PRIVACY POLICY

The protection of your personal data is a priority for Casa da Villa.

Below, we describe who we are, for what purposes we may use your personal data, how we process it, with whom we may share it, how long we keep it, and how you can contact us to exercise your rights.

Who are we?

Your personal data will be processed by Casa da Villa, a local accommodation brand located in Monção, Portugal.

For the purposes of this Privacy Policy, Casa da Villa is the data controller within the meaning of the General Data Protection Regulation, hereinafter referred to as GDPR.

For privacy-related matters, you may contact us through:

Email: [insert email]
Address: [insert contact address]

Why do we process your personal data?

Your personal data may be collected and processed by Casa da Villa for the following purposes:

a) To comply with legal obligations to which Casa da Villa is subject, namely obligations relating to guest registration, accommodation bulletins, tax and invoicing purposes.

b) For the performance of the temporary accommodation agreement, including reservation management, payment processing, check-in and check-out management, guest identification, security deposit management, communication with guests and provision of services related to the stay.

c) For communication purposes, including email, telephone or digital platform communications regarding reservations, check-in instructions, stay information, guest support, requests for information and, where consent has been given, marketing communications.

d) For the protection of Casa da Villa’s property, accommodation, equipment and assets, as well as for internal management, statistical analysis and service improvement purposes.

Failure to provide the personal data required for the purposes referred to in points a) and b) may prevent Casa da Villa from complying with its legal or contractual obligations and may result in the impossibility of confirming or maintaining the reservation.

What personal data do we collect?

Within the scope of its activity, Casa da Villa may collect and process the personal data necessary to provide the contracted services, manage reservations and comply with legal obligations, namely:

  • identification data;
  • contact details;
  • nationality and travel document details, where legally required;
  • reservation and stay details;
  • payment or payment card data;
  • billing data;
  • communications exchanged with guests;
  • information necessary for check-in, check-out and accommodation management.

What is the legal basis for processing your data?

The processing of your personal data is carried out on the following legal grounds:

a) Performance of a contract or pre-contractual steps, namely for reservation management, check-in, check-out and provision of the accommodation service, pursuant to Article 6(1)(b) of the GDPR.

b) Compliance with legal obligations, namely tax, invoicing and guest registration obligations, pursuant to Article 6(1)(c) of the GDPR.

c) Consent, where applicable, particularly for marketing communications, pursuant to Article 6(1)(a) of the GDPR.

d) Legitimate interest, namely for the protection of property, prevention of damage, internal management and service improvement, pursuant to Article 6(1)(f) of the GDPR.

How long do we keep your personal data?

Without prejudice to any legal, regulatory or judicial retention periods, personal data will only be kept for the period strictly necessary to fulfil the purposes for which it was collected.

Data required for tax, accounting or legal compliance purposes may be kept for the legally required period.

Data processed on the basis of consent will be kept until consent is withdrawn, unless another legal basis justifies its continued processing.

With whom may we share your personal data?

Casa da Villa may need to share some personal data with third parties, strictly where necessary and in accordance with applicable law.

These recipients may include:

a) Public authorities to whom Casa da Villa is legally required to provide information, including tax authorities and competent authorities responsible for guest registration and accommodation bulletin obligations.

The SIBA — Sistema de Informação de Boletins de Alojamento — states that establishments must register with the UCFE in order to communicate accommodation bulletins electronically, and its FAQ confirms that those who rent rooms, parts of a house or the whole property as local accommodation must communicate the presence and departure of foreign guests through an accommodation bulletin.

b) Service providers and subcontractors acting on behalf of Casa da Villa, including website hosting providers, booking platforms, payment service providers, cleaning and laundry service providers, accounting firms, legal advisers, insurance companies and technical support providers.

c) Competent judicial, administrative or supervisory authorities, whenever required by law or in the context of legal proceedings, security incidents or compliance obligations.

Casa da Villa will only share personal data to the extent necessary and will take appropriate measures to ensure that such data is processed securely and lawfully.

Are your data transferred outside the European Union?

As a general rule, personal data collected by Casa da Villa will not be transferred to entities established outside the European Union or the European Economic Area.

Exceptionally, and where certain service providers are used, personal data may be processed outside the European Union, namely for technical, hosting, storage, back-up or digital service purposes.

In such cases, Casa da Villa will ensure that appropriate safeguards are in place, in accordance with the GDPR, including adequacy decisions, standard contractual clauses or other legally recognised mechanisms.

What are your rights?

Under the GDPR, you may exercise the following rights at any time:

  • right of access to your personal data;
  • right to rectification of inaccurate or incomplete data;
  • right to erasure of personal data, where legally applicable;
  • right to restriction of processing;
  • right to object to processing;
  • right to data portability;
  • right to withdraw consent, where processing is based on consent.

The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal, nor does it affect processing carried out on another lawful basis, such as contractual necessity or compliance with legal obligations.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados — CNPD.

Security and confidentiality

Casa da Villa is committed to keeping your personal data secure and adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

However, the transmission of information over the internet is not completely secure, and Casa da Villa cannot guarantee the absolute security of data transmitted through digital means.

Casa da Villa respects the confidentiality of your information and does not sell, distribute or make your personal data commercially available to third parties.

Contacts

If you have any questions regarding this Privacy Policy or if you wish to exercise any of your rights, please contact us:

Email: alcasadavilla@gmail.com
Address: Praça da República, n.º 134, 4950-506 Monção

Casa da Villa may update this Privacy Policy from time to time. Guests are therefore advised to review this document periodically to ensure they are aware of the most recent version.