Privacy Policy – Art House Madeira

The protection of your personal data is a priority for Toada Audaz Unipessoal Lda, the company that operates the accommodation Art House Madeira.

This Privacy Policy explains who we are, how we may use your personal data, how we process it, with whom we share it, how long we keep it, and how you may contact us to exercise your rights.

1. Who We Are

Your personal data will be processed by Toada Audaz Unipessoal Lda, a company registered in Portugal with the registration number 517792613, operating the local accommodation Art House Madeira (hereinafter referred to as “Art House Madeira”).

For the purposes of the General Data Protection Regulation (GDPR), Toada Audaz Unipessoal Lda is the Data Controller, meaning it is responsible for deciding how and why your personal data is processed.

2. Why We Process Your Personal Data

Your personal data may be collected and processed for the following purposes:

a) Compliance with Legal Obligations

To comply with Portuguese legal requirements applicable to Local Accommodation (Alojamento Local) providers, including:

  • Guest reporting to the Immigration and Borders authorities (AIMA / SEF Guest Reporting System – SIBA)

  • Compliance with tax and invoicing obligations required by the Portuguese Tax Authority (Autoridade Tributária)

  • Compliance with tourism regulations applicable to short-term accommodation

b) Performance of the Accommodation Contract

To manage your stay and fulfil the accommodation agreement, including:

  • Reservation management

  • Check-in and check-out procedures

  • Guest identification and registration

  • Payment processing

  • Security deposits

  • Communication related to the stay

  • Provision of additional services such as cleaning, transfers, or other guest services

  • Handling requests or pre-booking enquiries

c) Communication and Customer Service

To communicate with guests via email, phone or messaging platforms regarding:

  • Reservation details

  • Guest support and assistance during the stay

  • Important information related to the accommodation

  • Follow-up communication after the stay

Where required by law, marketing communications will only be sent based on your explicit consent.

d) Legitimate Business Interests

To protect the property and improve our services, including:

  • Property security

  • Fraud prevention

  • Internal statistics and service improvement

Failure to provide personal data required for purposes (a) and (b) may prevent us from fulfilling legal obligations or providing accommodation services.

3. What Personal Data We Collect

Within the scope of our activity as a Local Accommodation provider, we may collect and process the following categories of personal data:

  • Identification data (name, nationality, date of birth, ID or passport number)

  • Contact information (email address, telephone number)

  • Address information

  • Payment or billing details

  • Reservation and stay information

  • Information required for legal reporting to Portuguese authorities

Only the data strictly necessary to provide the accommodation service or comply with legal obligations will be collected.

4. Legal Basis for Processing

Your personal data is processed based on the following legal grounds under Article 6 of the GDPR:

  • Contract performance – processing necessary to provide accommodation services (Art. 6(1)(b))

  • Legal obligations – compliance with Portuguese legislation regarding guest registration and taxation (Art. 6(1)(c))

  • Consent – for optional communications such as marketing where applicable (Art. 6(1)(a))

  • Legitimate interests – ensuring property security and improving services (Art. 6(1)(f))

5. How Long We Keep Your Data

Your personal data will only be retained for the period necessary to fulfil the purposes for which it was collected, including:

  • Legal retention periods required under Portuguese tax and tourism legislation

  • Mandatory retention periods related to guest reporting obligations

Once the legal retention period has expired, the data will be securely deleted or anonymised.

6. Who We May Share Your Personal Data With

Your personal data may be shared with the following entities when necessary:

Public Authorities

When legally required, including:

  • AIMA / SEF (Portuguese immigration authorities) through the guest reporting system

  • Autoridade Tributária (Portuguese Tax Authority) for invoicing and fiscal compliance

Service Providers (Subcontractors)

Trusted third parties who provide services necessary for the operation of the accommodation, such as:

  • Booking platform providers

  • Website hosting providers

  • Payment processing services

  • Accounting firms

  • Legal advisors

  • Cleaning or property management services

  • IT service providers

All service providers are contractually required to process personal data only for the agreed purposes and in accordance with GDPR requirements.

Competent Authorities

Where disclosure is required by law, court order, or regulatory authorities.

7. International Data Transfers

Your personal data is generally processed within the European Union.

In exceptional cases, certain technical service providers (such as booking platforms or cloud hosting providers) may process data outside the EU. In such cases, transfers will only occur where adequate data protection safeguards exist, in accordance with the GDPR.

8. Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

  • Access your personal data

  • Request correction of inaccurate or incomplete data

  • Request deletion of your data where legally applicable

  • Request restriction of processing

  • Object to certain types of processing

  • Request data portability

Where processing is based on consent, you may withdraw your consent at any time without affecting the legality of processing carried out before withdrawal.

If you believe your rights have been violated, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD – Comissão Nacional de Proteção de Dados).

9. Data Security and Confidentiality

We implement appropriate technical and organisational security measures to protect your personal data from loss, misuse, unauthorised access, disclosure, or alteration.

Although we take all reasonable precautions, data transmission over the internet cannot be guaranteed to be completely secure.

We are committed to maintaining the confidentiality of your personal data and will never sell or commercially distribute your information to third parties.

10. Contact Information

If you have any questions regarding this Privacy Policy or wish to exercise any of your rights, please contact us:

Email: art.house.madeira@gmail.com

Address:
Rua Velha da Ajuda 129, 6A
9000-749 Funchal
Madeira – Portugal

11. Updates to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect legal or operational changes. We recommend reviewing this document periodically to stay informed about how your personal data is protected.