Controller
Ricardo da Cruz, Unipessoal Lda. (brand: venimar)
Rua Sebastião Lopes 14, 4935-233 Viana do Castelo, Portugal
Contact: Ricardo da Cruz (Managing Director)
E-mail: hello@venimar.pt
What data we process, why, and on what legal basis
- Booking and stay: name, e-mail address, telephone number, address, booking details and payment information – to carry out your booking and your stay (Art. 6(1)(b) GDPR).
- Registration of foreign guests: identity document details – accommodation providers must report foreign guests to the Portuguese authorities via the SIBA system (Law 23/2007); legal obligation (Art. 6(1)(c) GDPR).
- Invoices: name, address, tax number if provided, and the amounts of your booking – legal obligation under Portuguese tax law (Art. 6(1)(c) GDPR).
- Enquiries by contact form, e-mail or telephone: the details you give us – to answer your enquiry (Art. 6(1)(b) GDPR if it concerns a booking, otherwise our legitimate interest in answering, Art. 6(1)(f) GDPR). The contact form sends your message to us by e-mail; it is not stored on the website.
- Marketing information: only if you have expressly consented (Art. 6(1)(a) GDPR).
- Website statistics with Google Analytics 4: only if you consent in the banner (Art. 6(1)(a) GDPR).
- Operation and security of the website: technical data such as IP address, browser and time of access, which our hosting provider records in server log files (legitimate interest in a secure website, Art. 6(1)(f) GDPR).
Do you have to provide your data?
For a booking we need your name, contact details and payment information and, for the registration of foreign guests, your identity document details. Without them we cannot accept the booking. For an enquiry we need your name and e-mail address so that we can reply. Everything else is voluntary.
Recipients
We share your data only as far as necessary with the following service providers, who process it on our behalf:
- Stripe: processing of card payments (tokenised payment data)
- Hostify: property management system and booking engine
- Booqable: bicycle and equipment rental
- Goki: door locking system
- Otrum: entertainment system in the houses
- Wintouch Cloud: invoicing
- Google: e-mail (Google Workspace) and, with your consent, Google Analytics 4
- our hosting provider: operation of the website
Where the law requires it, we pass data to public authorities, e.g. guest registration (SIBA) and the Portuguese tax authority.
Transfers outside the EU
Some of these providers or their sub-processors also process data outside the European Union, in particular in the USA (e.g. Stripe and Google). Such transfers take place on the basis of an adequacy decision of the European Commission (EU-US Data Privacy Framework) or standard contractual clauses (Art. 46 GDPR).
Retention
- Booking and invoice data: 10 years, as required by Portuguese tax law (Art. 52 of the VAT Code, Art. 123 of the Corporate Income Tax Code).
- Identity document details for guest registration: only as long as the registration obligation requires.
- Enquiries that do not lead to a booking: until the enquiry has been dealt with and nothing else requires us to keep it.
- Google Analytics: at most 14 months.
- Data processed on the basis of your consent: until you withdraw it.
Security
Card details go directly from your browser to Stripe; we never see or store them. Our website is only accessible via an encrypted connection (HTTPS).
Automated decisions
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
Your rights
You have the right to:
- access the personal data we hold about you (Art. 15 GDPR)
- have incorrect data rectified (Art. 16 GDPR)
- have your data erased (Art. 17 GDPR)
- restrict processing (Art. 18 GDPR)
- receive your data in a common, machine-readable format (data portability, Art. 20 GDPR)
- object to processing based on our legitimate interest (Art. 21 GDPR)
- withdraw your consent at any time with effect for the future (Art. 7(3) GDPR)
To exercise these rights, please contact us at hello@venimar.pt. You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).
Website, cookies and analytics
Our website itself does not use advertising or social media trackers. The fonts are loaded from our own server. Your browser only stores what is technically necessary, such as your language and your cookie choice.
We only use Google Analytics 4 (Google Ireland Limited) if you agree in the banner. You can change your decision at any time via “Cookie settings” at the bottom of every page.
When you book, we transmit your booking details to our booking system Hostify; card payments are processed by Stripe, and your card details go directly to Stripe. The bike rental on our website is provided by Booqable. It is only loaded when you click to load it on the bikes page; data is then transferred to Booqable, and Booqable also loads Google Analytics and Meta (Facebook). The map on the contact page is loaded from OpenStreetMap.
Contact for data protection questions
For questions or concerns about data protection, please contact:
Ricardo da Cruz, Managing Director
Ricardo da Cruz, Unipessoal Lda.
Rua Sebastião Lopes 14, 4935-233 Viana do Castelo, Portugal
E-mail: hello@venimar.pt