Privacy, Cookies
& Terms

Data controller

Who we are

Horas Enigmáticas, Unipessoal, Lda. (corporate tax number 516 947 753), based at Av. Amália Rodrigues, n.º 18, 3.º Dt.º, 2650-437 Amadora, telephone +351 934 014 280 and email geral@beachfront.pt, owner of the BeachFront Living brand, is the controller of personal data collected on beachfront.pt and in bookings made with us, under Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019 of 8 August. For partner-managed apartments, the property manager identified on the apartment page also controls the data needed to provide accommodation and invoice the stay and final cleaning. Additional services (extras) are invoiced by Horas Enigmáticas, Unipessoal, Lda.

Data protection

Data protection officer

We have not appointed a data protection officer because we are not required to do so under Article 37 GDPR: our main activity does not involve large-scale regular and systematic monitoring of individuals or large-scale processing of special categories of data.

For questions about your personal data or to exercise your rights, write to geral@beachfront.pt, with “Data protection” in the subject line.

01

Data we process

• Identification and contact — name, email, phone and country of residence.
• Booking details — apartment, dates, guest numbers, expected arrival time, special requests and additional services.
• Access to your booking area — the booking reference and email used to verify your identity, personal links and access sessions (stored only in protected form), and security records needed to prevent unauthorised access. Once access is verified, you can view bookings made with the same email. These data are retained only while access remains valid, up to 30 days after departure.
• Special requests — we do not request health or other sensitive data. If you provide them in a special request, such as an allergy or accessibility need, we use them only to fulfil that request.
• Guest registration — for foreign guests, only identity document data legally required to report accommodation to the authorities. The partner managing the apartment requests these during online check-in.
• Payment — for card payments, card data stays with Stripe and is never stored by us; we retain only the payment reference and status. For bank transfers, we retain the transfer details for accounting purposes.
• Invoicing — name, tax number (if provided) and amounts charged.
• Enquiries — the contents of messages you send us, including via WhatsApp.
• Reviews — the rating and text you send after your stay, with the first name and country you provide.
• Technical records — when you visit the site, the hosting server (Hostinger) automatically records IP address, date and time, requested page and browser type to ensure security and operation.
• Country of access — at checkout, “Country of residence” is suggested from the country you access the site from, inferred from the IP address by Cloudflare or, if unavailable, browser language. This is only an editable suggestion and is not stored; only the residence country you confirm when booking is recorded.
• Browsing — IP address, browser type and pages visited, through analytics cookies, only with your consent.
• Accompanying guests — when booking for others, you provide guest numbers and, where necessary, names. You must inform them that their data is processed under this policy.
• Minors — bookings are made by adults over 18 under the Booking Conditions. For minors staying in the accommodation, we process only numbers and ages for the booking and, for foreign guests, data legally required for guest registration.

Identification, contact and booking data are necessary to enter into and fulfil the contract: without them, the booking cannot be completed. We do not make solely automated decisions, including profiling, producing legal effects on you.

02

Purposes and legal bases

• Manage your booking and stay (confirmation, payment, communication before and during your stay) — performance of a contract (Article 6(1)(b) GDPR).
• Enable and protect booking access — verification of email and reference, issuing and renewing personal links and creating temporary sessions to fulfil the contract (Article 6(1)(b)); limiting attempts and preventing unauthorised access based on the legitimate interest in service security (point (f)).
• Invoicing, tax obligations and guest reporting to authorities — compliance with legal obligations (Article 6(1)(c)).
• Respond to enquiries — pre-contractual steps at your request (point (b)) or legitimate interest in responding to contacts (point (f)).
• Email offers to customers — if you have booked with us, we may email offers and news about BeachFront Living stays based on our legitimate interest (point (f)) and Article 13-A(3) of Portuguese Law 41/2004. You can opt out when booking and in each email using the unsubscribe link, free of charge. Partner offers are sent only with your consent.
• Review request — after your stay, we email a review link based on our legitimate interest in guests’ opinions (point (f)). You can ask us not to send further requests.
• Publication of reviews — reviews help others understand the experience of staying at the apartment. After review, they are published on the apartment page with first name, country and month of stay; email is never published. The basis is the consent given on submission (point (a)). You can withdraw it at any time by requesting removal at geral@beachfront.pt.
• Special requests containing health data — solely to fulfil your request, based on the explicit consent you give by providing them (Article 9(2)(a)).
• Fraud prevention, security and operation of the site and payments, including server technical logs — legitimate interest (point (f)).
• Suggested residence country at checkout, based on access country — legitimate interest in making booking easier (point (f)).
• Website usage analysis and campaign measurement — consent (point (a)), withdrawable at any time.

