Privacy Policy

S4P - Realestate, Lda.
Parque Empresarial de Lanheses, Lote B1, 4925-432 Lanheses, Portugal
represented by Tobias Harter
info@s4p-realestate.pt

Contact for data protection and data-subject requests: Tobias Harter · info@s4p-realestate.pt

We have not appointed a Data Protection Officer because the thresholds of Article 37 GDPR are not met. For any privacy question, write to the address above.

This policy covers personal data processed through this website only. There is no public booking flow, no account creation, and no online payments. Off-site interactions (email correspondence, on-site stays) follow the same principles but are governed by separate agreements.

Web server access logs

When you visit the site, our server records the IP address, browser User-Agent, requested URL, timestamp, and HTTP status. These logs are used for security, abuse prevention, and basic diagnostics.

Contact form

If you submit the contact form, your browser opens an email message in your mail client addressed to info@s4p-realestate.pt and pre-filled with the name, email address, and message you provided. The submission does not pass through any application server of ours — only the email itself arrives at our mailbox once you press send.

Cookies

We set only strictly-necessary cookies: a functional cookie that remembers your language (NEXT_LOCALE) and Cloudflare's security cookies (cf_bm, cf_clearance) for bot detection and challenge clearance. We do not use analytics, marketing pixels, font CDNs, or third-party embeds. See the dedicated Cookies page for the full inventory.

Each processing activity has its own legal basis under Article 6 of the GDPR.

Server logs

Article 6(1)(f) GDPR — legitimate interest in maintaining a secure, available, and abuse-free service. A balancing test shows no overriding rights of the data subject.

Contact form

Article 6(1)(f) GDPR — legitimate interest in responding to enquiries about the property. The mail you compose is sent from your own email account; we receive it and may reply to the address it came from.

Strictly-necessary cookies

Article 6(1)(f) GDPR read with Article 5(2) of Portuguese Law no. 41/2004 (ePrivacy) — strictly-necessary cookies for security and challenge clearance, exempt from consent.

We share personal data only with the processors strictly required to operate the site. Each is bound by a Data Processing Agreement under Article 28 GDPR.

• —Cloudflare, Inc. (USA) — content delivery network, DDoS protection, and bot management; processes IP and request metadata at the network edge.
• —Our email host (dominios.pt, Portugal) — stores replies and any further correspondence in our business mailbox.

Cloudflare is established in the United States. IP addresses and request metadata may be processed there for content delivery and security. Cloudflare is certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), which provides an adequate level of protection within the meaning of Article 45 GDPR.

As an additional safeguard, our Data Processing Agreements incorporate the EU Standard Contractual Clauses (Decision (EU) 2021/914 of 4 June 2021). You may obtain a copy of these safeguards by writing to the address above.

We retain personal data only for as long as is necessary for the purpose for which it was collected, subject to the following ceilings:

• —Server access logs — 30 days, then automatically deleted.
• —Contact enquiries (email correspondence sent from the mailto: form and stored in our mailbox) — up to 12 months from last contact, then deleted unless an active business relationship requires retention.
• —Business mailbox correspondence — up to 2 years, then archived offline; without prejudice to applicable tax and accounting retention obligations.

To manage stays at our property in Caminha we process guests' personal data in an access-restricted management system protected by Cloudflare Access. This data is not collected publicly through this website but in the course of handling a booking (e.g. via booking platforms, email or telephone).

Booking data

Name, email address, party size and stay dates. Legal basis: Article 6(1)(b) GDPR (performance of the accommodation contract — identifying the guest, checking capacity, sending the booking confirmation).

Guest registration (AIMA/SEF)

For foreign guests we are legally required to transmit registration data (full name, date of birth, nationality, country of residence, ID/passport number and issuing country) to the competent authority (Boletim de Alojamento). Legal basis: Article 6(1)(c) GDPR in conjunction with Articles 14–17 of Portuguese Law No. 23/2007. This data is collected solely for that purpose; we do not store copies or scans of your identity document.

Processors

Cloudflare, Inc. — hosting of the booking database (Cloudflare D1). The database is restricted to the EU jurisdiction; booking data is stored and processed exclusively within the European Union. Resend, Inc. (USA) — delivery of transactional booking confirmations; this transfer to the USA is safeguarded under the EU-US Data Privacy Framework and EU Standard Contractual Clauses (Article 46 GDPR). Resend in turn engages sub-processors, including PlanetScale, Inc. (USA) for database infrastructure; the same safeguards apply to that onward transfer.

Retention

Registration data under Law No. 23/2007 is kept for one year from the day after the departure has been reported and then deleted (Article 15(5)). Other booking data is kept for the duration of the contractual relationship and at most 24 months after departure, after which it is automatically anonymised or deleted — subject to applicable tax and commercial retention obligations.

We do not use your personal data for automated decision-making or profiling within the meaning of Article 22 GDPR.

Under Articles 15 to 22 of the GDPR, you have the right to access your data, have inaccurate data rectified, request erasure (the “right to be forgotten”), restrict our processing, receive your data in a portable format, and object to processing based on legitimate interest. To exercise any of these, write to info@s4p-realestate.pt and we will respond within one month (Article 12(3) GDPR).

Where processing is based on your consent or on Article 6(1)(b) GDPR (pre-contractual steps), you may withdraw at any time without affecting the lawfulness of processing carried out before the withdrawal.

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Portuguese supervisory authority:

This site is not directed at children. Under Article 16 of Portuguese Law no. 58/2019, the minimum age for valid consent to information-society services is 13. We do not knowingly collect data from anyone under 13; if we discover we have, we will delete it without delay.

We may update this policy to reflect changes in our processing or in the law. The “last updated” date at the bottom of this page indicates the most recent revision. Material changes will be communicated through the site itself.