Privacy Policy

1) Data Controller (who is responsible)

2) What this policy covers

This policy covers personal data processed:

• when you browse our website,
• when you contact us (e.g., via forms/email/phone),
• when you check availability in our booking calendar and continue to our booking engine (AvaiBook) to book directly,
• when you book through third-party booking platforms linked from our website (e.g., Airbnb links shown on our site). (Crossdeira)

It also covers data we process to operate your stay (guest communications, concierge services, and legal compliance).

3) Where your data comes from

We obtain personal data from:

1. You (website forms, email, phone, messages).
2. Booking platforms (where you book via Airbnb or other booking sites): they share booking details needed to manage the stay. (Crossdeira)
3. Automatic collection on the website: technical server logs and, only if you consent, cookies and similar technologies for analytics and ad measurement (see Section 10).

4) What personal data we process

Depending on your interaction, we may process:

A. Enquiries and communication

• Name, email, phone number
• Message content and correspondence
• Dates / interests you share (e.g., preferred stay dates)

B. Bookings and guest management

• Booking reference, dates, number of guests, communication history
• Guest names and stay-related preferences (e.g., arrival times)

C. Concierge / experience requests

Information required to arrange services you request (e.g., private chef, tours, training sessions), potentially including preferences and dietary requirements (see Section 5 on sensitive data).

D. Website technical data

IP address, device/browser details, pages visited, timestamp, referral URL, and similar usage metrics.

Only with your consent: usage data collected by Google Analytics and ad measurement data collected by the OpenAI Ads pixel (details in Section 10).

Payments: We do not process card payments on our website. Payments are handled via the booking platforms you use (Section 7).

5) Special category data (sensitive data)

We do not request sensitive data (health data, etc.). If you voluntarily provide sensitive details (e.g., health-related accessibility or dietary needs), we will only use them to deliver the requested service and protect guests' interests, and we will minimise access and retention.

6) Why we process data and our legal bases (GDPR Art. 6)

We process personal data only where a lawful basis applies:

1. To respond to enquiries and manage pre-booking communications
   Legal basis: legitimate interests (Art. 6(1)(f)) and/or steps prior to contract (Art. 6(1)(b)).
2. To manage bookings and provide accommodation services (check-in/out coordination, guest support, concierge arrangements you request)
   Legal basis: performance of a contract (Art. 6(1)(b)).
3. To comply with legal obligations applicable to accommodation providers (including reporting obligations concerning foreign guests, where applicable)
   Legal basis: legal obligation (Art. 6(1)(c)). SIBA is described as a system supporting the legally required communication of accommodation of foreigners. (siba.ssi.gov.pt)
4. To protect our website, prevent fraud/abuse, and maintain security logs
   Legal basis: legitimate interests (Art. 6(1)(f)).
5. To measure and improve our website (Google Analytics)
   Legal basis: your consent (Art. 6(1)(a)). Storing and reading information on your device is also based on your consent under Art. 5(3) of the ePrivacy Directive 2002/58/EC, as implemented in Portugal by Art. 5 of Lei n.º 41/2004 (for users in Germany: § 25(1) TDDDG). See Section 10.
6. To measure whether our ads in ChatGPT lead visitors to our booking page (OpenAI Ads pixel)
   Legal basis: your consent (Art. 6(1)(a)), and for device access the same ePrivacy provisions as above. See Section 10.
7. To remember your cookie choice
   Legal basis: legal obligation to respect and be able to demonstrate your choice (Art. 6(1)(c) in conjunction with Art. 7(1)). This storage is strictly necessary and does not require consent.

