Privacy Policy

Last updated: April 2026

Data controller

The data controller for personal data processed through this website is the owner of Casa de Portalegre. You can reach the owner using the details on the Contact page.

What we collect

  • Booking details: first name, last name, email address, optional phone number, check-in and check-out dates, number of guests, any special requests you include.
  • Payment data: card details are collected and processed directly by Stripe. We never see or store card numbers. We only receive a Stripe payment reference.
  • Reviews: the name you supply and the review text when you submit a review.
  • Server logs: IP address, browser type, and request timestamps, retained for up to 30 days for security and debugging.

Why we collect it and legal basis

  • To fulfil your booking (performance of a contract, GDPR Art. 6(1)(b)).
  • To comply with Portuguese tax and tourism-registration obligations (legal obligation, Art. 6(1)(c)).
  • To secure and operate this website (legitimate interests, Art. 6(1)(f)).

We do not use your data for marketing and we do not sell it to third parties.

Who sees your data

  • The property owner.
  • Stripe (payment processing) — see their privacy policy.
  • Resend (transactional email delivery for booking confirmations).
  • Cloudflare R2 (storage for property photos/videos — no guest data).
  • Our hosting provider (Akamai/Linode) in the EU.

How long we keep it

Booking records are retained for the period required by Portuguese tax and tourism law (typically 10 years). Server logs are rotated after 30 days. Reviews remain public until you ask us to remove them.

Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data erased, subject to our legal retention obligations.
  • Object to processing based on legitimate interests.
  • Lodge a complaint with the Portuguese Data Protection Authority (CNPD — cnpd.pt).

Send requests to the email address on the Contact page. We respond within 30 days.

Cookies

This website does not use tracking cookies, advertising cookies, or third-party analytics. The only client-side storage we use is a short-lived session token in your browser's sessionStorage when you log in to the owner portal — it is cleared when you close the tab.