Privacy & Cookie Policy
How Do Padre collects, uses, stores and protects personal data
Internal master draft for review. Remove this note before publication. Mandatory Portuguese and EU law prevails over any inconsistent wording
Do Padre values privacy and aims to handle personal data transparently, securely and only for clear and legitimate purposes. This policy applies to the website, enquiries, direct bookings and communications with guests.
1. Data Controller
Controller
Christian Adam, operating as Do Padre
Address
Largo da Igreja 7, 2350-052 Brogueira, Portugal
Telephone
+351 912 641 153
2. Personal Data We May Collect
-
Identity and contact data: name, postal address, telephone number and email address.
-
Booking data: arrival and departure dates, selected apartment, occupancy, special requests and booking correspondence.
-
Legal guest-registration data: nationality, date and place of birth, identity-document or passport details and other information required for statutory guest reporting.
-
Payment and transaction data: payment method, payment status, bank-transfer references and transaction identifiers. Do Padre does not intend to store complete payment-card details.
-
Invoice and tax data: billing address, invoice number, NIF or other tax-identification details where requested or required.
-
Communication data: messages sent through website forms, email, telephone, WhatsApp or booking platforms.
-
Technical and usage data: IP address, browser and device information, cookie identifiers, pages visited and interaction data, subject to cookie choices.
-
Complaint and incident data: information needed to investigate complaints, damage, safety matters or disputes.
3. Purposes and Legal Bases
Purpose
Responding to enquiries
Managing bookings and stays
Processing payments and refunds
Issuing invoices and keeping records
Guest reporting to authorities
Security, fraud prevention and claims
Website analytics and optional features
Occasional marketing to guests
Handling complaints
Typical data
Contact and message data
Identity, contact, booking and payment data
Transaction and payment data
Identity, billing and tax data
Identity and travel-document data
Booking, technical, incident and communication data
Contact and message data
Name, email and stay history
Contact, booking and complaint data
Legal basis
Steps requested before a contract; legitimate interests
Performance of a contract
Performance of a contract; legal obligations
Legal obligations
Legal obligations
Legitimate interests; legal claims
Consent where requiredConsent where required
Consent or the lawful existing-customer exception, with opt-out
Legal obligations; legitimate interests; legal claims
4. How We Receive Personal Data
Personal data is generally provided directly by the guest through the website, a booking form, email, telephone, WhatsApp, bank transfer or during check-in. Data may also be received from booking platforms such as Airbnb and Booking.com, travel companions who make a booking on another person’s behalf, and service providers involved in the booking or payment process.
5. Service Providers and Recipients5.
Personal data may be shared only where necessary with service providers and recipients supporting the accommodation service, including:
-
Wix and Wix Hotels for website hosting, forms and website functionality.
-
Lodgify and its integrated payment-service providers for booking, reservation and payment administration.
-
Hostkit for accommodation administration and invoicing.
-
Google services, including Google Analytics, Google Tag Manager, Google Maps and Google Fonts, where activated and subject to applicable consent requirements.
-
Airbnb, Booking.com and other booking platforms where a reservation is made through them.
-
Banks and payment providers for card payments, bank transfers, refunds and fraud prevention.
-
Accountants, tax advisers and professional advisers under duties of confidentiality.
-
Portuguese public authorities, including tax, immigration, security, consumer-protection and judicial authorities, where disclosure is legally required.
-
Insurers and legal advisers where needed to manage incidents, claims or disputes.
These providers may use approved subprocessors. They may process data only in accordance with their role, contractual obligations and applicable data-protection law.
6. Payments
Credit and debit card payments are made through the payment functionality integrated into Lodgify and the relevant connected payment-service provider. Bank transfers are processed through Do Padre’s banking provider. Do Padre receives payment status and transaction information but does not intend to receive or store complete card numbers, security codes or comparable authentication data
7. Statutory Guest Reporting
Where required by Portuguese law, Do Padre collects identification and travel-document information and transmits the required guest-registration data to the competent Portuguese authorities through the SIBA system or any successor reporting system. Only the information required for this legal purpose is processed.Where required by Portuguese law, Do Padre collects identification and travel-document information and transmits the required guest-registration data to the competent Portuguese authorities through the SIBA system or any successor reporting system. Only the information required for this legal purpose is processed.
