Privacy policy
Which personal data we process, why, for how long and how to exercise your rights.
1. Data controller
Vilamoura Rentals. For any question about your personal data, write to [email protected] with the subject "Personal data".
2. What data we process
- Booking requests: name, email, phone, dates of stay, number of adults and children, the chosen property and your message.
- Contact form, emails and phone calls: name, email, phone, subject and the content of the conversation.
- Confirmed bookings: the data needed for the stay and for invoicing, and the identity details Portuguese law requires for guest registration.
- Technical data: the server logs technical data (IP address, browser, requested pages) for security reasons. To prevent form abuse we only store an irreversible version (hash) of your IP address.
- Statistics: only if you accept statistics cookies (see the cookie policy).
3. Why we use your data and on what basis
| Purpose | Legal basis (GDPR, Article 6(1)) |
|---|---|
| Answering booking requests and enquiries | Pre-contractual steps at your request (point b) and legitimate interest in replying to people who contact us (point f) |
| Managing the booking and the stay | Performance of the contract (point b) |
| Guest registration and reporting, invoicing and accounting | Legal obligation (point c) |
| Website security and abuse prevention | Legitimate interest (point f) |
| Website usage statistics | Consent (point a), which you can withdraw at any time |
We do not make automated decisions or build profiles from your data.
4. How long we keep it
- Requests and messages that do not lead to a booking: deleted after 12 months.
- Booking and invoicing data: for the period required by tax law (as a rule, 10 years).
- Guest registration: for the period set by law.
- Statistics: for the period set in Google Analytics, up to 14 months.
5. Who we share it with
We do not sell or pass on your data for marketing. Where necessary, data may be accessed by: our website hosting and email providers, which process it on our behalf; the competent authorities, when the law requires it (for example, reporting foreign guests); and, if you accept statistics, Google Ireland Limited (Google Analytics).
6. Transfers outside the European Union
These only happen if you accept statistics: Google Analytics may transfer data to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework, recognised by the European Commission as ensuring an adequate level of protection.
7. Your rights
You can ask for access, rectification, erasure, restriction or portability of your data, object to its processing and withdraw any consent you have given, without affecting processing carried out before. Write to [email protected]; we reply within one month. You may also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).
8. Security
The website uses an encrypted connection (HTTPS), the management area is restricted and password protected, and the forms are protected against abuse. Data is only kept for the periods stated above.
9. Children
Booking requests can only be made by people over 18. Data about children travelling with their family is only processed as far as the stay and the law require.
10. Changes
This policy may be updated. The date of the last update is shown on this page.
Last updated: 3 November 2026