Privacy Policy

1.1 The controller

Olá Madeira is a boutique short-term rental business in Funchal and Paúl do Mar, Madeira, Portugal. We let nine homes on the island, we list property for sale and long-term rent, and we publish guides, events and articles about Madeira on this website.

Olá Madeira is a trading name of Lord Somerset, Sociedade Imobiliária, Lda, a company registered in Portugal under NIPC 515 581 380, at Rua da Carreira, N.º 100, Sala E, Edifício Solar da Carreira, 9000-612 Funchal, Madeira, Portugal. In this policy, "we", "us" and "our" mean that business. Under the General Data Protection Regulation we are the controller of the personal data described here, which means we decide what is collected and why.

1.2 How to contact us about your information

Email info@olamadeira.pt with "Privacy" in the subject line, or call +351 910 113 298. A written request is better than a phone call for anything in part 9, because we have to be able to show what was asked and when.

We have not appointed a Data Protection Officer. We are not required to have one: we are a small business, we do not monitor anybody on a large scale, and we do not process special category data as a core activity. Requests go to the address above and are handled by the owners.

1.3 What this policy does not cover

It does not cover other companies' websites. If you book one of our homes through Airbnb, Booking.com or another platform, that platform is a controller in its own right for everything it collects from you, under its own privacy notice, and this policy only picks up at the point that platform passes your booking to us.

Following a link from this site to somebody else's, including our WhatsApp channel, Google Maps or a partner's website, takes you outside this policy. We do not control what those sites collect.

The two homes at Yzerfontein in South Africa, shown on /international, belong to a separate business in South Africa, hosted by Dominic, Jeanne-Marie and Damian and reached on info@tedd.co.za. We show them here as partners. If you book one of those two homes, that business is the controller of your information and it handles it in South Africa under South African law, principally the Protection of Personal Information Act, rather than under this policy. Ask them directly for their privacy notice, or ask us and we will put you in touch.

2.1 If you booked a stay

• Your name, email address, phone number and postal or billing address.
• The names of the other guests, and the number of adults and children.
• Your dates, the property, the price, and any extras or requests.
• Your messages to us and ours to you, by email, phone, WhatsApp or through the booking platform.
• Arrival details you tell us, such as a flight number or an approximate arrival time.
• Anything you choose to tell us in order to make the stay work, which can include accessibility needs, allergies or dietary requirements, and the occasion you are travelling for.
• Your identity document details and nationality, where the law requires us to collect them. See part 4.
• A record that payment was made, the amount, the currency and the date. We do not hold your card number. See part 2.5.
• Any review you leave, and our reply to it.

2.2 If you enquired but did not book

Your name, your contact details and the content of the enquiry, including the dates and the property you asked about. We keep enquiries so that we can answer a follow-up months later without asking you to start again.

2.3 If you signed up for offers or joined the channel

Your name and email address, the date you signed up and which page you signed up on. Joining our WhatsApp channel gives us nothing at all: the channel is run by WhatsApp, members are not visible to us as a list, and we cannot see who is in it or message anyone individually through it.

2.4 If you asked about a property for sale or a long-term rental

Your name, your contact details, which listing you asked about and what you told us about what you are looking for. Enquiries of this kind are usually shared with the property owner and with the estate agency handling the sale. See part 6.

2.5 What we never hold

We do not hold your card number, the expiry date or the security code, and they are never typed into this website. Payment is taken on the checkout run by Lodgify, our booking system, and settled by Stripe. Those details go from your browser to Stripe and never reach us. What comes back to us is that a payment of a certain amount succeeded.

We do not ask for and do not want your health records, your religion, your politics, your sexual orientation, your biometrics or your genetics. If you happen to mention something of that kind in a message, we use it only to answer that message.

2.6 If you only read the site

Your browser tells every website it visits certain things, and Squarespace, which hosts this one, records some of them: your IP address in truncated or full form, the pages you looked at, roughly where in the world you are, what device and browser you used, and which site you arrived from. Part 5 covers what that means in practice and what you can switch off.

2.7 Where it comes from, if not from you

• Booking platforms. Airbnb, Booking.com, Vrbo and any other channel we list on send us the booking, your name, your dates and a way to contact you. Some of them replace your real email address with a forwarding address of their own, and we work with whatever they give us.
• Lodgify, our booking system, holds everything you type into our own checkout and passes it to us.
• The lead guest. If somebody books for a group, we get the other guests' names from them rather than from those guests. If you are booking for other people, please make sure they know their names are being given to us and can read this page.
• Public records and partner agencies, in the property sales side of the business only, where a listing needs verifying.

3.1 To give you the stay you booked

Taking the booking, holding the dates, sending the confirmation, arranging check-in, letting you in, answering you during the stay, cleaning and maintenance, and settling the bill. Basis: performance of a contract with you, or steps taken at your request before entering into one.

3.2 To answer you

Replying to an enquiry, a call, an email or a WhatsApp message, and following it up. Basis: our legitimate interest in running a business that answers the people who contact it. Where the enquiry turns into a booking, it becomes contract instead.

3.3 To meet our legal obligations

Reporting guests where the law requires it, issuing invoices, collecting and remitting tourist tax, keeping accounting records and answering the tax authority, and complying with the Alojamento Local rules our registration is issued under. Basis: compliance with a legal obligation. Part 4 sets these out. We cannot leave these out at your request and still let you stay.

3.4 To keep the property, our guests and our neighbours safe

Checking occupancy against what was booked, dealing with damage, noise or a breach of the house rules, and, rarely, keeping a record of a guest we would not host again. Basis: our legitimate interest in protecting property, people and the licence the business runs on.

3.5 To improve the homes and the website

Reading reviews, looking at which pages and which properties get attention, and fixing what is not working. Basis: our legitimate interest in a business that gets better, and, for anything that needs a cookie you can refuse, your consent. See part 5.

3.6 To send you offers

Emailing you about openings, seasonal rates and the discount for booking direct, if you asked us to. The list is run for us by Brevo, and every email we send through it carries an unsubscribe link. Basis: your consent, which you gave when you signed up and can take back in one click from the foot of any email, or by replying to it, or by emailing us. We may also email a past guest about a similar stay on the basis of our legitimate interest, and every one of those carries the same unsubscribe. We do not sell your address and we do not rent our list to anyone.

3.7 To defend a claim, or make one

Keeping enough of a record to deal with a dispute, a chargeback, an insurance claim or a legal proceeding. Basis: our legitimate interest in establishing, exercising or defending legal claims, and in some cases a legal obligation.

3.8 On legitimate interests

Where we rely on a legitimate interest, we have weighed it against what the use of your information costs you, and we will show you that reasoning if you ask. You can object to any of it: see part 9.

4.1 Reporting foreign guests

Portuguese law requires accommodation providers to report the stay of every guest who is not a Portuguese national to the authorities, within three working days of check-in. That is why we ask each adult guest for their full name, nationality, date of birth, place of birth, identity document or passport number and the dates of the stay, and why we cannot let you stay without them. The report is filed through the national accommodation bulletin system, SIBA, and goes to AIMA, the Agência para a Integração, Migrações e Asilo. We keep the details only for as long as the rules require and do not use them for anything else.

4.2 Invoices, tax and the tourist tax

We have to issue a compliant invoice for every stay and keep it. Invoices carry your name, your address and, where you give it, your tax number, and they are reported to the Portuguese tax authority in the ordinary course. Where a municipality charges a tourist tax, we collect it from you and pay it over, and the return that goes with it says how many guests stayed how many nights.

4.3 Alojamento Local

Our short-stay homes are registered under Portugal's Alojamento Local scheme and each carries a registration number, shown on its own page on this site. The scheme brings record-keeping, safety and complaints duties with it, and those records can be inspected by the authorities.

4.4 What this means for deleting things

A request to erase everything we hold about you cannot reach the records above while the law still requires them. We will delete everything we are free to delete, tell you plainly what is left and why, and delete the rest when the retention period in part 8 runs out.

5.1 What a cookie is doing here

A cookie is a small file a site asks your browser to keep. Portuguese law lets us set the ones the site cannot work without, and asks for your consent before anything else. That is what the banner on your first visit is for, and declining costs you nothing except the measurement in 5.3.

