1. Controller and Contact
The controller responsible for the processing of personal data on this website is:
Frank Wöller
Rua Direita do Pico de Mafra 16
9555-170 Mosteiros, São Miguel, Azores, Portugal
Email: contact@azores-woeller.com
If you have any questions about this Privacy Policy or the processing of your personal data, you can contact us at any time using the email address above.
2. Scope of this Privacy Policy
This Privacy Policy explains how we process personal data when you visit our website, contact us, make a booking enquiry or stay at Casa de Sonho as a guest. It applies to the website located at https://azores-woeller.com and to related communication by email.
3. Categories of Data We Process
We may process the following types of personal data:
Website usage data, such as the date and time of access, pages viewed and technical information about your device and browser. This information is typically collected in server log files for security and technical reasons. Contact data, such as your name, email address and any information you provide when you contact us by email or through a contact form. Booking and stay data, such as travel dates, number of guests, your preferences, and information necessary to manage your booking and your stay at Casa de Sonho. Identification data required under Portuguese law for guest registration (for example name, date of birth, nationality, document type and number). Payment-related information, to the extent necessary to process deposits and final payments. Detailed payment data may be processed by payment service providers on their own responsibility.
4. Purposes and Legal Bases of Processing
We process personal data only where permitted by applicable data protection law, in particular the EU General Data Protection Regulation (GDPR).
Contract performance: We process data to answer booking enquiries, confirm reservations and to provide our accommodation services. The legal basis is Article 6(1)(b) GDPR (performance of a contract or steps prior to entering into a contract). Legal obligations: We are required by Portuguese law to register guests with the competent authorities (Alojamento Local and AIMA/SEF regulations) and to keep certain records for tax and accounting purposes. The legal basis is Article 6(1)(c) GDPR (legal obligation). Legitimate interests: We may process data for the operation, security and optimisation of our website, for prevention of misuse and for the assertion or defence of legal claims. The legal basis is Article 6(1)(f) GDPR (legitimate interests). Consent: Insofar as we ask for your consent, for example for certain types of cookies or for receiving optional information by email, the legal basis is Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future.
5. Hosting and Server Log Files
Our website is hosted by Netlify, Inc., 512 2nd Street, San Francisco, CA 94107, USA (“Netlify”). When you visit the website, Netlify automatically collects certain information on our behalf in server log files. This may include the IP address of your device, the date and time of access, the URL accessed, the referring URL and basic technical information about your browser and operating system.
This data is processed to ensure the technical operation and security of the website. The legal basis is our legitimate interest in operating a secure and stable website in accordance with Article 6(1)(f) GDPR. Netlify acts as our processor (Article 28 GDPR). Log files are stored only for a limited period and then deleted or anonymised. For transfers to the USA, see section 11.
6. Contact and Booking Enquiries
If you contact us by email or send us a booking enquiry, we process the personal data you provide, such as your name, email address, the content of your message and any booking details. We use this information to respond to your request and, where applicable, to prepare or manage a booking.
The legal basis for this processing is Article 6(1)(b) GDPR where the enquiry relates to a booking or your stay, and Article 6(1)(f) GDPR where we process enquiries for general communication and service purposes. We store such correspondence for as long as it is necessary for the processing of your request and in line with statutory retention obligations.
Technically, the forms on this website are handled through our hosting provider Netlify: your entries are stored there on our behalf (form submissions and an internal, access-protected record of submissions). To send confirmation and notification emails we use Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA (“Resend”), which processes the email content for this purpose on our behalf (Article 28 GDPR). For transfers to the USA, see section 11.
7. Guest Registration and Legal Requirements in Portugal
As an Alojamento Local accommodation provider in Portugal, we are legally obliged to collect certain data from our guests and to report them to the competent authorities (for example for the purpose of guest registration and public security). This may include identification data such as full name, date of birth, nationality and passport or ID document information.
The processing and transmission of this data is based on legal obligations under Portuguese law in conjunction with Article 6(1)(c) GDPR. We retain this information only for as long as required by applicable legal obligations.
8. Cookies and Local Storage
This website does not use cookies and does not use any tracking. There are no analytics, statistics or marketing services.
Only the password-protected guest area stores — if you enter the password there yourself — this password in your browser's sessionStorage, so that you do not have to re-enter it while browsing. This storage is necessary for the service you have expressly requested and is automatically deleted when you close the browser tab.
9. Embedded Content from External Providers
The “The house” page embeds a map from OpenStreetMap (OpenStreetMap Foundation, St John's Innovation Centre, Cambridge, United Kingdom). When the map loads, your IP address is transmitted to OpenStreetMap. The legal basis is our legitimate interest in providing a clear presentation of the location (Article 6(1)(f) GDPR).
The password-protected guest area contains a video hosted on Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); when you play it, your IP address is transmitted to Google. We also link to WhatsApp in several places — these are plain links: only once you click them and use WhatsApp do WhatsApp's privacy terms apply (Meta Platforms Ireland Limited).
10. Recipients of Personal Data
We only share personal data with third parties where this is necessary, legally permitted and appropriate.
Specifically, these are: Netlify (hosting and storage of form submissions, see sections 5 and 6), Resend (email delivery, see section 6), our tax advisor (who receives the guest registration data for accounting and tax reporting), our email provider for the mailbox contact@azores-woeller.com and, in the context of the statutory guest registration, the competent Portuguese authorities (AIMA/SIBA).
These recipients may act as processors according to our instructions (Article 28 GDPR) or as independent controllers where they determine the purposes and means of the processing themselves.
11. Data Transfers Outside the European Economic Area
Our service providers Netlify and Resend are based in the USA; when you use the website and its forms, personal data is therefore transferred to the USA. These transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework and on the EU standard contractual clauses which form part of these providers' data processing agreements.
You can contact us for further information on any specific transfers and the safeguards used.
12. Storage Periods
We store personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by applicable legal retention periods.
Specifically, we apply the following periods: enquiries that do not result in a booking are deleted no later than two years after the last contact. Guest registration data (ID document details) is deleted no later than one year after departure, unless longer statutory obligations apply. Booking and accounting records are retained for the duration of the statutory tax retention periods (up to ten years in Portugal). Log files and technical data are kept for a much shorter period unless they are needed longer for security or evidential purposes.
13. Your Rights
Under the GDPR, you have the following rights in relation to your personal data:
The right of access to your personal data and to receive a copy of the data we hold about you. The right to rectification of inaccurate or incomplete data. The right to erasure (“right to be forgotten”), subject to legal retention obligations. The right to restriction of processing under certain conditions. The right to data portability, where applicable. The right to object to processing based on legitimate interests, including profiling, on grounds relating to your particular situation.
Where processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise your rights, please contact us at contact@azores-woeller.com.
14. Right to Lodge a Complaint
If you believe that the processing of your personal data infringes data protection law, you also have the right to lodge a complaint with a supervisory authority. In Portugal, the competent authority is the Comissão Nacional de Proteção de Dados (CNPD).
You remain free to contact the supervisory authority in your place of residence or workplace, or the authority competent for the place of the alleged infringement.
15. Data Security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Nevertheless, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example to reflect changes in legal requirements or in the way we operate our website and services. The current version is always available on this page.
This Privacy Policy was last updated in July 2026.