Privacy Policy

Information about the processing of personal data under Article 13 GDPR

Last updated: 20 April 2026

1. Introduction

This policy describes how José Viseu Carvalho & Filhos, Lda. (Casa de Santa Eufémia) collects and processes personal data of users of this website, in accordance with Regulation (EU) 2016/679 (GDPR) and Portuguese Law No. 58/2019.

2. Data controller

José Viseu Carvalho & Filhos, Lda., tax ID 502 955 210, registered at Parada do Bispo, 5100-650 Lamego, Portugal. Contact: casasantaeufemia@gmail.com · +351 254 331 820.

3. Data collected via the contact form

• Data processed: name, email address, selected subject and message content.
• Purpose: to respond to the request for information, visit booking or other enquiry submitted.
• Legal basis: steps taken at the data subject's request prior to entering into a contract (Art. 6(1)(b) GDPR) and/or legitimate interest in responding to commercial enquiries (Art. 6(1)(f)).
• Retention period: 24 months after the last contact, unless a commercial relationship is established, in which case applicable legal periods apply (e.g. tax — 10 years).

4. Data collected via analytics cookies (Google Analytics 4)

• Data processed: cookie identifiers, IP address (truncated / anonymised), pages visited, time on site, device and browser type, referrer.
• Purpose: aggregate statistical analysis of site usage to improve content and user experience.
• Legal basis: explicit consent of the data subject (Art. 6(1)(a) GDPR), obtained via the cookie banner. You may withdraw consent at any time on the Legal Information page.
• Retention period: 14 months (Google Analytics 4 configuration).

5. Recipients and processors

Your data may be shared with the following processors, always under a data processing agreement pursuant to Art. 28 GDPR:

• Supabase, Inc. — hosting of the database where contact form messages are stored.
• Resend, Inc. — delivery of the notification email to Casa de Santa Eufémia's inbox.
• Google Ireland Limited / Google LLC — provision of the Google Analytics 4 service (only activated with consent).

6. International transfers

Some processors (Google, Resend, Supabase) may transfer data outside the European Economic Area, namely to the United States. Such transfers are covered by the EU-U.S. Data Privacy Framework or by Standard Contractual Clauses approved by the European Commission, as applicable.

7. Data subject rights

Pursuant to Articles 15 to 22 GDPR, you have the following rights:

Access

obtain confirmation that your data is processed and access it.

Rectification

correct inaccurate or incomplete data.

Erasure (right to be forgotten)

request deletion of your data under the conditions set out by law.

Restriction of processing

in the situations provided for in Art. 18 GDPR.

Portability

receive your data in a structured format and transmit it to another controller.

Objection

object to processing based on legitimate interest.

Withdraw consent

at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, contact us at casasantaeufemia@gmail.com. We will respond within one month.

8. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD), located at Av. D. Carlos I, 134 — 1.º, 1200-651 Lisbon, via www.cnpd.pt.

9. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised destruction, loss, alteration, disclosure or access, including encrypted connections (HTTPS) and access controls.

10. Minors

This site is intended exclusively for persons aged 18 or over, as confirmed by the age verification step. We do not knowingly collect personal data from minors.

11. Changes to this policy

This policy may be updated to reflect legal or service changes. The current version is always available on this page, with the date of the last update.