Legal
Privacy Policy
OesteGest complies with Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019 of 8 August, which implements the GDPR in national law, and respects the privacy of its clients, guests and visitors.
Última atualização · January 2026
1. Data controller
Alexandra Ramos Unipessoal, Lda (OesteGest), VAT/NIPC [to fill], registered office at Rua Ildo H. da Silva Marques, Loja 7, 2530-320 Lourinhã. Data protection contact: geral@oestegest.pt.
2. Data Protection Officer (DPO)
As OesteGest does not meet the criteria of art. 37 GDPR, it is not required to appoint a DPO. All data protection matters can be addressed to geral@oestegest.pt.
3. Data collected
We collect identification data (name, email, phone), booking data (dates, property, guests, messages) and, for foreign guests, ID data required for mandatory reporting to SEF/AIMA.
4. Purposes
(a) responding to enquiries; (b) booking management and confirmation; (c) invoicing and accounting; (d) compliance with legal obligations (tax, SEF/AIMA, guest registration); (e) communication with owners and guests; (f) marketing communications, only with prior consent.
5. Legal basis
Processing is based on contract performance (art. 6(1)(b) GDPR), legal obligations (c), explicit consent (a) or legitimate interest (f), depending on the purpose.
6. Reporting to SEF/AIMA
Under DL 128/2014 and Law 23/2007, identification of foreign guests is mandatorily reported to the Agency for Integration, Migration and Asylum (AIMA) via the SIBA accommodation reporting system, within 3 business days after check-in.
7. Recipients and processors
Data may be shared with processors for technical services (web hosting, booking management, invoicing, payment platforms) and with public authorities when required by law (SEF/AIMA, Tax Authority). All processors comply with GDPR.
8. International transfers
Where processors operate outside the EEA, transfers rely on EU standard contractual clauses or other adequate safeguards under Chapter V GDPR.
9. Retention periods
Booking and invoicing data: 10 years (tax). SEF/AIMA accommodation reports: 1 year. Contact data and enquiries without booking: up to 2 years. Data based on consent: until consent is withdrawn.
10. Rights of data subjects
You may exercise the rights of access, rectification, erasure, restriction, objection, portability and consent withdrawal by contacting geral@oestegest.pt. We reply within 30 days.
11. Security measures
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction (TLS encryption, access controls, backups, training).
12. Complaints
Without prejudice to any other remedy, you may lodge a complaint with the Portuguese Data Protection Authority (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon · geral@cnpd.pt · www.cnpd.pt.