Personal Data Protection Policy
Casa de Cardigos values the privacy of its guests, clients, website visitors and other contacts. This Personal Data Protection Policy explains how we collect, use, store and protect the personal data provided through our website, contact channels and in the context of our local accommodation services.
The processing of personal data is carried out in accordance with the General Data Protection Regulation, Regulation (EU) 2016/679, and the applicable Portuguese legislation on personal data protection.
1. Data Controller
The entity responsible for the processing of personal data is:
Janelas Fidalgas, Lda.
Tax Identification Number: 516018760
Address: Estrada de Cardigos 244-1, No. 168
E-mail: [email protected]
Website: www.casadecardigos.pt
For any matter related to the processing of personal data, the e-mail address indicated above may be used.
2. Personal data collected
Within the scope of the use of the website and the provision of our services, the following personal data may be collected:
Identification and contact details: name, e-mail address, telephone number and other data voluntarily provided through contact forms, booking requests or direct communications.
Booking and stay-related data: requested or confirmed stay dates, number of guests, accommodation type, preferences communicated by the guest, special requests and other information necessary for managing the booking.
Billing and payment data: name, tax identification number, address, proof of payment or other data required for the issuing of accounting documents and compliance with legal obligations.
Data required to comply with legal obligations: information required by law within the scope of local accommodation activity, whenever applicable.
Technical browsing data: IP address, type of device, browser used, pages visited, date and time of access, browsing preferences and data collected through cookies or similar technologies, as described in this policy and, where applicable, in the Cookie Policy.
3. Purposes of data processing
The personal data collected is processed for the following purposes:
To respond to information requests submitted through the website, by e-mail, telephone or other contact channels.
To manage booking requests, pre-bookings, stay confirmations, changes and cancellations.
To provide local accommodation services and ensure the necessary communication before, during and after the stay.
To comply with legal, tax, accounting and administrative obligations applicable to Casa de Cardigos.
To issue invoices, receipts and other legally required documents.
To send communications related to bookings, stays, information requests or contracted services.
To improve the functioning of the website, the browsing experience and the quality of our services.
To ensure the security of the website, IT systems and communications.
To send promotional or informational communications, only where prior consent has been given or where another applicable legal basis exists.
4. Legal basis for processing
The processing of personal data is carried out on the following legal bases:
Performance of a contract or pre-contractual steps: when the data is necessary to respond to booking requests, confirm stays or provide the requested services.
Compliance with legal obligations: when processing is necessary to comply with tax, accounting, administrative or other applicable legal requirements.
Consent: when free, specific, informed and unambiguous consent has been given, for example to receive promotional communications or for the use of certain non-essential cookies.
Legitimate interest: when processing is necessary to ensure website security, respond to contacts, improve services or protect the legitimate rights and interests of Casa de Cardigos, provided that the fundamental rights and freedoms of the data subjects do not prevail.
5. Retention of personal data
Personal data will be kept only for the period necessary to fulfil the purposes for which it was collected, without prejudice to any applicable legal retention periods.
Data related to bookings and stays will be kept for the period necessary to manage the relationship with the guest and to comply with legal obligations.
Billing and accounting documentation data will be kept for the legally required period.
Data processed on the basis of consent will be kept until consent is withdrawn, unless another legal basis justifies its retention.
Data related to information requests may be kept for the period necessary to follow up on the request and manage future contacts related to the same matter.
6. Sharing of data with third parties
Casa de Cardigos may share personal data with third parties only when necessary for the provision of services, compliance with legal obligations or the operation of its activity.
The following entities may have access to personal data, strictly to the extent necessary:
Technology service providers, website hosting providers, IT maintenance providers, e-mail management providers or digital tools.
Booking platforms, when the booking is made through external channels.
Entities responsible for accounting, billing or administrative support services.
Public, tax, administrative or judicial authorities, whenever legally required.
Payment service providers, where applicable.
Casa de Cardigos seeks to ensure that third parties processing personal data on its behalf adopt appropriate security, confidentiality and data protection measures, in accordance with applicable legislation.
7. International data transfers
As a rule, personal data is processed within the European Economic Area.
If it becomes necessary to use service providers that process personal data outside the European Economic Area, Casa de Cardigos will ensure that such transfers are carried out with appropriate safeguards, in accordance with the applicable data protection legislation.
8. Rights of data subjects
Under the applicable legislation, data subjects may exercise the following rights:
Right of access to their personal data.
Right to rectification of inaccurate or incomplete data.
Right to erasure of data, where applicable.
Right to restriction of processing.
Right to object to processing.
Right to data portability, where applicable.
Right to withdraw consent, whenever processing is based on consent.
Right to lodge a complaint with the Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados.
These rights may be exercised by sending a written request to: [email protected].
Casa de Cardigos may request additional information to confirm the identity of the data subject before processing the request.
9. Promotional communications
Casa de Cardigos will only send promotional communications, newsletters or direct marketing campaigns when prior consent has been given for this purpose, or when permitted by applicable legislation.
The data subject may withdraw consent at any time through the mechanism indicated in each communication or by contacting: [email protected].
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of previously given consent.
10. Cookies and similar technologies
The Casa de Cardigos website may use cookies or similar technologies to ensure the proper functioning of the website, improve the browsing experience, analyse website usage and, where applicable, support communication or digital marketing activities.
Cookies that are strictly necessary for the functioning of the website may be used without prior consent, when they are essential to provide the service requested by the user.
Analytics, preference or marketing cookies will only be used when the user has given prior, free and informed consent, whenever legally required.
The user may manage or withdraw consent through the cookie settings available on the website or through the browser settings.
If the website uses tools such as Google Analytics, Meta Pixel, external booking systems, embedded maps or other third-party services, such use must be duly identified in the Cookie Policy or in the website’s consent banner.
11. Security of personal data
Casa de Cardigos adopts appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, disclosure or destruction.
Despite the measures adopted, no data transmission or storage system is completely secure. For this reason, users are also advised to follow good security practices, namely by avoiding the sending of sensitive information through unprotected channels.
12. Data relating to minors
Casa de Cardigos services may be used by families with children, but the website and contact forms are not intended for the direct collection of personal data from minors.
If data relating to minors is provided within the scope of a booking or stay, such data must be communicated by the respective holders of parental responsibility or by a person authorised for this purpose, and will only be processed to the extent necessary for the management of the booking, stay or compliance with legal obligations.
13. Links to third-party websites
The Casa de Cardigos website may contain links to third-party websites, platforms or services, including booking platforms, social networks, maps, payment services or other partners.
Casa de Cardigos is not responsible for the privacy policies, data processing practices or content of such external websites or platforms. Users are advised to read the respective privacy policies before using these services.
14. Changes to this policy
Casa de Cardigos may update this Personal Data Protection Policy whenever necessary, namely in the event of legal, technical or operational changes, or changes to the services provided.
The most recent version will always be available on the website.
Last updated: April 2026
15. Contacts
For any question related to this Personal Data Protection Policy or to the processing of personal data, please contact:
Casa de Cardigos
Controller: Janelas Fidalgas, Lda.
Tax Identification Number: 516018760
E-mail: [email protected]
Address: Estrada de Cardigos 244-1, No. 168
Website: www.casadecardigos.pt
If you consider that the processing of your personal data violates applicable legislation, you may lodge a complaint with the Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados.