Privacy and Data Protection Policy

www.picoholidayrentals.com

This Privacy Policy describes how the website www.picoholidayrentals.com processes the personal data of its users, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR), Law no. 58/2019 of 8 August (which ensures the implementation of the GDPR within the Portuguese legal framework), and other applicable legislation.

1. Data Controller

The Data Controller responsible for processing personal data is:

Name: Adelina Maria Valim Silveira
Tax Identification Number (NIF): 111227119
Address: Rua do Moinho 2
Postal Code: 9940-336
City: São Roque do Pico, Azores
Website: www.picoholidayrentals.com

Contact email: geral@picoholidayrentals.com

Hereinafter referred to as the “Data Controller”.

2. Personal Data Collected

Within the scope of local accommodation booking activities, the following personal data may be collected and processed:

  • Full name

  • Email address

  • Telephone number

  • Residential address

  • Tax Identification Number (for invoicing purposes)

  • Payment details (processed by certified external payment providers)

  • Stay dates and reservation-related information

  • Identification data required by legal obligations applicable to local accommodation (e.g., communication to competent authorities when legally required)

  • IP address, browsing data, and cookies

3. Purpose of Processing

Personal data is processed for the following purposes:

a) Management, confirmation, and execution of reservations;
b) Provision of accommodation services;
c) Payment processing and invoice issuance;
d) Compliance with legal, tax, and regulatory obligations applicable to local accommodation;
e) Responding to information or contact requests;
f) Sending promotional or informational communications, where prior consent has been given;
g) Improving the website user experience.

4. Legal Basis for Processing

The processing of personal data is based on the following legal grounds:

  • Performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR);

  • Compliance with a legal obligation (Article 6(1)(c) GDPR);

  • Legitimate interests pursued by the Data Controller (Article 6(1)(f) GDPR);

  • Consent of the data subject, where applicable (Article 6(1)(a) GDPR).

5. Data Retention Period

Personal data will be retained only for the period necessary to fulfill the purposes for which it was collected, or for the legally required periods, namely for tax, accounting, and legal purposes.

6. Data Sharing with Third Parties

Personal data may be disclosed to:

  • Payment processing entities;

  • IT service providers and web hosting providers;

  • Accounting and legal consultancy entities;

  • Public authorities, when required by law.

All subcontracted entities are contractually bound to comply with GDPR requirements and to ensure data confidentiality and security.

7. Data Subject Rights

Under applicable legislation, data subjects have the right to:

  • Access their personal data;

  • Request rectification of inaccurate or incomplete data;

  • Request erasure of data, where legally permissible;

  • Request restriction of processing;

  • Object to processing;

  • Request data portability;

  • Withdraw consent, where processing is based on consent.

These rights may be exercised by written request to the contact email indicated above.

Data subjects also have the right to lodge a complaint with the competent supervisory authority:

Portuguese Data Protection Authority (CNPD)
Av. D. Carlos I, 134 – 1.º
1200-651 Lisbon
www.cnpd.pt

8. Security Measures

Appropriate technical and organizational measures are implemented to protect personal data, including:

  • Use of SSL certificate;

  • Access control mechanisms;

  • Password protection and IT security systems;

  • Restricted access to data limited to authorized persons only.

9. Cookies Policy

The website uses cookies to improve the browsing experience and for statistical purposes. Users may configure their browser to block or delete cookies; however, some website functionalities may be limited as a result.

10. Policy Updates

This Privacy Policy may be reviewed and updated whenever necessary. Any changes will be duly published on the website.