EN

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA collects, uses, stores and shares personal data in connection with madeiravillarentals.com, the activities of Madeira Villa Rentals, and bookings and services relating to the accommodation units it operates.

This Policy applies to website visitors, guests, booking holders, people who contact us and other individuals whose personal data is processed in connection with our services.

1. DATA CONTROLLER

The controller of your personal data is:

JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA
Portuguese tax/company number (NIF/NIPC): 514 399 813
Brand/activity: Madeira Villa Rentals
Accommodation units: Vila Escaleiras (Caminho das Escaleiras, 9, 9270-038 Porto Moniz); Villa Domoterra I (Caminho das Escaleiras, 9A, 9270-038 Porto Moniz); Villa Espigão (Vereda do Espigão, 7, 9370-376 Fajã da Ovelha).
Local Accommodation Registrations: 33712/AL and 142917/AL
Contact address: Caminho Lourencinha, 23, 9300-092 Câmara de Lobos, Madeira, Portugal
Email: bookingmadeiravillarentals.com
Website: madeiravillarentals.com

For privacy-related questions or to exercise your data protection rights, you may contact us at bookingmadeiravillarentals.com.

2. APPLICABLE LAW

Personal data is processed in accordance with Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation, GDPR), Portuguese Law No. 58/2019 of 8 August, and other applicable Portuguese and European privacy, electronic communications and data protection legislation.

3. DATA PROTECTION PRINCIPLES

Madeira Villa Rentals aims to process personal data lawfully, fairly and transparently, in accordance with the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

We only collect data that is adequate, relevant and necessary for the identified purposes and implement technical and organisational measures designed to protect it.

4. PERSONAL DATA WE MAY COLLECT

Depending on how you interact with us, we may process the following categories of personal data:

  • Identification data: name, date of birth, nationality and, where required to comply with legal obligations, identity document or passport details.
  • Contact data: email address, telephone number, address and other information provided for communication.
  • Booking and stay data: arrival and departure dates, booked unit, number and age of guests, special requests, additional services, booking history and communications relating to the stay.
  • Billing data: billing name or company name, tax number, billing address and information relating to accounting documents.
  • Payment and transaction data: payment method, transaction status, amounts and transaction references. Full payment card details are generally processed by the payment service provider and may not be accessible to JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA.
  • Communication data: content of messages sent by email, contact form, booking engine, booking platforms or other channels used to communicate with us.
  • Technical and usage data: IP address, access date and time, browser, operating system, device, pages viewed, technical logs and cookie or similar technology identifiers, where applicable.
  • Other data that you voluntarily provide and that is necessary to respond to your request or provide the requested service.

5. HOW WE COLLECT DATA

Data may be collected directly from you, including when you:

  • use the website or contact form;
  • make a booking through the booking engine integrated into the website;
  • contact us by email, telephone or another channel;
  • check in or provide information necessary for your stay;
  • request additional services.

We may also receive data from third parties, including booking platforms, agencies, tour operators, payment providers or other partners used by the guest. In those cases, such third parties may act as independent controllers for processing carried out on their own platforms.

6. PURPOSES AND LEGAL BASES

We process personal data only where an appropriate legal basis exists. Our main purposes are:

Enquiries and pre-contractual steps: to respond to requests for information, availability, quotations or other communications before a booking. Legal basis: steps taken at the data subject’s request prior to entering into a contract and, where applicable, legitimate interests in managing communications.

Booking management and accommodation services: to create, confirm, amend and manage bookings, perform check-in and check-out, communicate with guests and provide contracted services. Legal basis: performance of a contract or pre-contractual steps.

Payments, billing and accounting: to process payments, issue tax documents, manage refunds and comply with accounting and tax obligations. Legal basis: performance of a contract and compliance with legal obligations.

Legal obligations relating to accommodation: including, where applicable, collecting and communicating legally required information concerning foreign guests and responding to lawful requests from authorities. Legal basis: compliance with a legal obligation.

Security, fraud prevention and legal claims: to protect guests, premises, IT systems and transactions, prevent abusive or fraudulent activity, manage incidents and complaints, and establish, exercise or defend legal claims. Legal basis: legitimate interests and, where applicable, compliance with legal obligations.

Service improvement: to proportionately assess service quality, manage feedback and improve internal processes. Legal basis: legitimate interests, provided these are not overridden by the data subject’s rights and freedoms.

