Privacy Policy – Carvalha House

Carvalha House values the protection of your privacy and the transparent handling of your personal data. This policy explains how we collect, use and protect your data, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679).

1. Data controller

The carvalhahouse.pt website
is managed by Carvalha House (Manuela Quintanilha), based in Arcos de Valdevez, Portugal.
Contact email: hello@carvalhahouse.pt

2. Data collected

We may collect and process the following personal data:

Contact form: name, email, phone and message.

Booking form: name, email, phone, stay dates and any preferences.

Browsing data: IP address, device type, browser and pages visited (via Google Analytics and Microsoft Clarity).

3. Purposes of processing

Your data is processed to:

Respond to contact and booking requests.

Comply with legal and contractual obligations.

Improve the user experience on the website (through analytics tools).

Ensure website security and prevent abuse.

4. Legal basis

The processing of personal data is based on:

Performance of a contract (Art. 6(1)(b) GDPR) – for bookings.

Consent (Art. 6(1)(a) GDPR) – for the submission of contact forms.

Legitimate interest (Art. 6(1)(f) GDPR) – for statistical analysis of site usage.

5. Data sharing

Your personal data is neither sold nor shared with third parties, except where necessary to:

Comply with legal obligations.

Provide web hosting services (server located in Portugal).

Use of analytics services from Google (Google Analytics) and Microsoft (Clarity), which may transfer data outside the European Union, based on standard contractual clauses approved by the European Commission.

6. Cookies and analytics tools

The site uses cookies to improve the user experience.

Google Analytics: analyses browsing patterns.

Microsoft Clarity: records interactions on the site anonymously to improve usability.

You can manage or disable cookies through your browser settings.

7. Data retention

Booking data: kept for the period necessary to comply with legal obligations (up to 10 years, in line with tax obligations).

Contact data: kept for up to 12 months after responding to the request.

Analytics data: retained for a maximum period of 26 months.

8. Rights of data subjects

Under the GDPR, you have the right to:

Access, rectify or erase your data.

Restrict or object to processing.

Data portability.

Withdraw consent at any time (where applicable).

Lodge a complaint with the National Data Protection Commission (CNPD).

9. Security

We implement appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access, alteration or disclosure.

10. Changes to this policy

We reserve the right to update this privacy policy whenever necessary. The updated version will be published on our website.