Privacy Policy

1. Who is responsible for your personal data?

Villa Luxa is the trading name of the accommodation business operated by:

Enthusiastic Time Unipessoal Lda.
NIF: 519418484
Alojamento Local registration number: 50745/AL
Address: Largo Ferreira de Castro 19, 2710-551 Sintra, Portugal
Email: luxa.villa.sintra@gmail.com
Telephone: +351 924 338 608

In this Privacy Policy, “Villa Luxa”, “we”, “us” and “our” refer to the accommodation business operated by Enthusiastic Time Unipessoal Lda.

For the purposes of the General Data Protection Regulation (GDPR), Enthusiastic Time Unipessoal Lda. is the data controller for the personal data processing activities described in this Policy, except where a third-party provider determines its own purposes and means of processing.

2. What personal data may we collect?

Depending on how you interact with us, we may collect:

• Contact information: name, email address and telephone number.
• Reservation information: booking reference, arrival and departure dates, number of guests, selected rate, reservation status and relevant booking details.
• Communication information: messages, enquiries, special requests, complaints and correspondence with us.
• Payment information: payment status, transaction reference, payment confirmation and refund information made available to us by the payment provider or booking platform.
• Guest registration information: information that may be required to comply with applicable Portuguese guest registration and reporting obligations.
• Technical information: information such as IP address, device and browser details, and website usage data, where collected through cookies or similar technologies in accordance with applicable law.

Information we do not store

Villa Luxa does not store in its ordinary reservation records:

• Copies or photographs of guests’ identity documents.
• Identity document numbers, such as passport or national identity card numbers.
• Guests’ postal codes.
• Full payment card numbers.
• Payment card expiry dates.
• Card security codes (CVV/CVC).

We do not ask guests to send full payment card details or card security codes by email.

Please note that third-party booking platforms and payment providers may independently collect or process some of this information under their own privacy policies. Their processing is separate from the information stored by Villa Luxa.

3. Guest registration and SIBA

Under applicable Portuguese law, accommodation providers must report the accommodation of foreign guests to the competent authorities through the Portuguese SIBA system (Sistema de Informação de Boletins de Alojamento).

Where this obligation applies, the information required for foreign guest registration is entered directly into the SIBA system.

Villa Luxa does not retain copies of identity documents or identity document numbers in its ordinary reservation records.

The information is processed for the specific purpose of complying with the applicable legal reporting obligation. This does not mean that the information is never processed: it is viewed and entered for the purpose of submitting the legally required accommodation report.

The processing and retention of information within SIBA are subject to the applicable rules governing that system and the competent authorities.

4. Why do we process your personal data?

We process personal data for the following purposes:

Purpose	Legal basis
Managing enquiries and communicating with you	Steps taken at your request before entering into a contract, or our legitimate interests
Creating and managing reservations and providing accommodation	Performance of a contract
Managing payments, payment confirmations and refunds	Performance of a contract
Meeting guest registration, tax, accounting and other legal requirements	Compliance with a legal obligation
Handling complaints, disputes and legal claims	Legal obligations and legitimate interests
Website analytics and measuring website performance	Consent where required by law
Advertising measurement, remarketing and personalised advertising	Consent where required by law
Sending marketing communications	Consent or another lawful basis where permitted by applicable law

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before the withdrawal.

5. Booking, payment and technology providers

We use third-party providers to operate the accommodation business and website. These may include:

Reservation and property management systems

We may use property management systems, reservation management software and other technology providers to manage bookings, availability, guest communications and accommodation operations.

These providers may process personal data on our behalf as data processors or, depending on the services they provide, determine certain processing purposes and means independently.

Stripe

We use Stripe as a payment service provider for relevant transactions.

Payment card details are entered and processed through Stripe’s secure payment systems or the relevant booking platform. Villa Luxa does not store full payment card numbers, expiry dates or CVV/CVC security codes.

We may receive payment confirmations, transaction references, payment status and refund information needed to manage reservations and accounts.

Stripe may act as an independent data controller for certain processing activities under its own privacy policy. Please consult Stripe’s privacy information for details of its processing.

Third-party booking platforms

If you make a reservation through a third-party booking platform, that platform may collect and process your personal data in accordance with its own privacy policy and terms.