5.2 The ones we cannot work without

• Squarespace, which hosts this site, sets cookies that keep the page working, keep the shop basket, remember that you answered the cookie banner and protect forms against abuse.
• Lodgify, our booking system, sets cookies on the checkout so that the dates, the property and the payment step survive from one page to the next.

5.3 Measurement, and the ones you can refuse

None of the following is set unless you agree to it on the banner, and you can change your mind at any time through the banner or your browser settings. Refusing them does not change anything about the site you can see or book.

• Squarespace Analytics, which records which pages are read, for how long and from roughly where, and reports it to us as totals rather than as people.
• Google Analytics, which does the same job in more detail and tells us which pages lead to a booking and which quietly lose people.
• The Meta pixel, which lets us see whether an advertisement on Facebook or Instagram led to a booking, and lets us show our own advertisements to people who have looked at our homes.

That last one is advertising, so it deserves saying plainly: with your consent, Meta may show you our advertisements after you have visited this site. Refuse the marketing cookies and it does not happen. Meta is a controller in its own right for what it does with that signal, under its own terms.

What we do not do, and will not: we do not sell your personal data, we do not rent our mailing list, and we do not pass anything to a data broker.

5.4 Other companies whose code runs on these pages

• Google Fonts serves the two typefaces the site is set in. Your browser requests them from Google, which sees your IP address in the process.
• Lodgify draws the availability calendar, the prices and the Book Now box on the stay pages.
• Revyoos collects our reviews from the booking platforms and displays them. It sets what it needs to show the widget.
• Google Maps draws the map at the foot of each stay page. It loads only when you scroll down to it, and it shows an approximate pin rather than the exact address.
• WhatsApp, if you follow our channel link or message us. That conversation is on WhatsApp's terms, not ours, and it is end to end encrypted between us and you.

5.5 Do Not Track and global privacy signals

We do not use the kind of tracking those signals were designed to stop. Where the browser sends one, our cookie banner provider treats it according to its own settings.

6.1 The companies that run the machinery

Each of these acts on our instructions under a written contract, uses your information only for the job we gave it, and is not free to do anything else with it.

• Squarespace, which hosts this website, serves its pages and handles its forms.
• Lodgify, which runs the calendar, the checkout and the booking records, and puts the payment through.
• Stripe, which takes the card payment. It is a controller in its own right for the card details, which is why they never reach us.
• Brevo, which sends the mailing list.
• Revyoos, which gathers and displays our reviews.
• Google and Meta, for the measurement and advertising described in part 5, and only where you have agreed to it.
• Our email and messaging providers, which carry the correspondence.

6.2 The people who make the stay happen

Your first name, your dates and anything relevant to getting you in and looking after you go to the host meeting you, the cleaner, and a maintenance contractor if something needs fixing. They get what they need for that job and not the rest.

Some of the homes we let are ours and some we manage for their owners. Where a home is managed, its owner sees the dates, the amount and, where something during the stay makes it necessary, the name on the booking. They do not get your contact details, and they do not get your correspondence with us.

6.3 Booking platforms

If your booking came through Airbnb, Booking.com or a similar channel, we exchange the messages and the booking details with that platform for as long as the booking runs.

6.4 Professional advisers and the authorities

Our accountant and bookkeeper see the invoices. Lawyers and insurers see what a claim requires. The tax authority, the police, the immigration authorities and the tourism regulator see what the law obliges us to give them, and we check that an obligation exists before we hand anything over.

6.5 On the property sales side

An enquiry about a property for sale or a long-term rental is passed to the owner of that property and to the estate agency handling it, because that is the point of making the enquiry. Those parties are controllers in their own right from the moment they receive it, and each has a privacy notice of its own. Tell us if you would rather we did not pass it on, and we will answer you ourselves instead.

6.6 If the business changes hands

If Olá Madeira is sold or merges, guest and enquiry records would pass to the buyer as part of the business. The buyer would be bound by this policy until it told you otherwise, and it would have to tell you.

