Privacy Policy and Personal Data Processing

Lagarto Pintado Country Home

Revised on 7 October 2026

This policy explains how we process the personal data of visitors to www.lagartopintado.com, people who contact us, and customers and guests of Lagarto Pintado Country Home, from initial enquiries through to managing their stay and meeting our legal obligations.

Personal data are processed in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, or GDPR), Portuguese Law No. 58/2019 of 8 August, and other applicable legislation, including Portuguese Law No. 41/2004 of 18 August, as amended, concerning electronic communications and cookies.

1. Data controller and contact details

The data controller is Joyful Lizard, Lda., Portuguese company and tax identification number (NIPC) 514 455 870, which operates Lagarto Pintado Country Home, registered as a local accommodation establishment under number 119499/AL.

Address: Rua de São Braz, n.º 20, 6230-160 Castelo Novo, Fundão, Portugal.
Email for privacy enquiries and requests to exercise your rights: info@lagartopintado.com.
Telephone: +351 926 963 545 — calls are charged at the applicable rate for calls to a Portuguese mobile number.

2. Personal data and their sources

Depending on the enquiry or service, we may process your name, email address, telephone number, postal address, billing details, including your tax identification number where necessary, booking dates and details, number of guests, correspondence, requests relating to your stay, and information about payments, security deposits and refunds. Data relating to accompanying guests and children are limited to what is necessary for their stay and to meet applicable legal obligations.

For the mandatory registration of foreign guests, including citizens of other European Union Member States, we process the information required for the statutory accommodation report, such as nationality, date and place of birth, country of residence and identity document details.

We collect data directly through forms, email, telephone, WhatsApp, or during the booking and check-in process. We may also receive data through Amenitiz, the platform used to make the booking, or the person booking on behalf of the guests. Anyone providing personal data about accompanying guests must inform them of this policy and have a lawful basis for sharing their data.

Use of the website and its integrated services may involve technical data, such as IP addresses, browser and device information, and access logs, depending on the features used. Payment details entered through a service provider’s dedicated interface are processed under the terms applicable to that service. Full payment card numbers and security codes must not be sent by email or WhatsApp.

3. Purposes and legal bases for processing

Enquiries and bookings — We use the data necessary to respond to enquiries, check availability, provide offers, and manage bookings, amendments and cancellations. Where an individual contacts us to enter into a contract, the legal basis is taking steps at their request before entering into a contract or performing that contract, under Article 6(1)(b) of the GDPR.

Provision of accommodation — We process the data necessary to manage stays, check-in and check-out, payments, security deposits, refunds and operational communications in order to perform the contract. Where data concern accompanying guests who are not parties to the contract, managing their stay may be based on our legitimate interest in providing the accommodation booked, subject to safeguards for their rights. Records required by law are processed to comply with a legal obligation.

Billing and legal obligations — We process the data necessary to issue and retain tax documents, meet accounting obligations, and fulfil the mandatory reporting requirements for foreign guests through Portugal’s Accommodation Reporting Information System (Sistema de Informação de Boletins de Alojamento, or SIBA). The legal basis is Article 6(1)(c) of the GDPR.

Complaints, security and disputes — We process the data necessary to handle complaints, prevent misuse, and establish, exercise or defend legal claims. The legal basis is compliance with legal obligations or, as appropriate, our legitimate interest in protecting our business, guests and the company’s rights. Reliance on this interest requires an assessment of necessity and proportionality; it does not automatically override the individual’s rights.

Marketing — Promotional communications sent electronically require prior consent where required by law. If we rely on the statutory exception for existing customers, communications are limited to our own similar products or services, with a free and straightforward opportunity to opt out both when contact details are collected and in every message. You may also opt out by emailing info@lagartopintado.com. Refusing marketing communications does not affect your booking or stay.

Special requirements — Please avoid providing health information or other sensitive personal data unless necessary. If a request requires us to process health data, we will provide specific information and obtain explicit consent where this is the applicable legal basis, or identify another valid legal condition under Article 9 of the GDPR.

4. Required information and identity verification

When collecting personal data, we indicate which information is essential to make a booking, provide accommodation or meet legal obligations. Without this information, we may be unable to confirm the booking or provide the service. Optional information and consent to marketing are handled separately.

Verifying identity and collecting legally required information do not, in themselves, require us to retain a full copy of an identity document. The Portuguese Citizen Card (Cartão de Cidadão) may only be copied where expressly permitted by law, ordered by a judicial authority, or authorised through freely given consent, with an effective alternative means of identification available. Any copying must be limited to the information necessary and any resulting copy retained only for as long as justified by its purpose.

