1. Data controller
The controller of personal data is Calyferias, NIF 515955124, Paderne, Algarve, Portugal — contact@calyferias.com.
This policy explains what data we collect, why, how long we keep it and what your rights are under the General Data Protection Regulation (GDPR — EU Regulation 2016/679).
2. Data we collect
We only collect the data required to provide our services:
- Identity and contact details: first and last name, email, phone, language.
- Stay details: dates, number of guests, property booked, messages exchanged.
- Billing and payment data: amounts, instalments, payment history (card data is handled exclusively by our payment provider Stripe and never stored on our servers).
- Technical data: connection logs and security data required for the site to operate.
3. Purposes and legal bases
- Managing booking requests, stays and payments: performance of the contract.
- Sending transactional emails (confirmation, payment link, instalment reminders): performance of the contract.
- Answering contact and concierge enquiries: legitimate interest or consent.
- Portuguese accounting and tax obligations: legal obligation.
- Site security and fraud prevention: legitimate interest.
4. Retention period
Booking data is kept for the duration of the contractual relationship, then archived for the statutory accounting and tax retention period (10 years in Portugal). Contact enquiries without a booking are deleted no later than 3 years after the last exchange.
5. Recipients and processors
Your data is never sold. It is shared only with the processors required to deliver the service:
- Hosting and database provider (European infrastructure).
- Stripe, for secure payment processing.
- Our transactional email provider.
- The owner of the booked property, limited to information needed to welcome you.
- Competent authorities where required by law (including guest reporting where mandatory).
6. Transfers outside the European Union
Where a processor handles data outside the European Union, the transfer is covered by the European Commission’s standard contractual clauses or by an adequacy decision.
7. Your rights
Under the GDPR you have the following rights:
- Right of access to your data and to obtain a copy.
- Right to rectification of inaccurate data.
- Right to erasure, within the limits of our legal retention obligations.
- Right to restriction of processing and right to object.
- Right to data portability.
- Right to withdraw consent at any time where processing is based on it.
8. Exercising your rights and complaints
To exercise your rights, write to contact@calyferias.com describing your request. We reply within one month.
If you believe your rights are not respected, you may lodge a complaint with the Portuguese data protection authority (CNPD — www.cnpd.pt) or with the authority in your country of residence.
9. Cookies
The site always uses technical cookies necessary for it to work (session, security, language preference).
Audience-measurement cookies (Google Analytics) are only set after your consent, given through the cookie banner. Your IP address is anonymised and you can change your mind at any time.
No advertising or profiling cookies are set.
10. Security
We implement appropriate technical and organisational measures: encrypted communications, restricted data access, authentication of administrator accounts and access logging.