Marketing and promotional communications: to send newsletters, campaigns or offers where a lawful basis exists. Where consent is required, such communications will only be sent after valid consent, which may be withdrawn at any time.

Website analytics: where non-essential analytics cookies or similar technologies are used, processing takes place only after the applicable consent, in accordance with the Cookie Policy.

7. YNNOV BOOKING ENGINE

The Madeira Villa Rentals website may integrate Ynnov technology to provide and manage bookings where that service is active.

For data processed through the platform in connection with Madeira Villa Rentals activities, JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA acts as the data controller and Ynnov may act as a processor, processing personal data on behalf of and under the instructions of JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA, without prejudice to processing for which Ynnov acts as an independent controller under its own Privacy Policy.

The platform may process data such as name, contact details, booking information, information required for the stay, billing information, communications and, where legally necessary, guest identification data.

Where used, the platform may host and process data for functions including booking management, guest communications, payments, invoicing and compliance with legal obligations, in accordance with the technical and contractual conditions applicable to the service.

If an individual concierge/check-in portal or link provided through Ynnov is used, guests should keep that link confidential and not share it with third parties.

8. CONTACT FORMS AND GOOGLE reCAPTCHA

The website may provide forms through which data such as name, email address, subject and message content are collected.

Data submitted through these forms is used to respond to the communication and follow up on the request.

To protect forms against spam, abuse and automated access, the website uses or may use Google reCAPTCHA. This service may collect technical information about the device and interaction with the website in accordance with Google’s terms and privacy policy.

The use of security mechanisms is based on JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA’s legitimate interest in protecting the website, its systems and users, without prejudice to the rules applicable to storing or accessing information on a user’s device.

9. COOKIES AND ANALYTICS

The website uses cookies and similar technologies. Some are strictly necessary for the operation and security of the website or to provide functions expressly requested by the user.

Analytics, advertising or other non-essential cookies will only be used where the consent required by applicable law has been obtained.

Where Google Analytics or equivalent services are active, technical and usage information such as IP address, device, browser and website interaction may be processed to produce usage statistics. These services should be activated in accordance with the choices made by the user through the consent management mechanism.

Detailed information about cookie categories, providers, purposes and durations should be set out in the Madeira Villa Rentals Cookie Policy.

10. PAYMENTS

Payments associated with online bookings may be processed by external payment service providers integrated with the booking engine.

These providers may process information required to authorise and execute the transaction and prevent fraud. Depending on the service used, the payment provider may act as an independent controller or as a processor for certain processing operations.

JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA aims to limit access to payment information to what is strictly necessary and generally does not need to store full payment card details.

11. SHARING AND RECIPIENTS

Personal data is not sold.

It may be made available, to the extent strictly necessary, to the following categories of recipients:

  • Ynnov and other technology suppliers involved in managing the website, bookings and stays;
  • web hosting, IT maintenance, email and communications providers;
  • payment service providers and financial institutions;
  • accountants, consultants, insurers, lawyers or other professional service providers subject to confidentiality duties;
  • booking platforms and partners involved in a booking where necessary to manage it;
  • Google or other technology providers where reCAPTCHA, analytics, maps or similar features are used;
  • public, tax, police, judicial or other legally competent authorities where disclosure is required or permitted by law.

Service providers processing data on behalf of JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA are subject to the contractual and legal requirements applicable to processors.

12. FOREIGN GUEST DATA

Portuguese law requires accommodation operators to collect and communicate certain information concerning foreign guests.

Where this obligation applies, the required data will be processed solely to comply with that legal obligation and communicated through the legally applicable system and to the competent authorities.

Accommodation bulletins and related records subject to the relevant legal regime are retained for the statutory period currently provided for by law, which is one year calculated in accordance with the applicable legislation.

13. INTERNATIONAL DATA TRANSFERS

We seek to use providers that process data within the European Economic Area (EEA). However, some technology providers may process or permit access to data from third countries.

Where personal data is transferred outside the EEA, the safeguards required by law will be used, such as a European Commission adequacy decision, the EU-U.S. Data Privacy Framework where applicable, European Commission Standard Contractual Clauses or another valid GDPR transfer mechanism.

You may request further information about applicable safeguards using the contact details in this Policy.

14. RETENTION PERIODS

Personal data is retained only for as long as necessary for the purposes for which it was collected and for any additional periods required or permitted by law.

