Privacy Policy

1. Who is responsible

The controller of your personal data is the operator of Casa Pavão, Sintra, Portugal. Full operator details are listed on our Legal Notice page.

For any question about this policy or your data, write to hello@casapavao.com.

2. What we collect, and why

Stay enquiries

When you use the enquiry form on this site, we collect the information you type into it: your name, your email address, an optional phone number, the type of gathering, your approximate dates and group size, and the message you write. We use it for one purpose only — to read your enquiry and reply to it, and to discuss and arrange a possible stay.

Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract. Where no booking follows, we rely on our legitimate interest in answering people who contact us, Article 6(1)(f) GDPR.

Providing this information is voluntary, but without a name and email address we cannot reply to you.

Email and other direct contact

If you email or message us directly, we process the contents of that correspondence for as long as needed to handle your request.

Server logs

Our hosting provider records technical information when a page is requested — IP address, time, requested page, browser type. These logs exist to keep the site running and secure and are not used to profile visitors. Legal basis: Article 6(1)(f) GDPR.

3. Cookies and local storage

This website does not use advertising cookies, analytics cookies, or any tracking technology that follows you across other websites. We do not run Google Analytics, ad pixels, or similar tools.

The site stores one item in your browser's local storage: your chosen language (English, German or Portuguese), so the site remembers it on your next visit. This is strictly necessary for a function you asked for and therefore does not require consent. You can clear it at any time through your browser settings.

If we ever add analytics or marketing tools, we will ask for your consent first and update this page.

4. Who your data is shared with

We do not sell personal data. We share it only with the following processors:

• Hosting and database provider — the managed cloud platform that runs this website and stores submitted enquiries, on servers within the EU where available.
• Email provider — used to notify our team of a new enquiry and to reply to you.
• Google Fonts — typefaces on this site are loaded from Google's servers (fonts.googleapis.com, fonts.gstatic.com). This means your IP address and browser information are transmitted to Google LLC, which may involve a transfer to the United States under the EU–US Data Privacy Framework. Legal basis: Article 6(1)(f) GDPR, our interest in presenting the site consistently. You can prevent this by blocking third-party requests in your browser; the site remains usable.

Links to Instagram and other external services open on those providers' own websites, where their privacy policies apply. We have no control over what they collect once you leave this site.

5. How long we keep it

Enquiries are kept while we are in conversation with you and for up to 24 months afterwards, so we can pick up a conversation you may resume. Where a booking takes place, records connected to it are kept for as long as Portuguese tax and commercial law requires. Server logs are kept for a short technical retention period by our hosting provider. You can ask us to delete your enquiry sooner at any time.

6. Your rights

Under the GDPR you have the right to:

• ask what personal data we hold about you and receive a copy (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data deleted (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interest, including at any time (Art. 21)
• withdraw consent where processing is based on it, without affecting past use

Write to hello@casapavao.com to exercise any of these. We will respond within one month.

You also have the right to complain to a supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. Visitors elsewhere in the EU may also contact their local authority — in Germany, the data protection authority of their federal state.

7. Security

The site is served over HTTPS and enquiry data is stored in an access-controlled database. No transmission over the internet can be guaranteed completely secure, but we take reasonable technical and organisational measures to protect what you send us.

8. Children

This site is not directed at children and we do not knowingly collect data from anyone under 16.

9. Changes to this policy

We may update this page as the site changes. The date at the top always shows the current version.