1. Controller and Contact
The controller responsible for the processing of personal data on this website is:
Frank Wöller
Rua Direita do Pico de Mafra 16
9555-131 Mosteiros, São Miguel, Azores, Portugal
Email: contact@azores-woeller.com
If you have any questions about this Privacy Policy or the processing of your personal data, you can contact us at any time using the email address above.
2. Scope of this Privacy Policy
This Privacy Policy explains how we process personal data when you visit our website, contact us, make a booking enquiry or stay at Casa de Sonho as a guest. It applies to the website located at https://azores-woeller.com and to related communication by email.
3. Categories of Data We Process
We may process the following types of personal data:
Website usage data, such as the date and time of access, pages viewed and technical information about your device and browser. This information is typically collected in server log files for security and technical reasons. Contact data, such as your name, email address and any information you provide when you contact us by email or through a contact form. Booking and stay data, such as travel dates, number of guests, your preferences, and information necessary to manage your booking and your stay at Casa de Sonho. Identification data required under Portuguese law for guest registration (for example name, date of birth, nationality, document type and number). Payment-related information, to the extent necessary to process deposits and final payments. Detailed payment data may be processed by payment service providers on their own responsibility.
4. Purposes and Legal Bases of Processing
We process personal data only where permitted by applicable data protection law, in particular the EU General Data Protection Regulation (GDPR).
Contract performance: We process data to answer booking enquiries, confirm reservations and to provide our accommodation services. The legal basis is Article 6(1)(b) GDPR (performance of a contract or steps prior to entering into a contract). Legal obligations: We are required by Portuguese law to register guests with the competent authorities (Alojamento Local and AIMA/SEF regulations) and to keep certain records for tax and accounting purposes. The legal basis is Article 6(1)(c) GDPR (legal obligation). Legitimate interests: We may process data for the operation, security and optimisation of our website, for prevention of misuse and for the assertion or defence of legal claims. The legal basis is Article 6(1)(f) GDPR (legitimate interests). Consent: Insofar as we ask for your consent, for example for certain types of cookies or for receiving optional information by email, the legal basis is Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future.
5. Server Log Files
When you visit our website, the server automatically collects certain information and stores it in log files. This may include the IP address of your device, the date and time of access, the URL accessed, the referring URL and basic technical information about your browser and operating system.
This data is processed to ensure the technical operation and security of the website. The legal basis is our legitimate interest in operating a secure and stable website in accordance with Article 6(1)(f) GDPR. Log files are usually stored only for a limited period and then deleted or anonymised.
6. Contact and Booking Enquiries
If you contact us by email or send us a booking enquiry, we process the personal data you provide, such as your name, email address, the content of your message and any booking details. We use this information to respond to your request and, where applicable, to prepare or manage a booking.
The legal basis for this processing is Article 6(1)(b) GDPR where the enquiry relates to a booking or your stay, and Article 6(1)(f) GDPR where we process enquiries for general communication and service purposes. We store such correspondence for as long as it is necessary for the processing of your request and in line with statutory retention obligations.
7. Guest Registration and Legal Requirements in Portugal
As an Alojamento Local accommodation provider in Portugal, we are legally obliged to collect certain data from our guests and to report them to the competent authorities (for example for the purpose of guest registration and public security). This may include identification data such as full name, date of birth, nationality and passport or ID document information.
The processing and transmission of this data is based on legal obligations under Portuguese law in conjunction with Article 6(1)(c) GDPR. We retain this information only for as long as required by applicable legal obligations.
8. Cookies and Similar Technologies
Our website may use cookies and similar technologies to enable basic functions, to improve user experience or to collect statistics about the use of the website.
Essential cookies are necessary to operate the website and are processed on the basis of our legitimate interests under Article 6(1)(f) GDPR. Where cookies are used for statistical or marketing purposes and are not strictly necessary, we rely on your consent in accordance with Article 6(1)(a) GDPR. You can manage cookies through your browser settings and, where applicable, through cookie controls provided on our website.
9. Analytics and Third-Party Services
If we use web analytics tools or third-party services (for example for aggregated visitor statistics), these services may process pseudonymous usage data. Wherever possible, we configure such services in a privacy-friendly way, for example by shortening IP addresses and disabling unnecessary tracking functions.
Where such processing is not strictly necessary, it takes place on the basis of your consent under Article 6(1)(a) GDPR. Further details on any third-party services used, the data processed and the applicable legal bases can be provided on request.
10. Recipients of Personal Data
We only share personal data with third parties where this is necessary, legally permitted and appropriate.
Typical recipients include IT and hosting providers who operate our website on our behalf, professional service providers such as accountants, tax advisors or legal advisors, payment service providers and, where required, public authorities and bodies in fulfilment of legal obligations.
These recipients may act as processors according to our instructions (Article 28 GDPR) or as independent controllers where they determine the purposes and means of the processing themselves.
11. Data Transfers Outside the European Economic Area
As a rule, we aim to process personal data within the European Economic Area (EEA). If, in individual cases, data is transferred to countries outside the EEA, this will take place only where an adequate level of data protection is ensured, for example through an adequacy decision of the European Commission or through appropriate safeguards such as standard contractual clauses.
You can contact us for further information on any specific transfers and the safeguards used.
12. Storage Periods
We store personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by applicable legal retention periods.
Booking and contract-related data are generally retained for the duration of the contractual relationship and thereafter in accordance with statutory retention obligations under tax and commercial law. Log files and technical data are kept for a shorter period unless they are needed longer for security or evidential purposes.
13. Your Rights
Under the GDPR, you have the following rights in relation to your personal data:
The right of access to your personal data and to receive a copy of the data we hold about you. The right to rectification of inaccurate or incomplete data. The right to erasure (“right to be forgotten”), subject to legal retention obligations. The right to restriction of processing under certain conditions. The right to data portability, where applicable. The right to object to processing based on legitimate interests, including profiling, on grounds relating to your particular situation.
Where processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise your rights, please contact us at contact@azores-woeller.com.
14. Right to Lodge a Complaint
If you believe that the processing of your personal data infringes data protection law, you also have the right to lodge a complaint with a supervisory authority. In Portugal, the competent authority is the Comissão Nacional de Proteção de Dados (CNPD).
You remain free to contact the supervisory authority in your place of residence or workplace, or the authority competent for the place of the alleged infringement.
15. Data Security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Nevertheless, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example to reflect changes in legal requirements or in the way we operate our website and services. The current version is always available on this page.
This Privacy Policy was last updated in November 2025.