Privacy Policy

1. Data Controller

The entity responsible for processing your personal data ("the controller") is:

2. Data We Collect

We may collect the following types of personal data:

• Identity and Contact Data: Name, email address, phone number, and any message content you provide through our contact or booking forms.
• Booking Data: Check-in/check-out dates, duration of stay, and number of guests.
• Guest Legal Registration Data: For every stay we are required to record the guest's name, contact details, nationality, date of birth, country of residence, travel document type/number/issuing country/expiry and address. For accommodations in Spain, when required, we also record sex, document support number, postal code, municipality and province. This may include accompanying minors when they are part of the stay.
• Property Owner Data: Property details and personal information required for management or project proposals.
• Website Usage Data: public page paths, interactions with selected buttons, language, property category, approximate device/location data and pseudonymous online identifiers generated by Google Analytics or Meta Pixel, only after the applicable consent.
• Private Arrival Portal Data: in the private portal we record access events (when the portal is opened), whether the arrival video was started, which items of the check-out list are ticked and when, and the link to the corresponding booking. We do not record the video's duration, progress, pauses or completion.
• Technical Diagnostic Data: When an error or performance issue occurs, we collect the error message and stack trace, the route/URL where it happened, browser/device information and performance metrics, so we can diagnose and fix the problem.

3. Purpose and Legal Basis for Processing

Your data is processed for the following purposes, based on these legal grounds:

• Managing bookings, guest communication and arrival support: To fulfill our contractual obligations with you, including using private portal access events and whether the arrival video was started to avoid unnecessary reminders and provide timely instructions (Art. 6.1.b GDPR).
• Handling proposals for owners and investors: To take pre-contractual steps at your request (Art. 6.1.b GDPR).
• Guest registration and reporting to authorities: To comply with our legal obligations under Portuguese and Spanish law (Art. 6.1.c GDPR).
• Service diagnostics, security and stability: To detect, diagnose and fix errors, protect the service and keep it available, based on our legitimate interest with data minimisation and no advertising use (Art. 6.1.f GDPR).
• Improving the departure experience: To understand which parts of the check-out list guests actually use, so that we can shorten it and stop asking for things that do not help, based on our legitimate interest. We read this in aggregate, we do not use it to assess or contact you individually, and we never use it for advertising (Art. 6.1.f GDPR).
• Marketing Communications: To send you promotional information, where you have provided your explicit consent (Art. 6.1.a GDPR).
• Website analytics: To understand use of our public website and improve it, only with your consent (Art. 6.1.a GDPR).
• Campaign measurement: To measure public page views and completed contacts resulting from campaigns, only with separate marketing consent (Art. 6.1.a GDPR).

4. Data Sharing

Your data will not be shared with third parties, except:

• Portuguese Authorities: For accommodations in Portugal we communicate guest registration data to SIBA (Sistema de Informação de Boletins de Alojamento), operated by the Unidade de Coordenação de Fronteiras e Estrangeiros (UCFE/SSI), and, where legally required, to the competent authorities (GNR/PSP).
• Spanish Authorities: For accommodations in Spain we communicate guest registration data to the Ministerio del Interior through the SES.Hospedajes platform.
• Essential Service Providers: Third-party service providers who support our activity under strict confidentiality agreements (e.g., accounting, insurance, IT support).
• Analytics Provider: Google Ireland Limited provides Google Analytics after consent. We do not send contact-form contents, names, email addresses, phone numbers, booking dates or private portal identifiers to Analytics.
• Marketing measurement provider: Meta Platforms Ireland Limited provides Meta Pixel after separate marketing consent. We send only explicit public-page and completed-contact events, without names, email addresses, phone numbers, messages, dates, guest counts or private portal identifiers. Advanced Matching, Conversions API and customer lists are disabled.
• Technical Monitoring Provider: Functional Software, Inc. (Sentry) provides error and performance monitoring. Data is stored in Sentry's German (EU) region; we acknowledge that support access or subprocessing outside the EEA may occur, protected by Standard Contractual Clauses and appropriate safeguards.

5. International Data Transfers

Some of our providers are established in the European Economic Area, such as Google Ireland Limited (Google Analytics) and Meta Platforms Ireland Limited (Meta Pixel). Others, such as Functional Software, Inc. (Sentry), are based outside the EEA but host data in the European Union (German region). Their processing may involve access to or transfers of data outside the EEA.

6. Data Retention

Your personal data is stored only for the period strictly necessary to fulfill the purposes for which it was collected, or as required by applicable laws (e.g., tax and commercial legislation).

• Contact form submissions (no booking): 12 months
• SIBA guest registration data (Portugal): 1 year counted from the day after the check-out is communicated
• SES.Hospedajes guest registration data (Spain, professional activity): 3 years after the end of the service
• Booking and invoicing data strictly necessary for tax, accounting or defence of legal claims: kept for the applicable statutory periods; this period is not used to justify retaining identity documents beyond what is necessary
• Property owner proposals: 3 years
• Marketing consent records: retained until consent is withdrawn
• Technical diagnostic data (Sentry): up to 90 days, or any shorter period configured in the service
• Google Analytics user and event data: 14 months; analytics cookies: no more than 13 months
• Meta Pixel measurement cookies: no more than 90 days; Meta's use of events follows the platform's applicable settings and terms
• Private portal interaction events (portal opened, arrival video started, check-out list items ticked): 12 months

After these periods, data will be securely deleted unless a longer retention is required by law.

7. Your Rights

You have the right to access, rectify, delete, or restrict the processing of your data. You also have the right to object to processing and to request data portability.

To exercise these rights, please send a clear request to:

privacy@lusiberiastays.com

You also have the right to lodge a complaint with a supervisory authority, namely the CNPD (Comissão Nacional de Proteção de Dados) in Portugal, or the AEPD (Agencia Española de Protección de Datos) in Spain.

8. Cookies and Tracking Technologies

Optional Google Analytics and Meta Pixel cookies are activated only after separate consent choices on public website pages. Both are disabled on management, owner, client and guest portals. Google Analytics never receives query parameters; Meta Pixel can operate only with pre-approved, validated campaign parameters and is blocked when any other parameter is present. You can change or withdraw each consent at any time through ‘Cookie settings’ in the footer. For more information, see our Cookie Policy.

9. Data of Minors

Our public website is not directed to individuals under the age of 18 and we do not knowingly collect personal data from minors through it. However, we may process personal data of minor guests when they are part of a stay, provided by the adult responsible for the booking, only to the extent necessary to deliver the stay and to comply with legal registration obligations. Data about minors is not used for marketing and is not sent to Google Analytics or Meta Pixel.

10. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

11. Contact

For any questions regarding this Privacy Policy or how we handle your data, please contact us at:

privacy@lusiberiastays.com