7) Sharing data (recipients) and booking platforms

We share personal data only when necessary, with appropriate safeguards:

A. Booking platforms (separate controllers)

If you book via a third-party booking site (e.g., Airbnb), that platform processes your personal data under its own privacy policy and acts as an independent controller for its platform operations. We receive the booking details necessary to manage your stay. (Crossdeira)

B. Service providers acting on our instructions (processors)

• Website hosting / IT support / security providers (our website is hosted by Vercel Inc., USA)
• AvaiBook, the booking engine for direct bookings: when you continue from our availability calendar, your selected dates and number of guests are passed to AvaiBook's booking pages, where your booking is processed on our behalf
• Email and communications tools
• On-island operational support (e.g., cleaning, maintenance) strictly on a need-to-know basis
• Concierge partners you request (e.g., chefs, guides, trainers) only to fulfil your request

C. Professional advisors and authorities

• Accountants, auditors, legal counsel (confidentiality obligations)
• Competent authorities where required by law (see Section 8)

D. Analytics and advertising providers (only with your consent)

Google (Google Analytics) and OpenAI (OpenAI Ads pixel), see Section 10.

We do not sell personal data.

8) Legal compliance: reporting of foreign guests (Portugal – SIBA)

Where applicable, Portuguese accommodation providers have legal obligations connected to the communication of accommodation of foreign guests, supported by the SIBA system. (siba.ssi.gov.pt)

Data typically involved (depending on legal requirements and guest status):

• Full name, nationality, date and place of birth
• Identification document details (type/number, issuing country)
• Country and city of residence
• Check-in / check-out dates

Legal basis: legal obligation (GDPR Art. 6(1)(c)). (siba.ssi.gov.pt)

9) Data retention (how long we keep data)

We retain personal data only as long as necessary for the purposes described, then delete or anonymise it.

Typical retention periods:

• Enquiries (no booking): up to 24 months after last contact.
• Bookings / guest communications: typically up to 5 years after the stay (to handle disputes and legal claims).
• Accounting and tax records (invoices, supporting documents): generally 10 years, consistent with Portuguese requirements for keeping books/records and supporting documents. (diariodarepublica.pt)
• Security/technical logs: typically 6–12 months, unless needed for incident investigation.
• Your cookie choice: 12 months in your browser, after which we ask again.
• Google Analytics and OpenAI Ads pixel: see the storage periods in Section 10.

Where litigation, regulatory enquiries, or enforcement actions are reasonably anticipated, we may retain relevant data longer to establish, exercise, or defend legal claims.

10) Cookies, consent and tracking

10.1 Your choice

When you first visit our website, we ask for your consent in a banner. Google Analytics and the OpenAI Ads pixel are only loaded after you actively agree, either with "Accept" or by selecting them under "Settings". If you click "Reject" or make no choice, neither service is loaded and no cookies or identifiers are set for them. Refusing has no disadvantages: the website and booking work fully without them.

You can change or withdraw your consent at any time, with effect for the future, via "Cookie settings" at the bottom of every page or with this button:

Open cookie settings

When you withdraw consent, we delete the cookies these services set on our domain. Withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3) GDPR). We ask for your consent again after 12 months or when we add new services.

Legal basis: consent (Art. 6(1)(a) GDPR) and, for storing or reading information on your device, Art. 5(3) of the ePrivacy Directive 2002/58/EC as implemented by Art. 5 of Portuguese Lei n.º 41/2004 (for users in Germany: § 25(1) TDDDG).

10.2 Overview of cookies and similar technologies

Necessary storage is required to provide the website and to respect your choice, so it does not need consent (Art. 5(3) ePrivacy Directive, second sentence; § 25(2) No. 2 TDDDG). The duration of a cookie is not the same as the storage period of the data at the provider (see below).

10.3 Google Analytics 4 (category "Statistics")

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Purpose: to understand how visitors use our website (e.g., pages viewed, time on page, device and browser type, approximate location such as country or city, how you reached us) so we can improve it. The reports we see are aggregated; we do not identify individual visitors.

Privacy settings: Google states that Google Analytics 4 does not log or store IP addresses of users in the EU; the IP address is only used on servers in the EU to derive an approximate location and is then discarded. We have disabled Google signals and ad personalisation, and we do not grant consent for Google advertising purposes (ad storage, ad user data, ad personalisation).

