Casa d'Amares Privacy Policy

1. Introduction

Casa d’Amares (“Hotel”, “we”, “us”, or “our”) is a boutique hotel with six rooms located in Amares, Portugal. We are committed to protecting the privacy and personal data of our guests, website users, business partners, and all other individuals who interact with us.

This Privacy Policy explains how we collect, use, disclose, and protect your personal data in accordance with:

Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR)
Portuguese Law no. 58/2019, which implements the GDPR in Portugal

By using our services or providing your personal data, you acknowledge that it will be processed as described in this Policy.

2. Data Controller

The data controller responsible for processing your personal data is:

Casa d’Amares
Rua de São Veríssimo Casa 1,
4720-427 Amares, Portugal
NIPC / Tax Number: 518678857
Telephone: +351 937 119 948 (call to the national fixed network)
General Contact E-mail: info@casadeamares.pt
Privacy Contact E-mail: info@casadeamares.pt

3. Categories of Personal Data We Process

We may collect and process the following categories of personal data:

Identification & Contact Data

Name, surname, nationality, date of birth, passport/ID details, address, e-mail, telephone number.

Booking & Stay Information

Reservation details, dates of stay, room type, number of guests, preferences, check-in/out data.

Payment & Billing Data

Invoice information, partial card details (when processed by us), payment history.

Legal & Regulatory Data

Data required for mandatory registration of foreign guests with Portuguese authorities (SEF/AIMA/SIBA).

Marketing & Communication Data

Consent preferences, e-mail address, communication history, feedback.

Website & Cookies Data

IP address, device details, browsing information, usage logs, cookies (subject to consent where required).
CCTV Footage (if installed)

Video recordings in common areas for security purposes.

We do not intentionally collect sensitive data unless voluntarily provided (e.g., allergies), and only with appropriate legal basis.

4. Purposes and Legal Bases for Processing

Hotel Services & Booking Management

Managing reservations, stays, payments, invoicing
Legal basis: Contract performance; legal obligation.

Legal Compliance

Mandatory reporting of foreign guests to immigration authorities (SEF/AIMA)
Tax and accounting obligations
Legal basis: Legal obligation.

Customer Support & Communication

Responding to inquiries
Pre-arrival and post-stay communication
Legal basis: Contract performance; legitimate interest.

Marketing

Sending newsletters and promotional offers
Legal basis: Consent or legitimate interest, depending on the channel.

Website Operation & Analytics

Improving site performance, security, and user experience
Legal basis: Legitimate interest; consent for non-essential cookies.

Security

CCTV and access control
Legal basis: Legitimate interest in protecting guests, staff, and property.

5. Mandatory Guest Registration with Authorities

Under Portuguese law, all accommodation providers must collect and communicate identification data of all foreign guests to immigration authorities via SIBA (operated by SEF/AIMA).

This includes:

Name, nationality, date of birth, ID/passport number, issuing country, and stay dates.
This is a strict legal obligation, and refusal to provide the required information may make accommodation impossible.

6. Recipients of Personal Data

Your data may be shared with:

Public authorities: SEF/AIMA (foreign guest registration), tax authorities, police/courts when required
Service providers: IT, hosting, booking engines, payment processors, accountants
Professional advisers: Legal and audit services
Security services: CCTV operators (if applicable)

All service providers operate under GDPR-compliant agreements.
We do not sell or rent personal data.

7. International Transfers

We aim to store all data within the European Economic Area (EEA).
If transfers outside the EEA occur, they will follow GDPR safeguards (SCCs or adequacy decisions).

8. Data Retention

Personal data is stored only for the necessary period:

Booking & guest records: For statutory civil, financial, and tax periods
SEF/AIMA data: As required by law
Accounting & invoicing records: As required under Portuguese legislation
Marketing data: Until consent is withdrawn or after defined inactivity
CCTV footage: Short retention period unless required for incidents

After expiry of retention periods, data is securely deleted or anonymised.

9. Security Measures

We apply technical and organisational measures to protect your data, including:

Secure systems and encrypted communication
Access control and authentication
Regular backups and monitoring
Employee confidentiality and training
Incident response and notification procedures

10. Your Rights

Under GDPR, you may exercise the following rights:

Access your personal data
Rectify inaccurate data
Erase data (“right to be forgotten”)
Restrict processing
Data portability
Object to processing based on legitimate interests
Withdraw consent at any time (for consent-based processing)

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD).

11. Cookies

Our website may use cookies for:

Essential functionality
Analytics and usage insights
Marketing and personalization
Non-essential cookies require your explicit consent.

12. Children’s Data

Our services are not intended for individuals under age 18.
We do not knowingly collect data from minors without parental consent where required.

13. Changes to This Policy

We may update this Privacy Policy to reflect operational, legal, or regulatory changes.
The “Last updated” date will indicate its latest version.

14. Contact for Privacy Matters

For questions or to exercise your rights, please contact:

Casa d’Amares – Data Protection Contact
Rua de São Veríssimo Casa 1
4720-427 Amares, Portugal
E-mail: info@casadeamares.pt
Telephone: +351 937 119 948 (call to the national fixed network)