03

Recipients

We share data only with entities necessary for the purposes above, acting as processors under data processing agreements or as independent controllers where required by law:

• Apartment property managers — the entity managing the booked apartment, always identified in that apartment’s booking conditions (currently UniversePoint, Lda. — Bedzy). Receives booking data to prepare and manage the stay: online check-in, arrival and departure instructions, cleaning, assistance, guest reporting and accommodation invoicing. For these purposes, it acts as a data controller.
• Partner accommodation owners — when the manager acts for the Local Accommodation Registration holder, the accommodation invoice is issued in that holder’s name, using the necessary booking data.
• Beds24 — booking management system used by property managers, storing booking and guest data. The site queries it for availability and prices. Privacy policy.
• Stripe — payment processing. Card details are entered directly into Stripe and remain there. For fraud prevention, Stripe also collects IP address and device data as a controller. Privacy policy.
• TOConline — invoicing. Privacy policy.
• Hostinger — website and email hosting, including server technical logs. Privacy policy.
• Cloudflare — content delivery and security network through which all site access passes. Receives IP addresses and request details (page, browser, date and time) to secure encryption, accelerate loading and protect against attacks and abusive automated access through rate limiting and bot detection. It also supplies access country to suggest residence country at checkout. Browsers may send technical connection-failure reports without page content. Acts as a processor. Privacy policy.
• Email delivery platform (for example Mailchimp) — sending email offers to customers. Mailchimp (Intuit) privacy policy.
• WhatsApp — when you contact us on WhatsApp, messages pass through WhatsApp servers. Privacy policy.
• OpenStreetMap — the apartment search map loads from OpenStreetMap Foundation servers, which receive your IP address. Privacy policy.
• Google — analytics, advertising and location map (Google Maps), only with consent. Privacy policy.
• Insurers — in case of a claim, the data necessary to report and resolve it.
• Public authorities — the Portuguese Tax and Customs Authority and competent foreign guest registration authorities where legally required. Foreign guests, including EU citizens, are reported through SIBA within three working days under Articles 15 and 16 of Portuguese Law 23/2007 of 4 July. The apartment manager makes this report.
• Meta (Facebook and Instagram) — measuring and displaying adverts, only with advertising consent. Privacy policy. Data sent to Meta only with advertising consent: pages viewed, a browser identifier (_fbp cookie) and, on completed bookings, the amount paid, booking reference and hashed (SHA-256) email, phone, name and country (advanced matching), to measure ad results. With automatic advanced matching, Meta may also receive, hashed, the name, email and phone number entered in the site’s forms, even before a booking is completed. You can withdraw consent at any time under “Cookie settings”.

We do not sell personal data or share it for third parties’ own commercial purposes.

04

Transfers outside the European Economic Area

Some providers (such as Cloudflare, Stripe, Google, Meta, WhatsApp and the email platform) may process data in the United States. Transfers then rely on the EU–US Data Privacy Framework for certified entities or European Commission-approved standard contractual clauses. You can request information about these safeguards using the contacts below.

05

Data retention

• Bookings and stays — during the contractual relationship and until applicable limitation periods expire.
• Personal links and booking sessions — for the periods under “Your booking: access and security”.
• Invoices and accounting documents — for the legally required tax retention period (usually 10 years).
• Guest registration — for the period required by applicable law.
• Enquiries without a booking — 1 year after last contact.
• Reviews — while published or until removal is requested.
• Email offers — up to 3 years after the last stay, or until you opt out if sooner.
• Server technical logs — for the short period needed for security and diagnosis, set by the hosting provider.
• Cloudflare security and network logs — for the short period set by Cloudflare for service security and diagnosis.
• Browsing data — according to Google Analytics settings (maximum 14 months).

After these periods, data is deleted or anonymised.

06

Data security

• The website uses an encrypted connection (HTTPS).
• Cloudflare protects the website against attacks and abusive automated access.
• Personal data access is restricted to people who need it to handle your booking.
• Card details are entered directly into Stripe and are never stored by us.

07

Your booking: access and security

• The confirmation email includes your public booking reference and a personal access link. You can also use “Your booking” with the email used for booking and the public reference.
• The link is personal and must remain confidential. You can request a new link by email; earlier links for the same booking remain valid. Each link is valid until 30 days after check-out.
• Each validated access opens a temporary 30-minute session. To prevent unauthorised access, failed attempts are limited and logged only as long as needed for temporary blocking.
• Link and session codes are not stored in readable form: the database retains only their hashes. The session cookie is HttpOnly, Secure and SameSite=Lax, and errors do not reveal whether the email or reference exists.

08

Your rights

You have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent at any time without affecting earlier processing. To exercise these rights, contact geral@beachfront.pt. We respond within one month.

You can also complain to the Portuguese Data Protection Authority (CNPD).

09

Changes to this policy

This Privacy Policy may be revised or updated. The current version is available on this page with its last update date; we recommend checking it regularly. Changes respect data subjects’ rights. If we process data for a new purpose, we will inform you first and seek consent where required.

10

Contact