Privacy Policy

1. Data controller

The controller of the personal data collected through this website is Casa do Porco, registered at R. Nossa Sra. da Piedade 681, 4515-588 Melres, Gondomar, Portugal (full identification and contacts in the Legal Notice).

For any data protection question you may contact us at reservas@casadoporco.com.

2. Data we collect

We collect only the data needed to manage your booking and your stay:

• Identification and contact data: name, email, phone, address, country and preferred language.
• Booking data: arrival and departure dates, room, number of guests, experiences and special requests.
• Guest identity documents (type, number and image of the document), where required by law.
• Payment data: chosen method and payment status. We do not store full credit card details.
• Technical data: IP address and access logs, for the security and operation of the website.

3. Purposes and legal bases

We process your data on the following bases, as set out in the GDPR:

• Performance of a contract: managing the booking, the stay, the services booked and contact with the guest.
• Compliance with a legal obligation: reporting accommodation data to the competent authorities under Portuguese law on the entry and stay of foreign nationals, and keeping tax records.
• Consent: sending promotional communications and using non-essential cookies. You may withdraw your consent at any time.
• Legitimate interest: website security, fraud prevention and improvement of our services.

4. Retention periods

We keep booking and stay data for the applicable legal periods (as a rule, up to 5 years for tax purposes and proof of contract) and identity documents only for the period necessary to comply with the legal obligation to register guests.

Data processed on the basis of consent is kept until consent is withdrawn.

5. Recipients

Data may be shared with service providers acting on our behalf and under contract — hosting and IT infrastructure, email service, payment processing and booking platforms — and with public authorities where legally required.

We do not sell or transfer your personal data to third parties for marketing purposes.

6. Transfers outside the EEA

Where a service provider is located outside the European Economic Area, we ensure that the transfer is carried out with the safeguards provided for in the GDPR, in particular standard contractual clauses approved by the European Commission.

7. Your rights

You may exercise the following rights at any time and free of charge:

• Access, rectification and erasure of your data.
• Restriction of and objection to processing.
• Portability of the data you provided.
• Withdrawal of consent, without affecting the lawfulness of processing already carried out.

8. Complaints to the supervisory authority

You have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, at www.cnpd.pt, without prejudice to contacting us first.

9. Security

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration, including encrypted connections, access control and restricted storage of identity documents.

10. Changes

We may update this policy to reflect legal or operational changes. The version in force is always the one published on this page, together with the last update date.