Privacy Policy
1. Data controller
The controller of personal data collected through this website is [TO BE COMPLETED: legal name and tax number (NIPC) of the entity operating Quinta Ponte da Capinha], with registered office at [TO BE COMPLETED: registered office address].
Property address: Estrada Municipal do Salgueiro, Capinha, 6230-145 Fundão, Portugal. Tourism registration RNET 6004.
Privacy contact: julia@nomadlandgroup.com · +351 962 812 497. Data protection officer: [TO BE COMPLETED: name and contact of the data protection officer, if applicable].
2. What we collect and why
Accommodation booking: name, email address, phone number, stay dates, number of guests and any notes you send us. We use these to manage the booking, communicate with you and prepare your arrival.
Payment: card details are entered and handled directly by Stripe. We never receive or store card numbers. We keep only the payment session reference, amount and payment status.
Technical and browsing data: [TO BE COMPLETED: state which technical data is actually collected and retained (for example IP address, server logs, error logs) and for what purpose].
3. Legal basis
Performance of a contract (GDPR art. 6(1)(b)) to manage your booking and payment.
Legal obligation (art. 6(1)(c)) for tax, invoicing and guest registration duties in Portugal.
Legitimate interest (art. 6(1)(f)) in the security and operation of the website, as described in section 2 regarding technical data.
Consent (art. 6(1)(a)) when you contact us on your own initiative. [TO BE COMPLETED: state whether promotional messages will be sent and the consent mechanism used — the site currently offers no marketing sign-up].
4. Processors acting on our behalf
These providers process personal data on our instructions and under a data processing agreement.
Stripe — payment processing. [TO BE COMPLETED: the Stripe legal entity named in the contract and its country of establishment].
Supabase — hosting of the bookings database. [TO BE COMPLETED: hosting region of the Supabase project data and, if outside the EU, the applicable transfer mechanism].
Lovable — website hosting and delivery. [TO BE COMPLETED: hosting region and, if applicable, transfer mechanism].
Application error reporting: when an error occurs in your browser, the site sends the technical details of that error to Lovable, the platform hosting the site, for diagnosis. [TO BE COMPLETED: the data actually sent and the retention period].
[TO BE COMPLETED: any other processors used, for example property management software, accounting or email services].
We do not sell or share personal data with third parties for marketing purposes.
5. Third parties whose content the site loads
These providers do not process data on our behalf. When your browser fetches content from their servers, it contacts those servers directly, so they receive your IP address and other technical request data (such as browser type and referring page) and process it as controllers in their own right, under their own privacy policies.
Google Fonts (fonts.googleapis.com and fonts.gstatic.com) — the site's typefaces.
Google Maps — the location map shown in an iframe.
Google Search Console — the site carries an ownership verification tag; it loads no further content through it.
Squarespace CDN (images.squarespace-cdn.com) — gallery photographs.
[TO BE COMPLETED: legal basis adopted for these third-party loads and data destination; consider prior consent if so decided].
6. Retention periods
Booking data and invoicing documents: [TO BE COMPLETED: retention period for invoicing documents, to be confirmed with the accountant].
Enquiries with no booking attached: [TO BE COMPLETED: retention period defined for enquiries without a booking].
Technical website logs: [TO BE COMPLETED: retention period for technical logs].
7. Your rights
You may request access to, correction, erasure, restriction or portability of your data, and object to certain processing.
To exercise these rights, write to julia@nomadlandgroup.com. We reply within one month at the latest.
You also have the right to lodge a complaint with the Portuguese supervisory authority, CNPD (www.cnpd.pt).
8. Cookies and local storage
First-party cookie "tof_lang": stores only your language choice (value "pt" or "en"), so the page is served in the right language from the very first load. Duration: 1 year. It is strictly necessary for the operation of the site and is not used for analytics or advertising.
The same language value is also kept in your browser's local storage, for the same purpose. You can delete both at any time in your browser settings.
[TO BE COMPLETED: state any analytics or marketing cookies, should they be used, as well as any cookies set by the third-party services listed in sections 4 and 5].
9. Changes
This policy may be updated. The version in force is the one published on this page. Last updated: [TO BE COMPLETED: date of last update].