.pt). If you live in another Member State, you may also complain to the supervisory authority in your own country.

12. What we do not do

To be clear, and to save you some reading:

• ·We do not sell or rent your data to third parties.
• ·We do not send newsletters or use your data for advertising.
• ·We do not use analytics, tracking cookies or advertising networks.
• ·We do not make decisions about you based on automated processing or profiling.
• ·We do not ask for special categories of personal data, such as information about your health, and we ask that you do not include any such data in the form.
• ·Our services are not aimed at children; children stay with us only under the responsibility of an accompanying adult, who provides their details on their behalf.

13. Changes to this policy

We may update this privacy policy, for example when we start using a new service or when the law changes. The current version is always available on this page, with the date of the latest change shown at the top.