The protection of your personal data is important to Casa das Laranjeiras. This Privacy Policy explains who is responsible for processing your personal data, why and how we use it, with whom it may be shared, how long it may be kept, and how you can exercise your rights.
Who are we?
Your personal data are processed by Ângela Pereira, operator of Casa das Laranjeiras, hereinafter referred to as “Casa das Laranjeiras”.
Casa das Laranjeiras is the data controller for the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR).
Contact details:
Email: info@casalaranjeiras.pt
Address: Rua Luís Alves Serrano, Lote 9, 7570-347 Grândola, Portugal
Why do we process your information?
Casa das Laranjeiras may collect and process personal data for the following purposes:
a) Compliance with legal obligations
To comply with legal, tax, accounting and guest registration obligations applicable to local accommodation establishments, including the communication of guest information to the competent authorities where required by law.
b) Management of reservations and stays
To manage reservations, payments, check-in and check-out, guest identification and communication, room allocation and the provision of services associated with the stay, such as breakfast.
This may also include responding to enquiries and taking the necessary steps before a reservation is confirmed.
c) Communications relating to reservations and stays
To send information necessary for the management of a reservation or stay, including booking confirmations, payment information, pre-arrival communications, check-in instructions, information about requested services and responses to guests’ enquiries.
d) Management and protection of Casa das Laranjeiras
To manage the operation of the accommodation, protect the property and its assets, prevent or address misuse, damage or security incidents and, where appropriate, carry out internal statistical and operational analysis.
What kind of personal data do we collect?
Depending on the reservation, stay or interaction with Casa das Laranjeiras, we may collect and process the following categories of personal data:
- Identification data, such as name, date of birth, nationality, country of residence, identification document type and number, and issuing country;
- Contact data, such as email address, telephone number and postal address where applicable;
- Reservation and stay information, such as dates of stay, room booked, number of guests, arrival information and preferences or requests communicated in connection with the stay;
- Billing and tax information, where required or requested for invoicing purposes;
- Payment-related information necessary to manage the reservation and payment process;
- Communications exchanged with Casa das Laranjeiras before, during or after the stay.
Where payment is made through a third-party payment provider, such as Stripe, payment data may be processed directly by that provider in accordance with its own privacy practices.
Where a reservation is made through a third-party booking platform, such as Booking.com or Airbnb, Casa das Laranjeiras may receive personal data relating to the reservation and the guests directly from that platform.
What is the legal basis for processing your personal data?
Casa das Laranjeiras processes personal data only where there is a valid legal basis under the GDPR.
Personal data necessary to manage reservations, payments, check-in and check-out, guest communications and services connected with the stay are processed because they are necessary for the performance of the accommodation contract or to take steps requested by the guest before entering into that contract, in accordance with Article 6(1)(b) of the GDPR.
Personal data required for guest registration, invoicing, accounting or other statutory obligations are processed because Casa das Laranjeiras is subject to legal obligations, in accordance with Article 6(1)(c) of the GDPR.
Where processing is necessary for the protection and proper management of Casa das Laranjeiras, including the prevention or management of misuse, damage, security incidents or the establishment, exercise or defence of legal claims, Casa das Laranjeiras may rely on its legitimate interests under Article 6(1)(f) of the GDPR, provided that those interests do not override the rights and freedoms of the individuals concerned.
Is providing personal data mandatory?
Certain personal data are required in order to make or manage a reservation, provide accommodation services and comply with legal obligations applicable to Casa das Laranjeiras.
Where the requested information is necessary for these purposes, failure to provide it may prevent Casa das Laranjeiras from confirming or managing the reservation, completing the required guest registration procedures, providing access to the accommodation or complying with its legal obligations.
How long do we keep your personal data?
Casa das Laranjeiras retains personal data only for as long as necessary for the purposes for which it was collected and processed, and for any additional period required by applicable legal, regulatory, accounting or tax obligations.
Different retention periods may therefore apply depending on the type of information and the purpose for which it is processed.
Personal data contained in accounting, invoicing and tax records may be retained for the period required by applicable tax legislation.
Guest identification information collected for mandatory accommodation reporting purposes will be retained for the period required by the applicable legislation.
