Privacy Policy

Luna Stays PT ("we", "us") respects your privacy. This policy explains what personal data we collect when you use lunastayspt.com, book a stay, or engage our property management services, and how we handle it under Regulation (EU) 2016/679 (GDPR) and Portuguese Law no. 58/2019 of 8 August.

1. Data controller

Luna Stays PT — NIF 297866753, Portimão, Algarve, Portugal.
Email: ola@lunastayspt.com · Telephone: +351 915 007 559

We are not required to appoint a Data Protection Officer, but all privacy enquiries are handled at the address above.

2. Data we collect

Guests: name, email, telephone, country of residence, stay dates, number of guests, selected extras, messages you send us, and — where legally required — identification details of all guests for the mandatory SEF/AIMA foreign-guest declaration (boletim de alojamento).
Payment data: processed directly by Stripe. We receive only a transaction reference, amount, status and the last four digits / card brand. We never store full card numbers.
Property owners: contact details, property address and AL licence number, banking details for payouts, and accounting records required for tax reporting.
Technical data: IP address, browser type, pages visited and basic usage statistics generated when you visit the site.

3. Why we use it and on what legal basis

Performance of a contract (Art. 6(1)(b)): to take and manage your booking, arrange check-in, cleaning and extras, and to deliver management services to owners.
Legal obligation (Art. 6(1)(c)): guest registration with the immigration authority (SEF/AIMA), municipal tourist tax reporting for Portimão, invoicing and the retention of accounting records under Portuguese tax law.
Legitimate interests (Art. 6(1)(f)): securing our site and properties, preventing fraud, resolving disputes and improving our services.
Consent (Art. 6(1)(a)): optional marketing emails and any non-essential cookies. You may withdraw consent at any time.

4. Who we share data with

We share data only as far as necessary with: our channel and booking system (Smoobu) and the listing platforms it connects to; Stripe Payments Europe for payment processing; our email delivery provider; our hosting and database provider; cleaning, maintenance and accounting partners engaged for your stay or property; and Portuguese public authorities (AIMA/SEF, Autoridade Tributária, Câmara Municipal de Portimão) where the law requires it. All processors act on written instructions under Art. 28 GDPR.

5. International transfers

Some providers may process data outside the European Economic Area. In those cases transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

Booking and guest records: 5 years after the stay.
Invoices and accounting records: 10 years, as required by Portuguese tax law.
Enquiries that do not lead to a booking: 12 months.
Marketing consents: until you unsubscribe.

7. Your rights

You have the right to access, rectify, erase, restrict or object to the processing of your data, to data portability, and to withdraw consent. Write to ola@lunastayspt.com and we will respond within 30 days. If you are not satisfied, you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, www.cnpd.pt.

8. Cookies

We use strictly necessary cookies to keep the site and your booking session working. Any analytics or marketing cookies are only set with your consent, and you can clear or block cookies in your browser at any time.

9. Security

Data is transmitted over encrypted connections and stored in access-controlled systems. Payment card data never touches our servers. If a breach occurs that presents a risk to your rights, we will notify the CNPD within 72 hours and inform you where required.

10. Changes

We may update this policy; the revision date above always shows the current version.