Privacy Policy

This Privacy Policy explains how personal data is collected and processed through the website home-stay-braga.pt in compliance with the GDPR and Portuguese data protection law.

1. Data Controller
   Carla Castro, NIPC 206740751
   Rua das Gramelhas nº22, Este São Pedro, 4715-431 Braga
   Email: castrcarla@gmail.com

2. Personal Data Collected
   Identification data: full name, nationality, birth date, identification document details and fiscal number.
   Contact data: email address and phone number.
   Reservation data: stay dates, number of guests, accommodation details and payment status.
   Technical data: IP address, device information, browser type and usage statistics.
   Payment data: handled exclusively by secure third-party payment processors.

3. Purpose of Processing
   Personal data is processed for:
   • Managing reservations and check-in registration required for Local Lodging operations.
   • Complying with legal and fiscal obligations.
   • Communicating with Guests regarding their stay.
   • Improving Website performance and security.
   • Preventing fraud.
   • Sending marketing communications when consent is explicitly provided.

4. Legal Basis
   Data is processed under one or more of the following legal bases:
   • Performance of a contract.
   • Compliance with legal obligations.
   • Legitimate interests ensuring service quality and security.
   • User consent for marketing and non-essential cookies.

5. Data Retention
   Personal data is kept only for the necessary period.
   Identification and reservation data may be stored for up to the legally required duration.
   Fiscal data may be retained for up to 10 years.
   Marketing data is retained until consent is withdrawn.

6. Data Sharing
   Data may be shared with:
   • Tax authorities and legal entities when required.
   • Immigration authorities for mandatory AL guest registration.
   • Payment processors.
   • Booking platforms.
   • Hosting and technical service providers.
   Personal data is never sold.

7. International Transfers
   Some third-party services may transfer data outside the EU. Such transfers occur only under GDPR-compliant safeguards, including adequacy decisions and standard contractual clauses.

8. User Rights
   Users may exercise the following rights at any time:
   • Access to personal data.
   • Correction of inaccurate data.
   • Deletion of data when legally applicable.
   • Restriction or objection to processing.
   • Data portability.
   Requests must be sent to: castrcarla@gmail.com

9. Security Measures
   The Provider applies technical and organisational security measures including encrypted connections, restricted data access and secure backups.

10. Policy Updates
    This Policy may be updated to reflect changes in practices or legislation.

11. Complaints
    Users may submit complaints to the competent national authority or through the ADR platform:
    https://www.consumidor.gov.pt