5. Recipients and service providers

Access to personal data is restricted to authorised individuals who need it to perform their duties. Where necessary for the service concerned, we may use providers of booking and guest management services, IT services, communications, accounting and payment processing.

We use Amenitiz Solutions, S.L., established in Spain, to manage bookings and check-in. When processing guest data on our behalf, Amenitiz acts as a data processor under the applicable instructions and contractual terms. The specific features used determine which data are processed. Contractual information on data processing is available at https://amenitiz.com/pt/legal/dpa.

The website uses Google services, including website hosting and contact and map components. Each provider’s role—as a data processor or an independent data controller—depends on the service and processing concerned. Booking platforms, payment providers, and social media or messaging services may process data for their own purposes under their respective policies. We remain responsible for the processing we carry out.

Personal data may be disclosed to the Portuguese Tax and Customs Authority, to the competent authorities through SIBA, to courts, or to other bodies where required by law or supported by a valid legal basis. Data processors are subject to the contractual data protection obligations set out in Article 28 of the GDPR.

6. International data transfers

Some providers and their subprocessors may process personal data outside the European Economic Area. In these circumstances, transfers must be based on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with any necessary assessments and supplementary measures.

Reliance on the EU–US Data Privacy Framework requires the recipient to hold valid certification covering the processing concerned. A provider’s establishment in Europe does not rule out international transfers by its subprocessors. You may request information about transfers involving your personal data and the safeguards used by emailing info@lagartopintado.com.

7. Data retention

We retain personal data only for as long as necessary for the purpose for which they were collected. Enquiries that do not result in a booking are retained for the time needed to respond and follow up. Booking and stay data are retained while the contractual relationship is being performed and concluded and, where necessary, to meet legal obligations or establish, exercise or defend legal claims, within the applicable time limits.

Accounting books, records and supporting documents covered by Article 123 of the Portuguese Corporate Income Tax Code (Código do IRC) are retained for 10 years. This period does not apply indiscriminately to all guest data. Statutory accommodation reports and equivalent records are retained for one year, starting on the day after the guest’s departure is reported, under Article 15 of Portuguese Law No. 23/2007, as amended.

Contact details used for marketing are no longer used for that purpose after consent is withdrawn or an objection is received. A minimal record may be retained to respect the opt-out and demonstrate compliance with our obligations. Once the applicable retention period has expired, data are deleted or anonymised, unless a specific legal obligation requires further retention.

8. Cookies and external services

Cookies and similar technologies may store information on your device or access information already stored there. Technologies strictly necessary to transmit a communication or provide a service you have expressly requested may be used without consent. Other technologies, including those used for analytics or advertising, require prior consent where covered by the applicable law, even if the results are presented in aggregate form.

Where non-essential cookies are used, the information provided when you make your choice must identify the cookies, providers, purposes and duration. It must allow you to accept, reject or choose cookies by purpose, and to withdraw consent as easily as you gave it. Continuing to browse the website or reading this policy does not constitute consent.

Maps, forms and other embedded content may involve communications with external providers. Content that relies on non-essential cookies must respect the user’s prior choice. When following a link to an external service, please consult its privacy policy. You may also manage or delete cookies through your browser. Browser settings complement consent mechanisms and may affect features you have requested.

9. Your rights and how to exercise them

Subject to the conditions and limitations set out in the GDPR, you may request access to your personal data and information about their processing, rectification, erasure, restriction of processing and data portability. Data portability applies to automated processing based on consent or a contract and covers data provided by the individual.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time. You may withdraw consent without affecting the lawfulness of processing carried out before its withdrawal. You also have the rights provided under Article 22 concerning decisions based solely on automated processing that produce legal effects or similarly significantly affect you, subject to the applicable statutory exceptions and safeguards.

Please send your request to info@lagartopintado.com or to the postal address provided in this policy. We may request only the proportionate information needed to verify your identity. We normally respond within one month. Where necessary because of the complexity or number of requests, this period may be extended by a further two months. We will inform you of the extension and its reasons within the first month. Requests are generally handled free of charge.

You may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, or CNPD) through www.cnpd.pt, without having to contact us first and without prejudice to any other remedies available to you.

10. Security and personal data breaches

We implement technical and organisational measures appropriate to the risks to protect personal data against unauthorised access, disclosure or alteration, and against accidental or unlawful loss or destruction. These measures include access controls and confidentiality obligations. No system can guarantee absolute security.

If a personal data breach occurs, we assess the risks and comply with the obligations to notify the supervisory authority and communicate the breach to affected individuals where required by law.

11. Updates and contact details

This policy may be revised to reflect changes in legislation, technology or our services. The published version must indicate the date of its latest revision. Material changes will be communicated appropriately. Revising this policy does not replace the need to obtain specific consent where required.

For further information, please contact info@lagartopintado.com.