Privacy policy
This policy explains what personal data Granvila collects when you visit our website, make an enquiry, book or stay at the villa, why we collect it, who we share it with and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and Portuguese law, and it applies to guests from every country.
Who we are
The data controller is Fernandez & Hemingstam LDA (NIF 513798641), trading as Granvila, Rua da Abelheira, 8125-173 Quarteira, Portugal (local accommodation licence 110483/AL). For anything about your data, write to [email protected] or call +351 915 800 533. We are a small family business and are not required to appoint a data protection officer; your request will be handled by the owners directly.
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Name, email, phone, country, dates, group size and your message when you enquire or use the contact form | To answer you and prepare a quote | Steps you asked for before a contract (GDPR art. 6(1)(b)) |
| Booking details: lead guest's contact details, billing address, number and ages of guests, extras booked, special requests | To make and manage your booking and stay | Contract (art. 6(1)(b)) |
| Payment information | To take the deposit, balance and any extras. Card payments are handled by Stripe; we never see or store your full card number | Contract (art. 6(1)(b)) |
| Invoicing details (name, address, tax number if you give one) | To issue invoices and keep accounting records | Legal obligation (art. 6(1)(c)) |
| For each guest who is not a Portuguese national: name, date and place of birth, nationality, residence, passport or ID number and issuing country, dates of stay | Portuguese law requires accommodation providers to report foreign guests to the authorities through the SIBA system within three working days of arrival | Legal obligation (art. 6(1)(c)) |
| For Portuguese guests: the equivalent details in our guest register (Livro de Hóspedes) | Required by Portuguese law | Legal obligation (art. 6(1)(c)) |
| Number of guests aged 16 or over and nights stayed | To charge and declare the Loulé municipal tourist tax | Legal obligation (art. 6(1)(c)) |
| Security deposit details (amount, method, and bank details if refunded by transfer) | To hold and return your security deposit | Contract (art. 6(1)(b)) |
| Images from CCTV cameras on the outer perimeter and gates | Security of guests, staff and property | Legitimate interest (art. 6(1)(f)) |
| How you use our website (pages viewed, approximate location, device and browser, how you arrived), only if you accept analytics cookies | To understand which pages are useful and improve the website | Consent (art. 6(1)(a)) |
| Messages by email, phone or WhatsApp during your stay | To help you before and during your stay | Contract (art. 6(1)(b)) |
| Complaints, reviews and correspondence about a dispute | To handle complaints and defend legal claims | Legal obligation and legitimate interest (art. 6(1)(c) and (f)) |
We only ask for what we need. If you do not provide the details the law requires (for example passport details), we may not be able to accommodate you. We do not use your data for automated decision-making or profiling, and we do not sell it.
We will only send you news or offers if you have asked to receive them, and you can stop them at any time.
Children
We collect the names and ages of children in your group only because they are needed for the booking, safety equipment (cots, high chairs) and, for non-Portuguese children, the legal guest registration. This data is supplied by the adult making the booking.
CCTV
Cameras cover the outer perimeter of the property only. There are no cameras inside the villa. Signs at the property tell you where recording takes place. Recordings are kept for 30 days and then deleted, unless they are needed for an incident report to the police or insurers.
Who we share data with
We share only what each party needs, and only for the purposes above:
- Portuguese authorities: SIBA guest registration, the tax authority (invoices), Loulé municipality (tourist tax), and the police or courts where required by law.
- Service providers working for us: Stripe (card payments), one.com (website, booking system and email hosting), Cloudflare (website delivery and security), Google (website statistics, only with your consent), our invoicing software provider, our accountant, and the staff and contractors who clean, maintain and service the villa.
- Booking platforms: if you book through a partner such as Airbnb, that company is a separate controller of your data under its own privacy policy, and passes us the details we need for your stay.
- Suppliers you ask us to arrange: for example a chef, transfer or other extra, who receive only your name, dates and the details needed to provide that service.
Transfers outside Europe
Some providers (for example Stripe, Cloudflare, Google and, if you message us, WhatsApp/Meta) may process data in the United States or other countries outside the European Economic Area. Where they do, the transfer is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Enquiries that do not become a booking: up to 2 years.
- Booking records, invoices and accounting documents: 10 years, as Portuguese tax law requires.
- Guest registration (SIBA and Livro de Hóspedes): for the period the law requires, then deleted.
- Security deposit bank details: until the deposit has been returned.
- CCTV recordings: 30 days.
- Complaints and dispute files: until the matter and any limitation period have ended.
Cookies
Our website uses no advertising cookies and does not track you across other sites.
Strictly necessary: Cloudflare may set a security cookie to protect the site from automated abuse, and when you pay by card Stripe sets cookies to prevent fraud. These do not need your consent.
Analytics, only if you accept: we use Google Analytics 4 to count visits and see which pages are useful. It sets the cookies _ga and _ga_*, which last up to two years, and Google keeps the statistics for 14 months. IP addresses are not stored by Google Analytics 4. Until you accept, no analytics cookies are set and Google Analytics is not loaded. Your choice is remembered in your browser; you can change it at any time with the “Cookie settings” link at the bottom of every page.
Fonts and images are served from our own website.
Your rights
You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive the data you gave us in a portable format. Where we rely on your consent you can withdraw it at any time. Some rights are limited where the law requires us to keep data (for example invoices and guest registration).
To use any of these rights, email [email protected]. We will reply within one month, and we may ask you to confirm your identity.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or to the supervisory authority in the country where you live.
Security
Our website and booking system use encrypted connections, card data stays with Stripe, and access to guest data is limited to the owners and the people who need it to run your stay. Passport details are used only for the legal registration.
Changes
We may update this policy when our services or the law change. The version and date at the top show when it was last changed.