Privacy Policy - Carvalha House

Carvalha House values the protection of your privacy and the transparent handling of your personal data. This policy explains how we collect, use and protect your data, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679).

1. Responsible for treatment

The site carvalhahouse.pt
is managed by Carvalha House (Manuela Quintanilha), based in Arcos de Valdevez, Portugal.
Contact email: hello@carvalhahouse.pt

2. Data collected

We may collect and process the following personal data:

Contact form: name, email, telephone and message.

Booking form: name, email, telephone number, dates of stay and any preferences.

Browsing data: IP address, type of device, browser and pages visited (via Google Analytics and Microsoft Clarity).

3. Purposes of processing

Your data is processed for:

Responding to contact requests and booking requests.

Complying with legal and contractual obligations.

Improve the user experience on the website (through analytical tools).

Ensure the security of the website and prevent abuse.

4. Legal basis

The processing of personal data is based on:

Execution of contract (Art. 6(1)(b) GDPR) - in the case of reservations.

Consent (Art. 6(1)(a) GDPR) - in the case of sending contact forms.

Legitimate interest (Art. 6(1)(f) GDPR) - in the statistical analysis of website use.

5. Data sharing

Your personal data is not sold or shared with third parties, except when necessary for:

Complying with legal obligations.

Guaranteeing web hosting services (server located in Portugal).

Use of analytical services from Google (Google Analytics) and Microsoft (Clarity), which may transfer data outside the European Union, based on standard contractual clauses approved by the European Commission.

6. Cookies and analytical tools

The website uses cookies to improve the user experience.

Google Analytics: analyzes browsing patterns.

Microsoft Clarity: records interactions on the site anonymously to improve usability.

You can manage or disable cookies via your browser settings.

7. Data retention

Reservation data: kept for the period necessary to comply with legal obligations (up to 10 years, according to tax obligations).

Contact details: kept for up to 12 months after the request has been answered.

Analytical data: retained for a maximum of 26 months.

8. Holders' rights

Under the terms of the GDPR, you have the right to:

Access, rectify or delete your data.

Limiting or opposing treatment.

Data portability.

Withdraw consent at any time (where applicable).

File a complaint with the National Data Protection Commission (CNPD).

9. Security

We have implemented appropriate technical and organizational measures to protect your data against loss, misuse, unauthorized access, alteration or disclosure.

10. Changes to this policy

We reserve the right to update this privacy policy whenever necessary. The updated version will be published on our website.