Other information relating to reservations, stays and communications will be retained only for as long as reasonably necessary for the management of the stay, the fulfilment of contractual obligations, the resolution of disputes or the establishment, exercise or defence of legal claims.
Once the applicable retention period has expired and the data are no longer required for any lawful purpose, they will be deleted or anonymised, where appropriate.
Who can we share your personal data with?
Casa das Laranjeiras may share personal data, where necessary and appropriate, with the following categories of recipients:
a) Public authorities and official bodies
Public authorities to which Casa das Laranjeiras is legally required to provide information, including authorities responsible for guest registration, tax, accounting or other statutory obligations.
b) Booking and accommodation management service providers
Service providers used to manage reservations, guest information, check-in, invoicing or other aspects of the stay, including Talkguest, which provides booking and accommodation management services used by Casa das Laranjeiras.
c) Payment service providers
Payment providers, such as Stripe, where necessary to process payments, refunds or other payment-related operations.
d) Booking platforms
Where a reservation is made through a third-party platform, such as Booking.com or Airbnb, personal data may be exchanged with that platform to the extent necessary to manage the reservation, payment, communication or stay.
e) Professional and technical service providers
Accountants, legal advisers, insurers, IT providers, website or hosting providers and other service providers who may process personal data where necessary to provide services to Casa das Laranjeiras.
f) Competent authorities
Judicial, police, regulatory or supervisory authorities where disclosure is required by law or is necessary in connection with legal proceedings, the prevention or investigation of unlawful activity, or the protection of the rights and property of Casa das Laranjeiras or others.
Where third-party service providers process personal data on behalf of Casa das Laranjeiras, appropriate contractual and data protection requirements will apply in accordance with applicable law.
Some third-party providers may process personal data as independent data controllers in accordance with their own privacy policies and applicable data protection law.
International transfers of personal data
Some of the service providers used by Casa das Laranjeiras may process or store personal data outside the European Economic Area (EEA).
Where personal data are transferred to a country outside the EEA, Casa das Laranjeiras and/or the relevant service provider will ensure that an appropriate legal mechanism and safeguards are in place in accordance with applicable data protection law.
Such safeguards may include an adequacy decision adopted by the European Commission, participation in an approved data protection framework, standard contractual clauses approved by the European Commission, or other safeguards permitted under the GDPR.
In particular, payment service providers such as Stripe may process personal data internationally in connection with the provision, security and operation of their services.
What are your rights?
Under the GDPR, and subject to the conditions applicable in each case, you may have the right to:
- access your personal data;
- request the rectification of inaccurate or incomplete personal data;
- request the deletion of your personal data;
- request the restriction of processing;
- object to certain processing, including processing based on legitimate interests;
- request the portability of your personal data, where applicable.
Requests to exercise these rights may be sent to info@casalaranjeiras.pt.
The exercise of these rights is generally free of charge. However, where a request is manifestly unfounded or excessive, in particular because of its repetitive nature, Casa das Laranjeiras may, where permitted by law, charge a reasonable fee or refuse to act on the request.
You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) if you consider that the processing of your personal data infringes applicable data protection law.
Automated decision-making
Casa das Laranjeiras does not use automated decision-making, including profiling, that produces legal effects or similarly significantly affects guests.
Security and confidentiality
Casa das Laranjeiras is committed to protecting personal data and adopts appropriate technical and organisational measures designed to prevent unauthorised access, loss, alteration, disclosure or misuse of personal data.
However, the transmission of information over the Internet cannot be guaranteed to be completely secure, and Casa das Laranjeiras cannot guarantee the absolute security of information transmitted electronically.
Casa das Laranjeiras does not sell personal data or make personal data commercially available to third parties. Personal data will only be shared in accordance with this Privacy Policy and applicable law.
Questions and exercise of rights
If you have any questions about this Privacy Policy, the processing of your personal data or the exercise of your data protection rights, you may contact:
Casa das Laranjeiras / Ângela Pereira
Email: info@casalaranjeiras.pt
Address: Rua Luís Alves Serrano, Lote 9, 7570-347 Grândola, Portugal
Changes to this Privacy Policy
Casa das Laranjeiras may update this Privacy Policy from time to time to reflect changes in its activities, services, legal requirements or data processing practices.
The most recent version will be made available on the Casa das Laranjeiras website, together with the date of the latest update.