Privacy Policy
and Data Processing

1. Data Controller

The data controller responsible for processing your personal data is:

2. Scope and Purpose

This Privacy Policy applies to the processing of personal data collected through the website quintadabarradinha.pt and any direct communication (email, phone) established with Quinta da Barradinha.

Your personal data is processed for the following purposes:

• Booking management — processing and confirming cottage reservation requests.
• Pre- and post-stay communication — sending relevant information about your stay, check-in, check-out, and customer support.
• Compliance with legal obligations — particularly those arising from local accommodation activity (registration with SEF/AIMA, invoicing, accounting).
• Service improvement — anonymous and aggregated analysis of website usage to improve the user experience.

3. Data Collected

We collect only the data strictly necessary for the purposes described above:

• Full name
• Email address
• Phone number
• Check-in and check-out dates
• Number of guests
• Preferences or special requests voluntarily provided
• Browsing data (IP address, browser type, pages visited) — collected anonymously and in aggregate form

We do not collect special category data (sensitive data) within the meaning of Article 9 of the GDPR.

4. Legal Basis for Processing

The processing of your personal data is based on the following legal grounds set out in Article 6 of Regulation (EU) 2016/679 (GDPR):

• Performance of a contract (Art. 6(1)(b)) — processing necessary for the management and fulfilment of your reservation.
• Compliance with a legal obligation (Art. 6(1)(c)) — tax obligations, guest registration and reporting to competent authorities.
• Legitimate interests (Art. 6(1)(f)) — service improvement and website security, where these do not override the data subject's interests or fundamental rights.
• Consent (Art. 6(1)(a)) — for marketing communications, when expressly authorised.

5. Data Retention

Personal data is retained for the minimum period necessary for the purposes that justified its collection, without prejudice to legally imposed retention periods:

• Booking data — 5 years after the end of the stay, due to tax obligations (Article 52 of the VAT Code and Article 123 of the CIRC).
• Guest registration data — period defined by current local accommodation legislation.
• Marketing communications — until consent is withdrawn or a deletion request is made.
• Anonymous browsing data — maximum 26 months.

Upon expiry of the applicable period, data is irreversibly deleted or anonymised.

6. Sharing with Third Parties

Your personal data is not sold, rented or transferred to third parties for commercial purposes. It may be shared, to the strictly necessary extent, with:

• Booking platforms (e.g., Booking.com, Airbnb) — when a reservation is made through these platforms, under their respective privacy policies.
• Public authorities — SEF/AIMA, Tax and Customs Authority, and other entities, when required by law.
• Technical service providers — web hosting and email services, contractually bound to comply with the GDPR.

Any transfer of data to countries outside the European Economic Area (EEA) is carried out with the appropriate safeguards provided for in the GDPR (Articles 45 to 49).

7. Cookies

Our website may use strictly necessary technical cookies for its proper functioning. These cookies do not collect personally identifiable information and do not require consent under Article 5(3) of Directive 2002/58/EC (ePrivacy).

Should analytical or marketing cookies be used, your prior and explicit consent will be requested, and you may withdraw it at any time through your browser settings or the consent management platform.

8. Your Rights

Under the GDPR (Articles 15 to 22), you have the right to:

• Access — obtain confirmation as to whether your data is being processed and receive a copy.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data, where applicable.
• Restriction of processing — restrict processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing purposes.
• Not to be subject to automated decisions — not be subject to decisions based solely on automated processing.
• Withdrawal of consent — withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us in writing at quintabarradinha@gmail.com. We will respond within a maximum of 30 days from receipt of the request (Article 12(3) of the GDPR).

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or disclosure, in accordance with Article 32 of the GDPR. Communication between your browser and our website is carried out via a secure protocol (HTTPS/TLS).

10. Complaints

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority in Portugal:

11. Changes to this Policy

We may update this Privacy Policy to reflect legal or operational changes. The most recent version will always be available on this page, with the date of last update. In the event of material changes, we will notify data subjects through appropriate means.