Draft for review
This notice is a draft awaiting review. The legal entity details and the controller scope marked below must be confirmed before it is treated as final. Everything else describes what the site actually does, and was written from the code rather than from a template.
Who is responsible for your data
This is the booking site of Starbase18, a guesthouse in Meios, Guarda, in the Serra da Estrela, Portugal, operated as part of the Hospedes network.
[To confirm: controller scope.] Two shapes are possible and they are not the same thing legally:
- This hotel alone is the controller for bookings made here; the network holds only the consent record and the anonymous measurement.
- Hospedes.pt and its partner hotels are separate controllers for their own bookings, and this site is operated within that network.
The wording above assumes the second, because that is what the product is. The data below is handled the same way under either reading; what changes is who is named as responsible.
[To confirm: registered name, address and contact of the controller.]
What we collect, and why
To take your booking. Your name, email, telephone number, the dates and apartments you chose, the party size, and your payment details. Payments are handled by Stripe; card details never reach this site. We need this to perform the contract with you, and we keep it because tax and accounting rules require it.
To understand how the site is used — only if you allow it. Anonymous measurement of the booking journey: which page was viewed, which dates were selected, which apartment was chosen, where people stopped. It is described below, because it is the part you are being asked about.
To keep in touch — only if you allow it. Occasional messages about this house, and seasonal offers from the network. This is the purpose the consent bar asks about separately, and you can say yes to measurement and no to messages.
We do not sell anything, we do not share data for anyone else's advertising, and we do not profile you to set different prices.
The measurement, in detail
When you allow measurement, the site records journey events against a random identifier created for your visit. In particular:
- The identifier lives in your browser's session storage, so it disappears when you close the tab. It is not a cookie and it does not identify you or your device on a return visit.
- We do not store your IP address or your browser's user-agent.
- Anything after a
?in a web address is stripped before storing, so a booking reference or an email address cannot ride along by accident. - Nothing is stored at all until you make a choice. If you decline, no measurement happens — the engine refuses it — and you can carry on booking normally.
Your choice, and how to change it
Every decision is recorded with its date, and the record is kept as a history rather than overwritten: if you withdraw a permission, the fact that you once gave it stays on file, and so does the withdrawal. The record contains the identifier, the purpose, whether you allowed it, and which version of this notice you were shown. It contains nothing that identifies you.
To change your mind, clear this site's data in your browser and choose again, or write to us using the contact details below.
Who else is involved
- Stripe processes payments, as an independent controller for payment data.
- The consent record is held centrally for the network rather than only on this hotel's own systems, because a single hotel asking for marketing permission at every booking would lose most of its bookings — permission is asked once, here, and honoured across the network.
- [To confirm: hosting and email providers, and their locations.]
How long we keep things
- Booking and invoice records: [to confirm — typically 10 years for Portuguese tax purposes].
- Anonymous measurement: [to confirm — 14 months suggested], after which the events are deleted or reduced to counts.
- Consent records: for as long as the permission is in force, plus the period needed to demonstrate that we had it.
Your rights
You can ask for a copy of your data, have it corrected, have it deleted, object to processing, or ask for it in a portable format. Where we rely on your permission, you can withdraw it at any time, and withdrawing it does not affect anything done before. Write to us at the contact below. If you are not satisfied, you can complain to the Portuguese supervisory authority, the CNPD (cnpd.pt).
Contact
[To confirm: the email address and postal address for privacy requests.]
Changes to this notice
When this notice changes materially, its version changes with it, and the consent bar asks again. The version you were shown is recorded alongside your decision.
