1. Data Controller

Responsible for processing your personal data during your stay is:

• Name/Operator: Soul House GmbH & Co. KG Sucursal em Portugal
• Property Address: Rua da Fundação 2, 2520-124 Ferrel, Portugal
• Registration Number (AL): 169095
• Contact: [email protected], +351 961 749 016

2. Types of Data Collected

We only process personal data that is strictly necessary for booking management, secure payment processing, website optimization, and compliance with statutory obligations in Portugal:

• Full name, date of birth, gender, and nationality.
• Identification document number (passport or national ID card) and the country of issue.
• Period of stay.
• Payment details (payment status, anonymized transaction records).
• Website behavior (truncated/anonymized IP address, mouse movements, clicks, scrolling behavior via Mouseflow).

3. Purpose and Legal Basis

• Performance of a Contract (Art. 6(1)(b) GDPR): To manage your booking and provide the accommodation.
• Compliance with a Legal Obligation (Art. 6(1)(c) GDPR): Under Portuguese law ( Lei n.º 23/2007 ), we are legally required to report the data of all non-Portuguese guests to the Agência para a Integração, Migrações e Asilo (AIMA) within 3 business days. Additionally, anonymized statistics are shared with the National Institute of Statistics ( INE ), and invoicing details are transmitted to the Portuguese Tax Authority ( Autoridade Tributária e Aduaneira ).
• Consent (Art. 6(1)(a) GDPR): For the use of non-essential analytical cookies and user tracking (Mouseflow) on our direct booking website. You can withdraw this consent at any time via our cookie banner.
• Legitimate Interests (Art. 6(1)(f) GDPR): For fraud prevention, secure payment handling, and efficient accommodation management using specialized software tools.

4. Data Processing via Booking Platforms, Technical Tools, and Payment Services

To market our accommodation, process payments securely, and improve our online presence, we utilize external platforms and third-party service providers. The terms of these data processing activities are detailed below:

• Online Travel Agencies (OTAs): If you book through a third-party portal, that platform remains primarily responsible for your user account and its internal data processing. Once your booking data is transferred to us, we process it to fulfill the accommodation contract. For details, please consult their respective policies:
• Airbnb: Processed by Airbnb Ireland UC (Ireland). See the Airbnb Privacy Policy .
• Booking.com: Processed by Booking.com B.V. (Netherlands). See the Booking.com Privacy Notice .
• Vrbo: Processed by EG Vacation Rentals Ireland Limited (Ireland). See the Vrbo Privacy Statement .
• Channel Manager (Lodgify): To synchronize calendars and guest communications across channels, we use Lodgify ( Codebay Solutions S.L. , Spain). A legally compliant Data Processing Agreement (DPA) under Art. 28 GDPR is in place. See the Lodgify Privacy Policy .
• Payment Service Provider (Stripe): To process online payments securely (especially for direct bookings or security deposits), we use Stripe ( Stripe Payments Europe, Ltd. , Ireland). Your payment credentials (such as full credit card details) are handled directly by Stripe. We never have access to your full card information. Stripe acts as an independent controller to fulfill financial regulations and prevent fraud. See the Stripe Privacy Policy .
• Web Analytics Tool (Mouseflow): On our direct booking website, we use Mouseflow ( Mouseflow ApS , Flæsketorvet 68, 1711 Copenhagen, Denmark) to analyze and optimize user interactions.
• Mouseflow records randomly selected individual sessions using strictly anonymized IP addresses to track mouse movements, clicks, and scrolling actions.
• Keyboard entries in form fields are masked by default and never recorded. Identifying your individual identity is structurally impossible.
• This processing relies entirely on your voluntary Consent (Art. 6(1)(a) GDPR) granted via our cookie choice banner. A Data Processing Agreement (DPA) is established, and all data remains securely hosted within the European Union.
• For further details, consult the Mouseflow Privacy Policy . If you wish to block tracking across all websites using this tool, you can use the global Mouseflow Opt-Out .

5. Data Disclosure and Retention Period

Your personal data is treated with strict confidentiality. It will only be shared with the official Portuguese authorities mentioned above (AIMA, Finanças) to meet lawful mandates and with our technically required processing tools. Invoice and tax records are stored locally for up to 10 years in strict alignment with Portuguese tax statutory retention requirements.

6. Your Rights

Under the GDPR, you have the right to request access to, rectification, restriction, or deletion of your personal data, provided that no overriding statutory preservation and reporting duties apply. You also hold the right to lodge an official complaint with the national Portuguese Data Protection Authority: Comissão Nacional de Proteção de Dados (CNPD) , Av. Dom Carlos I, 134 - 1.º, 1200-651 Lisboa ( www.cnpd.pt ).