Privacy Policy

Last updated: 27 October 2026

1. Data controller

Vila Milreu Guest House, Rua de Faro, Estoi, 8005-463 Faro, Portugal · [email protected] · AL 98430/AL

2. What data we collect and why

  • Bookings (online booking system): first and last name, email, phone, country, optional address and notes, dates, room and guests. Purpose: managing your reservation and stay. Legal basis: performance of a contract (art. 6(1)(b) GDPR).
  • Payments: card payments are processed directly by Stripe; we do not see or store full card numbers. Legal basis: contract.
  • Contact form: name, email, subject and message, to answer your request. Legal basis: pre-contractual steps / legitimate interest. The form is protected by Google reCAPTCHA against spam.
  • Guest registration at check-in: identification data required by Portuguese law for short-term rental (alojamento local) and, for foreign guests, the mandatory reporting to the competent authorities (AIMA) through the official online platform. Legal basis: legal obligation.
  • Invoicing: data needed to issue invoices, kept for the period required by tax law. Legal basis: legal obligation.
  • Emails (booking confirmations and correspondence) are sent through our email providers (Google Gmail – [email protected] – and Resend).

3. Recipients / processors

  • Stripe (payments) – may transfer data outside the EU under Standard Contractual Clauses.
  • Hosting: DigitalOcean, data centre in Amsterdam (Netherlands, EU).
  • Google (reCAPTCHA, Google Maps – Maps only after your consent; Gmail).
  • Resend (transactional email delivery).
  • Cloudflare Turnstile (anti-bot check on login and checkout forms).
  • Trustindex / Booking.com – reviews widget shown only after your consent.
  • Booking platforms, when you book through them: Booking.com, Airbnb, Expedia, HomeRez, Holidu, Odisseias, Smartbox. Each platform processes your data under its own privacy policy.
  • Accountant and public authorities where required by law.

Some providers are based outside the EU (e.g. USA); transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

4. Retention

Booking data and related documents: for 10 years (general legal retention period for documents). Contact-form messages: 3 years. Consent choice: 180 days.

5. Your rights

You may request access, rectification, erasure, restriction, portability and object to processing, and withdraw consent at any time, by emailing [email protected]. You also have the right to lodge a complaint with the Portuguese supervisory authority, CNPD – Comissão Nacional de Proteção de Dados (www.cnpd.pt).

6. Cookies

See our Cookie Policy.


Loading...