Role and recipients: Google processes the data on our behalf as a processor (Art. 28 GDPR) under Google's data processing terms. Data may be transferred to Google LLC in the USA (see Section 11).

Storage period: event and user data in Google Analytics are automatically deleted after 2 months. The cookies are listed in 10.2.

More information: Google Privacy Policy, Google Analytics and EU data protection.

10.4 OpenAI Ads pixel (category "Marketing")

We advertise our villa with ads in ChatGPT. To measure whether these ads work, we use the OpenAI Ads pixel.

Provider: for users in the EEA and Switzerland, OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland ("OpenAI").

Purpose: measuring whether visitors who clicked one of our ads in ChatGPT continue from our availability calendar to our booking page ("checkout started" event). This helps us evaluate and optimise our advertising.

Data processed: the click ID from the ad link (URL parameter "oppref"), a random browser identifier, the page address without query parameters and the referring page, the type and time of the event, as well as your IP address and browser/device information, which are technically transmitted with every request. If you use ChatGPT in the same browser, OpenAI may be able to link the event to the ad you clicked in ChatGPT. We do not pass your name, email address or phone number to OpenAI.

Role and recipients: according to OpenAI's Ad Tools Data Processing Addendum, we and OpenAI each act as independent controllers for this processing. OpenAI processes the data under its own privacy policy and conversion terms. We only see aggregated statistics (e.g., number of conversions per campaign) and cannot identify you. Data may be transferred to OpenAI OpCo, LLC in the USA (see Section 11).

Storage period: the cookies are listed in 10.2. OpenAI stores the measurement data for as long as necessary for the purposes described in its terms; we have no influence on this period.

11) International transfers

Some service providers process data outside the EEA, in particular in the USA. We only allow this where an appropriate safeguard applies:

• Google LLC is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission's adequacy decision (EU) 2023/1795 (Art. 45 GDPR). In addition, Google's data processing terms include Standard Contractual Clauses.
• OpenAI: transfers from OpenAI Ireland Limited to OpenAI OpCo, LLC in the USA are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Hosting and other providers: adequacy decisions (including the EU-US Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses, plus supplementary measures where required.

You can request a copy of the relevant safeguards using the contact details in Section 1.

12) Your rights (GDPR)

Subject to legal conditions and exemptions, you can request:

• Access to your data
• Rectification
• Erasure
• Restriction
• Data portability (where applicable)
• Objection (especially to processing based on legitimate interests)
• Withdrawal of consent at any time, with effect for the future (for consent-based processing, e.g., via "Cookie settings" at the bottom of every page)

Right to object (Art. 21 GDPR): where we process data based on legitimate interests, you can object at any time on grounds relating to your particular situation.

We do not use automated decision-making, including profiling, that has legal or similarly significant effects on you (Art. 22 GDPR).

How to exercise rights: email hello@crossdeira.com. (Crossdeira)

We may request verification to prevent unauthorised access.

Right to lodge a complaint: You may complain to a supervisory authority, in particular in the EU member state where you live or work. Our lead supervisory authority is the CNPD (Comissão Nacional de Proteção de Dados), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt, geral@cnpd.pt.

13) Security

We implement reasonable technical and organisational measures to protect personal data, including access controls, least-privilege access, and operational security measures. No system is perfectly secure, but we work to reduce risk and respond to incidents appropriately.

14) Third-party links (Airbnb, Google, social media)

Our website includes links to third-party platforms (e.g., Airbnb booking links and Google review links). When you click those links, the third parties process your data under their own policies and terms. (Crossdeira)

15) Children

Our accommodation services are intended for adults. We do not knowingly collect personal data from children without appropriate parental authorisation where required.

16) Updates to this policy

We may update this Privacy Policy from time to time. The "Last updated" date indicates when changes were made. Material changes will be posted on the website.