Villa Luxa receives the reservation information necessary to manage your booking and provide the accommodation.

Google Analytics

We may use Google Analytics to understand how visitors use our website and to measure website performance.

Analytics technologies that require consent will only be activated after the visitor has provided the required consent.

Google Ads

We may use Google Ads technologies to measure advertising performance and, where enabled, support advertising and remarketing activities.

Technologies requiring consent will only be activated after the required consent has been obtained.

Meta

We may use Meta technologies, such as the Meta Pixel or related tools, to measure advertising performance and, where enabled, support advertising and remarketing activities.

Technologies requiring consent will only be activated after the required consent has been obtained.

The exact technologies enabled on the website may change. The Cookie Policy and cookie consent tool should be consulted for current information.

6. Who may receive your personal data?

Depending on the circumstances, personal data may be shared with:

• Reservation and property management system providers.
• Stripe and relevant banks or payment providers.
• Booking platforms through which you make a reservation.
• Website hosting, technical support and IT providers.
• Google and Meta, where their services are used and the applicable legal requirements are met.
• Accountants, legal advisers and professional service providers.
• Public authorities and competent bodies where disclosure is required by law, including through SIBA where applicable.

We only share information where there is an appropriate legal basis and to the extent reasonably necessary for the relevant purpose.

7. International data transfers

Some service providers may process personal data outside the European Economic Area (EEA), including in countries that may not provide the same level of data protection as the European Union.

Where personal data is transferred internationally, we will rely on an appropriate transfer mechanism under the GDPR, where required. This may include an adequacy decision or appropriate safeguards such as Standard Contractual Clauses.

For information about a particular provider’s international transfers, please consult that provider’s privacy documentation.

8. How long do we keep personal data?

We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account applicable legal retention requirements.

Examples include:

• Reservation and guest contact information: for the period needed to manage the reservation and any related claims, subject to applicable legal obligations.
• Invoices and accounting records: for the retention period required under Portuguese tax and accounting law.
• Guest registration information: information entered into SIBA is handled under the rules applicable to that system. Villa Luxa does not retain identity document copies or identity document numbers in its ordinary reservation records.
• Enquiries and correspondence: for as long as reasonably necessary to respond and maintain relevant records.
• Marketing data: until consent is withdrawn or the data is otherwise no longer needed for the relevant marketing purpose.
• Consent and cookie preference records: your cookie choice and the date you made it are kept in a cookie in your own browser for 180 days, after which we ask again.

Specific retention periods may vary depending on the type of record and the legal obligations that apply.

9. Your data protection rights

Subject to the conditions and limitations set out in the GDPR, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Receive certain personal data in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the competent data protection supervisory authority.

In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD): https://www.cnpd.pt/

To exercise your rights, contact us at luxa.villa.sintra@gmail.com. We may need to verify your identity before responding.

10. Marketing communications

We will only send marketing communications where we have an appropriate legal basis to do so.

If you receive marketing emails from us, you can unsubscribe using the link in the message or contact us at luxa.villa.sintra@gmail.com.

Unsubscribing from marketing communications does not affect service messages relating to an existing reservation.

11. Cookies and similar technologies

Our website may use cookies and similar technologies for essential website functions, analytics and advertising.

Where required by law, non-essential cookies and similar technologies will remain inactive until you provide valid consent.

You can manage or withdraw your preferences at any time through “Cookie settings” at the foot of every page.

Further information is available in our Cookie Policy.

12. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration or disclosure.

No method of transmission or storage can be guaranteed to be completely secure. We therefore cannot guarantee absolute security, but we work to protect information in accordance with applicable law.

13. Children

Our services are booked by adults. Where personal data relating to a child is provided as part of a reservation or where required by law, it will be processed only for the relevant accommodation, legal or safety purposes.

14. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology or legal obligations.

The latest version will be published on our website with its update date.

15. Contact

For questions about this Privacy Policy or the processing of your personal data, contact:

Enthusiastic Time Unipessoal Lda. – Villa Luxa
Largo Ferreira de Castro 19, 2710-551 Sintra, Portugal
Email: luxa.villa.sintra@gmail.com
Telephone: +351 924 338 608