Privacy Policy
At Boa Vibra we respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and Portuguese law.
1. Data Controller
Titular: Laura Aragonés Maigí
Email: [email protected]
Address: Cabo da Vila nº 61, Santa Cruz - Lagoa.
2. Data we collect
We collect only the data necessary to provide our services efficiently and securely:
- Name and surname
- Email and phone number
- Payment data (processed securely via Stripe or another platform)
- Guest identification documents for mandatory registration with the competent authorities
- Booking information (dates, number of guests, preferences)
- Messages sent via the contact form or WhatsApp
- Cookies and browsing data (see Cookies Policy)
3. Purpose of processing
We use your data to:
- Manage bookings and payments
- Respond to your enquiries
- Comply with legal obligations (invoicing, guest registration)
- Improve our services and user experience
4. Legal basis
Processing your data is based on:
- Performance of a contract (booking)
- Explicit consent (where applicable)
- Compliance with legal obligations
- Legitimate interest of the owner for accommodation management, communication with guests, and fraud prevention
5. Data retention
Your personal data is retained only for as long as necessary to:
- Comply with legal and tax obligations: 10 years (according to IRS/IRC Code)
- Manage bookings and services provided: up to 2 years after the end of the stay
- Ensure security and prevent fraud: up to 5 years
After these periods, data will be deleted or anonymised
6. Sharing with third parties
Data may be shared with booking platforms, PMS, and payment processors, all compliant with GDPR through standard contractual clauses:
- Booking platforms and PMS (Airbnb, Lodgify)
- Payment processors (Stripe, banks)
- Public authorities when required by law (SIBA, SREA)
We never sell your data to third parties.
7. Security
We implement technical and organisational measures to protect your data against unauthorised access, loss, or improper disclosure.
8. User rights
You may exercise, free of charge, the following rights:
- Right of access
- Right to rectification
- Right to erasure (right to be forgotten)
- Right to object
- Right to data portability
- Right to restrict processing
o exercise any of these rights, contact us at [email protected].
Responses will be provided within a maximum of 1 month, according to GDPR.
9. International transfers
International transfers, when necessary, are conducted based on EU Standard Contractual Clauses or approved equivalent mechanisms.
10. Cookies and tracking
The use of cookies and analytics tools is detailed in the Cookies Policy, available on this website.
11. Changes to the privacy policy
This Privacy Policy may be updated at any time.
The current version will always be available on this page and dated 28/01/2026.