Our own operations are in Portugal. The booking system, the payment provider, the mailing list and the review service are all in the European Union or the European Economic Area: Lodgify and Revyoos in Spain, Stripe in Ireland and Brevo in France. Nothing about your booking or your payment has to leave Europe to be processed.

What does reach the United States is the website itself, which is hosted and served by Squarespace, an American company; the typefaces, which your browser requests from Google's font servers; and, where you have consented to them, the measurement and advertising services in part 5, which are Google's and Meta's.

Where a provider is outside the European Economic Area, the transfer is covered either by an adequacy decision of the European Commission, which for the United States means a provider certified under the EU to US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses in the contract we have with them, with additional safeguards where the provider's own assessment calls for them. You can ask us which applies to a particular provider and we will tell you.

If you book one of the South African homes on /international, your information is handled in South Africa. See 1.3.

• Invoices, tax records and anything an auditor would need: ten years from the end of the tax year, because Portuguese tax law says so.
• The guest details reported under 4.1: only as long as the accommodation rules require, then deleted.
• Your booking record, correspondence and house-rules history: five years from the end of the stay. That is the ordinary limitation period for a civil claim in Portugal, so it is how long we might need to answer one.
• Enquiries that did not become bookings: two years from your last message, so that a returning enquiry does not have to start again.
• Mailing list sign-ups: until you unsubscribe, and then a permanent note of the address that unsubscribed, so that we do not email it again by accident.
• Property sale and long-term rental enquiries: five years, because transactions of that kind are slow and come back.
• Website analytics: for the period Squarespace's own retention settings allow, in a form that is about pages rather than people.
• Reviews: for as long as they are published, which is a matter for the platform you left them on.

A live dispute, claim or investigation freezes the clock on anything relevant to it until it is resolved.

9.1 What you can ask for

• A copy of what we hold about you, and an explanation of what we do with it.
• A correction, if something we hold is wrong or out of date.
• Deletion, where we no longer need it and no law requires us to keep it. Part 4.4 explains what survives a deletion request and why.
• A pause, if you dispute something we hold: we keep it but stop using it while the point is settled.
• A portable copy of what you gave us, in a machine-readable file, or sent straight to another provider where that is technically possible.
• An objection to anything we do on the basis of a legitimate interest. We stop unless we can show a compelling reason not to.
• An end to marketing, always, immediately, and with no reason needed. This one has no exceptions.
• Your consent back, at any time. Withdrawing it does not undo what was lawful before you withdrew it.

9.2 How to ask

Email info@olamadeira.pt. Tell us what you want and enough about yourself for us to find you, which for a past guest usually means the name and the dates of the stay. If we cannot tell who you are we will ask for something more, and only for that purpose. There is no charge. We answer within one month, and if a request is complicated enough to need longer we will tell you inside that month and explain why.

9.3 If we get it wrong

Tell us first, on the address above, and we will try to put it right. You do not have to: you can complain directly to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados, at www.cnpd.pt. If you live in another EU or EEA country you may complain to your own national authority instead.

This site is served over HTTPS, so what you send it is encrypted in transit. The booking system and the mailboxes are reached with individual accounts and two-factor authentication. Access is limited to the people who need it for the job in front of them, which for most of the team means a first name, a date and a door code and nothing else. Card details are handled by the payment provider and never touch our systems.

No system is perfectly safe, and anyone who tells you otherwise is selling something. If a breach ever put your rights or freedoms at real risk, we would tell the Comissão Nacional de Proteção de Dados within 72 hours of becoming aware of it and we would tell you, plainly, without waiting to be asked.

11.1 Children

This site is not aimed at children and we do not knowingly collect information from them. Children stay in our homes as part of a family booking, and what we hold about them is a first name and an age, given to us by the adult who booked. If you think we hold anything more than that about a child, email us and we will delete it.

11.2 Automated decisions

Nothing here decides anything about you automatically. Bookings, refunds and disputes are settled by a person. There is no profiling and no scoring.

11.3 Changes to this page

We update this policy when what we do changes. The date at the top of the page is the date of the current version. If a change materially affects you, for example a new purpose or a new recipient, we will say so on the site and, where we hold your address and the change warrants it, by email. Carrying on using the site after a change means the current version applies.