Privacy Policy

Marujo's House & Heart is committed to protecting the privacy and personal data of its guests, website users, and all individuals who interact with us. This Privacy Policy transparently describes how we collect, use, store, and protect your personal data, in compliance with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — and applicable Portuguese legislation, namely Law no. 58/2019, of August 8.

By using our website or making a booking, you declare that you are aware of the conditions described herein.

1. Data Controller

The entity responsible for processing your personal data is:

2. Personal Data Collected

Within the scope of our local accommodation activity and website management, we may collect and process the following categories of personal data:

2.1. Identification and contact details

• Full name
• Email address
• Phone / mobile number
• Tax Identification Number (NIF), when requested for billing purposes
• Billing address, when required for invoice issuance
• Nationality and identity document details (as required by Portuguese immigration authority SEF/AIMA)

2.2. Booking details

• Check-in and Check-out dates
• Number of guests
• Preferences or special requests
• Booking history

2.3. Payment details

• Transaction data (processed by secure third-party payment providers — we never store full credit card details)
• Proof of payment

2.4. Browsing data

• IP address
• Browser and device type
• Pages visited, length of visit, and navigation patterns
• Data collected through cookies and similar technologies

2.5. Communication data

• Content of messages sent via email, contact forms, or other platforms
• Reviews and feedback submitted on the website

3. Purposes of Processing

The collected personal data is processed for the following purposes:

• Booking management: processing, confirmation, and management of accommodation bookings, including communications related to the stay
• Compliance with legal obligations: legally required data may be processed to comply with obligations applicable to local accommodation, including communication to competent authorities when legally required, and tax/accounting duties
• Guest communication: responding to inquiries, sending check-in instructions, and supporting guests during their stay
• Service improvement: analyzing website usage patterns and guest reviews to improve the user experience
• Direct marketing: sending promotional communications, news, and special offers, strictly subject to prior consent
• Security: fraud prevention and protection of our systems and property

4. Legal Basis for Processing

The processing of your personal data is based on the following legal grounds, as provided for in Article 6 of the GDPR:

• Performance of a contract: when processing is necessary for the execution of the accommodation contract or pre-contractual steps requested by you
• Compliance with legal obligations: when processing is required by law, such as for tax, accounting, or communication to competent authorities when legally required
• Consent: for sending marketing communications and using non-essential cookies. Consent can be withdrawn at any time
• Legitimate interests: for improving our services, ensuring system security, and preventing fraud, provided that these do not override your fundamental rights and freedoms

5. Data Sharing with Third Parties

Your personal data may be shared with the following categories of entities, strictly to the extent necessary for the indicated purposes:

• Booking platforms: Booking.com, Airbnb, etc., when bookings are made through them
• Payment processors: payment service providers that securely handle transaction processing
• Hosting services: Supabase (database infrastructure), with servers located within the European Union
• Email communication services: platforms used to send transactional and marketing emails
• Public authorities: SEF/AIMA, Tax and Customs Authority, and other public entities when legally required
• Advisors and professional services: accountants, lawyers, and other professionals bound by professional secrecy

We do not sell, rent, or lease your personal data to third parties for marketing purposes. All processors accessing your data are bound by agreements ensuring compliance with the GDPR.

6. International Data Transfers

We prioritize storing personal data on servers located within the European Economic Area (EEA). If any transfer outside the EEA is necessary, we will ensure that appropriate safeguards are implemented, such as standard contractual clauses approved by the European Commission, in accordance with Articles 44 to 49 of the GDPR.

7. Data Retention Periods

Personal data is retained only for as long as strictly necessary to fulfill the purposes for which it was collected:

Once the retention period expires, data is securely deleted or anonymized, making identification impossible.

8. Cookies Policy

Our website uses cookies — small text files stored on your device — to ensure proper website function and improve your experience.

8.1. Types of cookies used

• Strictly necessary cookies: essential for website operation (e.g., session management and language preferences). Do not require consent.
• Analytical cookies: allow us to understand how visitors use the site, collecting aggregated and anonymous information. Require consent.
• Functionality cookies: remember your preferences to customize your experience.

8.2. Cookie management

You can manage your cookie preferences at any time through your browser settings or using the cookie consent banner on our website. Disabling cookies may impact website functionality.

9. Rights of the Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: request confirmation of data processing and access a copy of your data
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure ("to be forgotten"): request data deletion when there is no legal ground for keeping it
• Right to restriction of processing: request restriction of data processing under certain conditions
• Right to data portability: receive your data in a structured, commonly used, machine-readable format
• Right to object: object to data processing based on legitimate interests
• Right to withdraw consent: withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at reservas@marujoshouses.pt. We will respond within 30 days. This period may be extended by up to two additional months in case of complex or multiple requests, with prior notice.

10. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe our data processing violates the GDPR. In Portugal, the competent authority is:

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. These measures include data encryption in transit (HTTPS/TLS) and at rest, access control, regular updates, and security assessments of our processors.

12. Minors

Our website and services are not directed at minors under 16. We do not intentionally collect personal data from minors without parental consent. Data of minors collected during a booking is the responsibility of the booking holder.

13. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy at any time. Significant changes will be communicated through our website. The date of the last update is indicated at the top of this document.

14. Contacts

For questions or exercising your rights, contact us at:

This document constitutes the Privacy Policy of Marujo's House & Heart and is an integral part of the general Terms & Conditions.