Privacy Policy

1. Who is responsible for your data

The data controller responsible for personal data collected through this website and in the course of operating the InnEsposende Sports Hostel is:

For any question about how we process your personal data, please contact us using the details above.

2. What personal data we collect

Depending on how you interact with us, we may collect:

• Identification and contact details: name, address, phone number, email address, nationality.
• Booking and stay data: check-in and check-out dates, room type, number of guests, special requests, stay history.
• Legal identification data: ID document number and type (national ID card, passport or equivalent), date and place of birth, and signature, collected to comply with the legal obligation to register guests.
• Payment data: credit/debit card or other payment details, processed directly by our payment partners — we never store full card numbers on our own systems.
• Communications: messages exchanged by email, WhatsApp, phone, or through booking platforms.
• Website technical data: this website does not use analytics or advertising tools; see our Cookie Policy for details on the cookies used on the Location page.

3. Why we process your data, and on what legal basis

• Booking management and providing accommodation services (performance of a contract) — to process your reservation, prepare your stay and deliver the services you booked.
• Guest registration (compliance with a legal obligation) — Portuguese law governing Local Accommodation establishments requires us to collect and report identification data for all guests aged 16 and over to the competent authorities (currently via AIMA — the Agency for Integration, Migration and Asylum).
• Invoicing and tax obligations (compliance with a legal obligation) — issuing invoices and keeping accounting records as required by Portuguese tax law.
• Communicating with you before, during and after your stay (performance of a contract / legitimate interest) — to respond to requests, provide assistance and collect feedback.
• Direct marketing (consent) — only where you have expressly opted in to receive promotional communications; you may withdraw your consent at any time.
• Security and fraud prevention (legitimate interest) — to protect our property, guests and staff.

4. Who we share your data with

We do not sell your personal data. We share only the data strictly necessary with the following recipients, acting as processors or independent controllers as applicable:

• Amenitiz — our property management system (PMS), booking engine and channel manager, used to manage bookings, availability, guest communications and invoicing.
• Chekin — an online check-in platform, integrated through Amenitiz, used to collect and verify identification documents and to comply with the legal guest-registration obligation to the competent authorities.
• Payment service providers — to process payments securely.
• Public authorities — including AIMA and other competent bodies, where required by law.
• Certified accountant — to comply with tax and accounting obligations.

We contractually require all our service providers to process your personal data securely and in compliance with the GDPR (General Data Protection Regulation).

5. How long we keep your data

We keep your data only for as long as necessary for the purposes described above, and in any event for the minimum periods required by Portuguese law, including:

• Guest registration data: for the period required by Local Accommodation and border-control legislation.
• Invoicing and accounting records: 10 years, as required by Portuguese tax and commercial law.
• Consent-based marketing data: until you withdraw your consent.

6. Your rights

Under the GDPR, you have the right, at any time, to:

• Access the personal data we hold about you;
• Request rectification of inaccurate or incomplete data;
• Request erasure of your data, where applicable;
• Request restriction of processing;
• Object to processing based on legitimate interest, including direct marketing;
• Request portability of your data;
• Withdraw consent previously given, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with the supervisory authority, the Portuguese National Data Protection Commission (CNPD) — www.cnpd.pt.

7. Data security

We adopt appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or improper disclosure. However, no system is completely infallible; should a security incident occur that is likely to affect your rights and freedoms, we will notify the CNPD and affected data subjects within the timeframes and terms required by the GDPR.

8. Cookies

For information about the cookies used on this website, see our Cookie Policy.

9. Contact and updates to this policy

We may update this Privacy Policy from time to time to reflect legal or operational changes. The date of the last update is shown at the top of this page. For any question, contact us at [email protected] or +351 253 179 868.