8. International Data Transfers
Some technology providers may process or support personal data from countries outside the European Economic Area. Where this occurs, the provider and Do Padre will rely on a legally recognised transfer mechanism, such as an adequacy decision, standard contractual clauses or another safeguard permitted by the GDPR. Further information may be requested from Do Padre or obtained from the relevant provider’s privacy documentation.
9. Retention Periods
-
General enquiries: kept only for as long as reasonably necessary to answer the enquiry and manage related follow-up.
-
Booking and stay records: kept for the time necessary to perform the contract and for applicable limitation periods, including the establishment, exercise or defence of legal claims.
-
Invoices, accounting records and tax documents: kept for ten civil years after the relevant period, or longer where required by law.
-
Guest-registration data: kept only for the period required by the applicable reporting and record-keeping rules.
-
Marketing data: kept until consent is withdrawn, an objection is made or the data is no longer needed for the stated purpose.
-
Cookie choices and technical logs: kept for the period stated in the cookie settings or as reasonably necessary for security and compliance.
-
Complaint and claim records: kept while the matter is active and for applicable legal limitation periods.
10. Direct Marketing
Do Padre does not currently operate a general newsletter. Former guests may occasionally receive information about similar accommodation offers or stays at Do Padre. Such messages will be sent only where a valid legal basis exists, including consent or the lawful existing-customer exception. Guests are given a clear and free opportunity to object when their contact details are collected and in every marketing message. An objection can also be sent at any time to info@do-padre.com.
11. Cookies and Similar Technologies
The website uses cookies and similar technologies. The current cookie banner and preference centre provide the most up-to-date list of active technologies and allow visitors to accept or reject optional categories.
-
Strictly necessary cookies: required for security, navigation, booking functions, language preferences and other essential website operations.
-
Functional cookies: support enhanced features and user preferences.
-
Analytics cookies: help understand how visitors use the website, including through Google Analytics. They are activated only after consent where consent is required.
-
Third-party content and services: services such as Google Maps may receive technical data when loaded. Optional third-party content should be controlled through the consent mechanism where legally required.
Visitors can reject optional cookies without losing access to essential website content. Cookie preferences can be changed later through the cookie-settings control displayed on the website. Withdrawing consent does not affect processing that occurred lawfully before withdrawal.
12. Data Security
Do Padre applies proportionate technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No internet or electronic-storage system can be guaranteed to be completely secure. Guests should avoid sending payment-card details or highly sensitive information through ordinary email or WhatsApp.
13. Your Data-Protection Rights
Subject to the conditions and exceptions in applicable law, individuals may have the right to:
-
request access to personal data;
-
request correction of inaccurate or incomplete data;
-
request erasure or restriction of processing;
-
object to processing based on legitimate interests and to direct marketing;
-
withdraw consent at any time where processing is based on consent;
-
receive certain data in a portable format;
-
lodge a complaint with a supervisory authority.
Requests may be sent to info@do-padre.com. Do Padre may need to verify identity before acting on a request and will respond within the time required by law
14. Complaints to the Supervisory Authority
A data-protection complaint may be submitted to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt. Individuals may also contact the supervisory authority in their EU/EEA country of residence where applicable.
15. Children
Do Padre is an adults-only accommodation and does not knowingly offer stays to persons under 18. The lead guest must be at least 21 years old. If personal data relating to a minor is received inadvertently, Do Padre will take appropriate steps consistent with applicable law.
16. Changes to This Policy
This policy may be updated to reflect changes in services, technology or legal requirements. The latest version will be published on the website with its revision date.
Last updated: 3 August 2026 · Effective upon publication
