Privacidade / Privacy
Information provided under Articles 13 and 14 of Regulation (EU) 2016/679 concerning the processing of personal data by Rusticbison Investments Lda.
1.1 Rusticbison Investments Lda, a sociedade por quotas incorporated under the laws of Portugal under NIPC 517975009, with registered office at Rua Praia do Salgado RC, Serra dos Mangues, 2460-697 São Martinho do Porto, Portugal (the Company), is the controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the GDPR) in respect of the processing described in this notice.
1.2 This notice is given pursuant to Articles 13 and 14 of the GDPR and to Lei n.º 58/2019, de 8 de agosto.
1.3 The scope of this notice is confined to the website published at villasdosalgado.com (the Site) and to correspondence addressed to the Company. Processing carried out in connection with reservations, occupancy and departure falls outside that scope and is addressed at clause 6.
1.4 The Company is not obliged to designate a data protection officer under Article 37 of the GDPR and has not done so. Correspondence under this notice may be addressed to [email protected].
2.1 The Company carries out the processing set out in the following table and no other processing in connection with the Site.
| Purpose | Categories | Basis | Retention |
|---|---|---|---|
| Delivery and security of the Site | IP address, request time, resource requested, response status, user agent | Art. 6(1)(f) | Determined by the processors at clause 3 |
| Correspondence | Name, email address, contents of the message | Art. 6(1)(f) | 24 months from last contact |
| Display of the embedded map | IP address, existing Google cookies | Art. 6(1)(a) | Not retained by the Company |
2.2 The legitimate interests relied upon under Article 6(1)(f) are, respectively, the secure operation of the Site and the conduct of correspondence with persons who have addressed the Company.
2.3 No automated decision-making within the meaning of Article 22 of the GDPR is carried out, and no profiling of any kind is undertaken.
3.1 The Site is published by means of GitLab Pages and delivered through Cloudflare. Each records connection data, including IP addresses, for the purposes of delivering the Site and protecting its own network infrastructure.
3.2 Such records are held on the systems of those parties. The Company has no access to them and is accordingly unable to retrieve, interrogate, export or erase them, and receives no report derived from them. Retention is determined by those parties under their respective privacy statements.
3.3 Save as stated in this clause and at clause 4, no personal data collected through the Site is disclosed to any third party. The Company does not sell personal data and does not transfer it for the purposes of direct marketing.
4.1 The Site sets no cookies and employs no local storage, analytics, tracking pixels, advertising technology or social media embeds. All resources, including typefaces, are served from the Site’s own origin.
4.2 The location map is supplied by Google and is not requested until the visitor activates it. Activation transmits the visitor’s IP address, together with any Google cookies already present on the device, to Google. The consent so given may be withheld by declining to activate the map, in which case no request is made and no data is transmitted. The postal address and coordinates of the property are printed on the page in any event.
5.1 The parties identified at clause 3.1 process connection data in the United States and in other jurisdictions outside the European Economic Area. Such transfers are made under the safeguards those parties maintain for that purpose, including their respective data processing agreements and standard contractual clauses adopted under Article 46(2)(c) of the GDPR.
5.2 Activation of the map under clause 4.2 constitutes a transfer to Google on the basis of the visitor’s consent.
6.1 The villas are marketed and operated by an independent property management company (the Operator), which contracts with guests in its own name, publishes the listings on booking platforms in its own name, and conducts arrival, occupancy and departure.
6.2 The Operator determines the purposes and means of the processing of guest personal data and is the controller in respect of it. The Company is not a controller or a joint controller of that processing, receives no guest personal data from the Operator, and gives no instruction in respect of it. The Operator’s own privacy notice governs and will be furnished by it.
6.3 For the avoidance of doubt, the collection of identity documents from foreign guests and their communication through the SIBA system within three working days of arrival, required by Articles 15 and 16 of Lei n.º 23/2007, de 4 de julho, is an obligation of the operator of the establishment and is discharged by the Operator. Booking platforms neither make that communication nor are capable of making it on the operator’s behalf.
6.4 A booking platform through which a reservation is made is a controller in its own right in respect of the visitor’s account with it, on its own terms.
7.1 Subject to the conditions and exceptions in Chapter III of the GDPR, a data subject has the right to obtain confirmation as to whether personal data concerning them is processed and access to that data (Art. 15); to obtain rectification (Art. 16); to obtain erasure (Art. 17); to obtain restriction of processing (Art. 18); to receive the data in a structured, commonly used and machine-readable format (Art. 20); and to object to processing carried out under Article 6(1)(f) (Art. 21).
7.2 Where processing rests on consent, that consent may be withdrawn at any time under Article 7(3), without affecting the lawfulness of processing carried out before withdrawal.
7.3 A request under clause 7.1 shall be answered within one month of receipt, extensible by two further months under Article 12(3) where necessary by reason of complexity or number of requests, and notice of any such extension shall be given within the first month.
7.4 A request should be directed to the party holding the data. Requests concerning the Site or correspondence with the Company should be addressed to the Company. Requests concerning a reservation, an occupancy or identity documents should be addressed to the Operator, and requests concerning an account with a booking platform to that platform. Where the Company receives a request in respect of data it does not hold, it shall inform the data subject accordingly without undue delay.
8.1 A data subject may lodge a complaint with the supervisory authority under Article 77 of the GDPR. The competent authority in Portugal is the Comissão Nacional de Proteção de Dados, to which complaints may be submitted at cnpd.pt/cidadaos/participacoes.
8.2 The exercise of that right is without prejudice to any judicial remedy under Articles 78 and 79 of the GDPR.
9.1 This notice may be amended from time to time. The revision number and date appear below, and the version in force is that published on the Site.
Rev. 4.0 · 28 August 2026 · Rusticbison Investments Lda