Privacy Policy

How we handle your personal data.

Last updated: 7 August 2026.

Data we collect

When you send an availability request, we collect the information you provide in the form: name, email address, check-in and checkout dates, number and type of guests, message, and the technical anti-spam field used by the booking endpoint.

When you subscribe to updates, we collect your email address and the information needed to demonstrate your choice, including the signup source, confirmation time and consent wording version. Subscription is completed only after you confirm through the email sent to you.

If you contact us by WhatsApp or email, we receive the contact details and message content you choose to send through those services.

We use Plausible Analytics to collect aggregate website statistics without cookies. Google Analytics 4 and Microsoft Clarity are not contacted or loaded unless you consent to analytics. After consent, Google Analytics measures pseudonymous sessions and conversions, and Microsoft Clarity provides heatmaps and reconstructions of website interactions. Forms, email addresses, messages and booking details are explicitly masked from Clarity.

Why we use it

• To answer availability, price and booking enquiries.
• To manage direct booking communications before and after a stay.
• To send confirmed subscribers weekly Vilamoura guides and occasional availability alerts.
• To prevent spam and keep the website secure.
• To remember privacy choices on this website.
• To understand traffic sources, navigation, clicks, scroll and where the website can improve direct booking enquiries.

Legal bases

We process booking enquiries because it is necessary to respond to your request before entering into a possible booking contract. Newsletter messages, Google Analytics, Microsoft Clarity and the embedded Google Map rely on your consent. We use anti-spam, security processing and cookie-free aggregate Plausible statistics based on our legitimate interest in operating and improving the website. Essential browser storage is used to remember your choices and avoid repeatedly showing the same prompts.

Service providers

The website is hosted by Cloudflare Pages, and booking, availability and subscription requests are processed by Cloudflare Pages Functions. Newsletter contacts, confirmation messages and booking-request delivery are managed by Brevo. Availability data may be checked through a private Airbnb calendar feed. Website analytics are provided by Plausible Analytics and, only after analytics consent, Google Analytics 4 and Microsoft Clarity. If you choose to load the embedded map, Google Maps may receive technical information such as your IP address and browser details. If you use WhatsApp, Facebook, Instagram, Google Maps or email links, those services process your data under their own policies.

Retention

Booking request data is kept for up to 24 months, unless a longer period is required to manage an active booking, comply with legal obligations, resolve disputes or protect legal claims. Newsletter data is kept while you remain subscribed; after unsubscribe, a minimal suppression record may be retained to prevent further messages. Privacy choices are stored for up to six months and a dismissed newsletter invitation for up to 30 days. User and event data in Google Analytics is configured for 14 months. Clarity playback data is normally retained for 30 days and heatmap or click data for up to nine months.

Your rights

Under the GDPR, you may request access, rectification, erasure, restriction, portability or objection where applicable. You may withdraw newsletter consent through the unsubscribe link in every message. You may withdraw consent for optional analytics and external services at any time through the privacy choices link in the site footer.

You can contact us at hello@penomargolfe.com. You also have the right to lodge a complaint with the Portuguese data protection authority, CNPD.

International transfers

Some providers, including Cloudflare, Google, Microsoft, Meta, WhatsApp, Airbnb, Plausible Analytics or Brevo, may process data outside the European Economic Area or use international support infrastructure. Where applicable, those providers are responsible for using appropriate transfer mechanisms for their processing.