Privacy Policy

This policy describes how Porto Smart Apartments collects, uses and protects the personal data of the users of this website and of its guests, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable national law.

1. Data controller The controller of the personal data is:

Ana Luísa Alves de Magalhães Ferreira Unipessoal, Lda,

NIPC 516550845

E-mail: reservas@portosmartapartments.com Telephone: +351 919 109 904 (call charged at the national mobile network rate)

For any question relating to the processing of your personal data, you may contact us using the details above.

2. What data we collect We collect only the data needed to respond to enquiries and provide the accommodation service:

Contact and enquiry data, provided through the website form: name, e-mail address, telephone number, preferred dates, number of guests, accommodation of interest and the content of the message.

Booking and stay data, once a booking is confirmed: identification data required by law for the registration of guests with the competent authorities (SEF/AIMA), under the legislation applicable to local accommodation. Browsing data, collected automatically through cookies and similar technologies (see section 7), such as IP address, device type and pages visited.

We do not collect, through this website, data falling within special categories of personal data (for example, health data).

3. Purposes and legal basis for processing

Purpose / Legal basis

  • We respond to enquiries and availability requests sent via the form on the basis of pre-contractual steps taken at the data subject’s request (Art. 6(1)(b) GDPR).
  • We manage bookings and provide the accommodation service on the basis of the performance of a contract (Art. 6(1)(b) GDPR).
  • We comply with legal obligations, including guest registration and invoicing, on the basis of compliance with a legal obligation (Art. 6(1)(c) GDPR).
  • We ensure the operation and security of the website on the basis of legitimate interest (Art. 6(1)(f) GDPR).
  • We send informational or promotional communications, where applicable, on the basis of the data subject’s consent (Art. 6(1)(a) GDPR).

4. Retention period

We retain personal data only for as long as necessary for the purposes for which it was collected: Enquiries without a booking: data is kept for a maximum of [indicate period, e.g. 12 months] after the last contact, and then deleted. Booking and invoicing data: kept for the applicable legal periods, in particular for tax and guest-registration purposes. Browsing data: kept in accordance with the periods indicated in the cookie policy.

5. Sharing data with third parties

We do not sell or transfer your personal data to third parties for commercial purposes.

Data may be shared only with: Service providers (processors) acting on behalf of the controller, such as the website hosting provider, the e-mail service and any booking-management tools — [indicate the providers actually used]. Public authorities, where there is a legal obligation to report, in particular the registration of guests with SEF/AIMA and obligations towards the Tax Authority.

All processors are bound by confidentiality and data-protection obligations.

6. International data transfers

Whenever a service provider processes data outside the European Economic Area, we ensure that such transfer is carried out with adequate safeguards, in accordance with the GDPR (for example, an adequacy decision or standard contractual clauses approved by the European Commission). 

7. Cookies

This website uses cookies to ensure its operation and to improve the browsing experience. You can manage or disable cookies in your browser settings. 

8. Rights of the data subject

Under the GDPR, you have the right to:

  • Access your personal data; Request the rectification of inaccurate or incomplete data;
  • Request the erasure of data, where applicable;
  • Request the restriction of processing;
  • Object to processing;
  • Request data portability;
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent previously given. 

To exercise any of these rights, simply contact us using the e-mail address indicated in section 1. We will respond to your request within the periods provided by law.

9. Complaints

If you consider that the processing of your personal data does not comply with applicable law, you have the right to lodge a complaint with the competent supervisory authority: Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt

10. Data security

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or improper disclosure.

11. Changes to this policy

This privacy policy may be updated whenever necessary. The version in force is the one published on this page, with the date of the last update indicated. Last updated: 18 August 2026