Estalagem Sequeira
← Back to homepage

Privacy Policy

Last updated: 2026-02-18

Data Controller

The data controller is Estalagem Sequeira, operated by L&L Sequeira, Lda, with registered office at Rua Dr. Evaristo Sousa Gago N.9, 8150-139 São Brás de Alportel, Portugal. This policy describes how we collect, use and protect the personal data of our guests and users of this website, in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and Portuguese Law No. 58/2019.

Data Collected

During your stay, we collect the following personal data:

Mandatory (required by law for INE and AIMA reporting):

  • Full name
  • Date of birth
  • Nationality
  • Country of residence
  • Identification document (number and issuing country)

Optional:

  • Phone number and email (recommended for communication about your reservation)
  • Tax identification number / NIF (only required if you request an invoice with NIF)

Without the mandatory data above, we cannot complete your check-in as required by Portuguese law.

When you visit this website, we may collect:

  • Technical data (IP address, browser type, pages visited) via server logs
  • A language preference cookie to remember your chosen language

Purpose and Legal Basis

Your personal data is processed for the following purposes, each with a specific legal basis under Article 6(1) of the GDPR:

  • Guest registration and reporting to INE/AIMA — Legal obligation (Art. 6(1)(c))
  • Booking and stay management — Performance of contract (Art. 6(1)(b))
  • Communication regarding your reservation — Performance of contract (Art. 6(1)(b))
  • Invoice issuance — Legal obligation (Art. 6(1)(c))
  • Optional contact data (phone/email when not booking) — Consent (Art. 6(1)(a))
  • Video surveillance (CCTV) for security — Legitimate interest (Art. 6(1)(f)): protecting the safety of guests, staff and property
  • Website server logs for security and operation — Legitimate interest (Art. 6(1)(f)): ensuring the security and proper functioning of our website

Data Recipients

Your personal data may be shared with the following recipients:

  • INE — National Statistics Institute (tourism statistics, as required by law)
  • AIMA — Agency for Integration, Migration and Asylum (foreign citizen registration, as required by law)
  • Portuguese Tax Authority — when invoices with NIF are issued
  • Room Raccoon — our booking management platform, acting as a data processor on our behalf under a Data Processing Agreement (Art. 28 GDPR)
  • Vercel Inc. — our website hosting provider, which may process server log data (including IP addresses) on our behalf as a data processor

We do not sell, rent or share your personal data for marketing purposes.

International Data Transfers

Some of our service providers (such as our hosting platform and booking engine) may process data outside the European Economic Area (EEA). In such cases, transfers are protected by appropriate safeguards, including EU Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission, in accordance with Chapter V of the GDPR.

Video Surveillance (CCTV)

To ensure the safety of our guests, staff and property:

  • Exterior cameras cover the perimeter and entrances
  • Interior cameras are limited to the reception lobby and access hallways
  • There are no cameras in guest rooms, private areas or bathrooms
  • Footage is stored for a maximum period of 30 days and then automatically deleted
  • The legal basis for CCTV processing is legitimate interest (Art. 6(1)(f) GDPR)

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss or alteration, in accordance with Article 32 of the GDPR. These measures include encrypted connections (HTTPS) for all website traffic, restricted access controls to personal data, secure storage of guest records, and regular review of our security practices.

Cookies

This website uses only essential cookies necessary for its functioning:

  • A language preference cookie to remember your selected language across pages

We do not use advertising cookies, tracking cookies, or third-party analytics tools. No cookie consent banner is required as we only use strictly necessary cookies exempt under the ePrivacy Directive.

Data Retention

We retain your personal data only for as long as necessary:

  • Guest registration data (INE/AIMA): retained for the period required by Portuguese law
  • Booking and invoice records: retained for 10 years in accordance with Portuguese fiscal obligations
  • CCTV footage: automatically deleted after 30 days
  • Website server logs: retained for a maximum of 90 days
  • Language preference cookie: expires at the end of your browser session

Your Rights

Under the GDPR, you have the following rights:

  • Right of access — request a copy of your personal data
  • Right to rectification — request correction of inaccurate data
  • Right to erasure — request deletion of your data (where not overridden by legal obligations)
  • Right to restrict processing — request limitation of how your data is processed
  • Right to data portability — receive your data in a structured, machine-readable format
  • Right to object — object to processing based on legitimate interest
  • Right to withdraw consent — for optional data provided on the basis of consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us using the details below. We will respond within 30 days of receiving your request.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD): www.cnpd.pt

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on guests.

Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. The updated version will be published on this page with a revised date. We encourage you to review this policy periodically.

Contact

To exercise your rights or clarify any questions about data protection, contact us:

© 2026 L&L Sequeira, Lda. All rights reserved.