Privacy Policy

Data Controller

The data controller responsible for your personal data is:

What Personal Data We Collect

We collect personal data that is necessary to provide our accommodation services, comply with legal obligations, and improve your experience.

Data You Provide Directly

• Identity data: full name, date of birth, nationality, passport or identity card number
• Contact data: email address, telephone number, postal address
• Booking data: check-in and check-out dates, room preferences, number of guests, special requests
• Payment data: credit or debit card details, billing address (processed securely via our booking engine provider)
• Communication data: correspondence with us by email, telephone, or other means
• Marketing preferences: consent choices for newsletters and promotional communications

Data Collected Automatically

• Technical data: IP address, browser type and version, operating system, device identifiers
• Usage data: pages visited, time spent on pages, referral source
• Cookie data: information collected through cookies and similar technologies (see our Cookie Policy)

Data Collected From Third Parties

• Booking platforms: if you book through a third-party platform such as Booking.com or Expedia, we receive the booking details and contact information you provided to that platform

Why We Process Your Data (Legal Bases)

We process your personal data only when we have a lawful basis to do so under Article 6 of the GDPR:

Guest Registration (SIBA/AIMA)

Under Portuguese law (Decreto-Lei 71/2019 and related regulations), all accommodation providers must register guests with AIMA (Agência para a Integração, Migrações e Asilo), the Portuguese immigration authority.

We are required to collect and transmit the following data for all foreign national guests via the SIBA (Sistema de Informação de Boletins de Alojamento) platform:

• Full name
• Date of birth
• Nationality
• Passport or identity card number and issuing country
• Country of residence
• Dates of stay

This data must be transmitted within 3 working days of check-in. We have no discretion over this requirement. The legal basis is compliance with a legal obligation (GDPR Art. 6(1)(c)).

Who We Share Your Data With

We share your personal data only where necessary and with appropriate safeguards.

Service Providers (Data Processors)

Authorities

• AIMA (via SIBA): guest registration data for foreign nationals (legal obligation)
• Autoridade Tributária e Aduaneira: tax and accounting data as required by Portuguese fiscal law
• Law enforcement or judicial authorities: when required by law or court order

We do not sell your personal data to third parties.

International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA), specifically in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) approved by the European Commission and the EU-US Data Privacy Framework, where the recipient is certified.

You may request a copy of the safeguards in place by contacting us at info@mercedescountryhouse.com.

How Long We Keep Your Data

Your Rights Under GDPR

Under the GDPR and Portuguese Law 58/2019, you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data where there is no compelling reason for continued processing
• Right to restriction (Art. 18): request that we limit how we use your data in certain circumstances
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right not to be subject to automated decision-making (Art. 22): we do not use automated decision-making or profiling that produces legal effects

How to Exercise Your Rights

To exercise any of these rights, contact us at:

We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Portuguese data protection authority:

UK residents may also contact the Information Commissioner's Office (ICO).

Security of Your Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted transmission (SSL/TLS), PCI DSS-compliant payment processing, and access controls limiting data to authorised personnel only.

Children's Data

We do not knowingly collect personal data from children under the age of 16 without parental consent, in accordance with Article 8 of the GDPR and Portuguese Law 58/2019. If you believe we have collected data from a child without appropriate consent, please contact us so we can delete it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised "Last updated" date.

Contact Us