Last updated: 23 October 2026
This policy explains how Casa Azul Sagres collects, uses and protects your personal data when you visit casaazulsagres.com, make a booking or contact us. It complies with the EU General Data Protection Regulation (GDPR) and Portuguese Law no. 58/2019.
1. Who is responsible for your data
The data controller is GROOVYSEASON – TURISMO LDA, trading as Casa Azul Sagres, a bed and breakfast in Sagres, Algarve, Portugal.
- Registered address: Rua D. Sebastião, 8650-341 Sagres, Portugal
- VAT number (NIF): PT510945848
- Email for privacy requests: info@casaazulsagres.com
- Telephone: +351 282 624 856
2. What we collect, why, and on what legal basis
We collect only the data needed for each purpose.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Bookings and stay | Name, email, telephone, dates, number of guests, special requests, payment details (handled by the payment provider) | Performance of a contract (Art. 6(1)(b)) |
| Guest registration | Name, nationality, date of birth, identity document number, dates of stay | Legal obligation (Art. 6(1)(c)) |
| Invoicing and accounting | Name, address, tax number, amounts paid | Legal obligation (Art. 6(1)(c)) |
| Enquiries by form, email or telephone | Name, contact details, message | Legitimate interest (Art. 6(1)(f)) |
| Newsletter and offers | Email, name | Consent (Art. 6(1)(a)) |
| Website statistics and cookies | IP address, device, pages visited | Consent (Art. 6(1)(a)) |
| Complaints and legal claims | Case details | Legitimate interest (Art. 6(1)(f)) |
We do not collect special categories of data (such as health or religion) unless you tell us, for example a dietary restriction or an accessibility need. We use it only to look after you during your stay.
Our services are not intended for children under 16. Bookings must be made by a parent or legal guardian.
3. Who we share data with
We do not sell your data. We share it only with providers and authorities that need it, under a written contract wherever the law requires one.
- Booking and property management systems: the property management system, the channel manager and the online booking engine.
- Online booking platforms: if you book through a third-party platform, that platform is also a controller of your data.
- Payment providers: to process payments and prevent fraud.
- Email and web hosting providers: website hosting, email delivery and analytics tools.
- Accountants and legal advisers: for tax and legal compliance.
- Public authorities: AIMA receives guest registration data, as required by law. The Tax Authority and other bodies may request data where the law allows.
Some providers are based outside the European Economic Area. In those cases we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses.
4. How long we keep data
| Data | Retention |
|---|---|
| Invoices and accounting records | 10 years, under Portuguese tax law |
| Booking records | Length of stay plus the legal limitation period for claims |
| Guest registration data | As required by law |
| Enquiries | Up to 12 months after the last contact |
| Newsletter | Until you unsubscribe |
| Cookie data | See section 5 |
When the period ends, we delete or anonymise the data.
5. Cookies
Cookies are small files stored on your device. Strictly necessary cookies keep the website and booking engine working and do not require consent. Analytics and marketing cookies are only switched on after you accept them in the cookie banner (CookieYes). We manage these tags with Google Tag Manager.
| Category | Purpose | Consent |
|---|---|---|
| Strictly necessary | Website operation, security, booking session | No |
| Analytics | Understanding how visitors use the website | Yes |
| Marketing | Measuring and personalising advertising | Yes |
You can withdraw or change your choice at any time via the cookie settings link in the footer or in your browser settings. Withdrawing consent does not affect processing already carried out.
6. How we protect data
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), access limited to staff who need the data, password controls and regular software updates. Card details are handled by the payment provider and are not stored on our systems.
If a data breach puts your rights at risk, we notify the Portuguese data protection authority (CNPD) within 72 hours and, where the law requires, you as well.
7. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you;
- rectify inaccurate data;
- erase your data, where no legal obligation requires us to keep it;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time, for example via the unsubscribe link in any email.
To exercise a right, write to info@casaazulsagres.com. We reply within one month. We may ask you to confirm your identity.
8. Complaints
If you believe we have processed your data unlawfully, please contact us first. You may also lodge a complaint with the Portuguese data protection authority, CNPD (www.cnpd.pt), or with the supervisory authority in your EU country.
As a consumer, you may also use the Portuguese online Complaints Book (www.livroreclamacoes.pt), where we are registered, or the alternative dispute resolution body CIMAAL (www.consumidoronline.pt, apoio@consumidoronline.pt, +351 289 823 135).
9. Changes to this policy
We update this policy when our practices or the law change. The date at the top shows the latest version.