In general:

  • enquiries that do not result in a booking are retained for the time necessary to respond and manage the contact and may be kept for a reasonable additional period for follow-up and the defence of legal rights;
  • booking and stay data is retained for the contractual relationship and afterwards for the period necessary to comply with legal, tax and accounting obligations and to establish, exercise or defend legal claims;
  • tax and accounting documents are retained for the periods required by applicable law;
  • foreign guest accommodation bulletin data is retained for the applicable statutory period, currently one year under the relevant legal regime;
  • data used for consent-based marketing is processed until consent is withdrawn or the data is no longer necessary, without prejudice to the minimum retention required to demonstrate compliance with opt-out or objection requests;
  • cookie and analytics data is retained according to the periods stated in the Cookie Policy and the settings of the relevant providers.

When data is no longer required, it will be deleted, anonymised or restricted where retention remains legally required.

15. DATA SECURITY

JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA implements technical and organisational measures appropriate to the risk to protect personal data against destruction, loss, alteration, unauthorised disclosure or access.

These measures may include access controls, credential management, security updates, backups, protection of communications and limiting access to data to people who need it to perform their duties.

Despite these measures, no Internet-connected system can guarantee absolute security. Users should also follow appropriate security practices and keep any personal links or credentials provided to them confidential.

16. CHILDREN’S DATA

Madeira Villa Rentals does not specifically target its website or marketing activities at children.

However, in the context of a family booking, data relating to minors may be processed, such as age and, where legally required, other identification information. Such data should be provided by a person with parental responsibility, a legal representative or the adult responsible for the booking and will only be processed to the extent necessary to manage the stay and comply with legal obligations.

17. YOUR DATA PROTECTION RIGHTS

Under the GDPR, and where the relevant legal requirements are met, you may exercise the following rights:

  • the right of access to your personal data and information about its processing;
  • the right to rectification of inaccurate or incomplete data;
  • the right to erasure;
  • the right to restriction of processing;
  • the right to object to processing based on legitimate interests and, at any time, to direct marketing;
  • the right to data portability where processing is based on consent or a contract and is carried out by automated means;
  • the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
  • the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects, in the cases provided by law.

These rights are not absolute, and there may be situations where JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA is legally permitted or required to retain or continue processing certain data.

18. HOW TO EXERCISE YOUR RIGHTS

Requests to exercise your rights or other privacy enquiries may be sent to:

bookingmadeiravillarentals.com

Your request should clearly identify the right you wish to exercise and provide sufficient information to identify the data concerned. Where there is reasonable doubt about the identity of the requester, additional information strictly necessary to confirm identity may be requested.

Exercising your rights is generally free of charge. JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA will respond within the time limits set out in the GDPR.

19. COMPLAINT TO THE SUPERVISORY AUTHORITY

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes applicable data protection law.

In Portugal, the supervisory authority is:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1st Floor
1200-651 Lisbon, Portugal
Email: geralcnpd.pt
Website: www.cnpd.pt

20. AUTOMATED DECISION-MAKING AND PROFILING

JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA does not expect to use guest data to make decisions based solely on automated processing that produce legal or similarly significant effects on the individual.

External providers, particularly payment providers, may use automated fraud-prevention mechanisms in accordance with their own policies and legal responsibilities.

21. THIRD-PARTY LINKS AND PLATFORMS

The website may contain links to websites, maps, social networks, booking platforms or other services operated by third parties.

This Privacy Policy applies only to processing for which JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA is responsible. Processing carried out directly by third parties is subject to their own privacy policies, which we recommend reviewing.

22. CHANGES TO THIS PRIVACY POLICY

This Policy may be updated when there are changes to applicable law, technology, operations, services or suppliers used by Madeira Villa Rentals.

The current version will be available at madeiravillarentals.com and will state the date of its latest update. Material changes may be communicated through additional means where appropriate or legally required.

23. CONTACT

For any questions about this Policy or the processing of your personal data:

Madeira Villa Rentals
JOÃO GAMA & RODRIGUES, UNIPESSOAL, LDA
Portuguese tax/company number (NIF/NIPC): 514 399 813
Local Accommodation Registrations: 33712/AL and 142917/AL
Caminho Lourencinha, 23
9300-092 Câmara de Lobos
Madeira, Portugal
Email: bookingmadeiravillarentals.com
Website: madeiravillarentals.com