Website and Guest Privacy Notice

Caravelis Solutions, Lda (‘Caravelis’, ‘we’, ‘us’ or ‘our’) operates licensed holiday accommodation in Armação de Pêra, Portugal and provides this website, direct-booking service and guest portal. Our NIPC is 518462200. Our registered office is Rua das Caravelas, 7, Edifício Marany, 8365-116 Armação de Pêra, Silves, Portugal. You can contact us at contact@caravelis.net or +351 961 405 002.

Caravelis is the controller of personal data processed for direct bookings and stays. A booking platform may be a separate controller where a reservation is made through that platform.

This notice covers website visitors, people making enquiries, direct and platform guests, lead and accompanying guests, guest-portal users, newsletter subscribers, chatbot users and people who begin but do not complete a direct checkout.

Depending on how you interact with us, we collect information directly from you, from the lead guest, from booking platforms and property-management providers, from payment and authentication providers, and automatically from your device where permitted.

• identity and contact details;
• property, stay dates, guest numbers, preferences, messages and booking references;
• payment status, transaction references, refunds and fraud-prevention signals, but not complete card details;
• guest-registration and identity-verification data required for lawful accommodation reporting and secure self-check-in;
• enquiry, support, complaint, chatbot and correspondence records;
• newsletter preferences and consent evidence;
• device, browser, IP address, security logs, cookie choices and consented analytics data;
• photographs or content you choose to submit through an enabled guest feature.

• We take steps at your request and perform the accommodation contract, including booking, payment, check-in, support and stay administration.
• We comply with Portuguese accommodation-reporting, accounting, tax, consumer and regulatory duties.
• We pursue legitimate interests in service security, fraud prevention, property protection, complaint handling and establishing or defending legal claims, where those interests are not overridden by your rights.
• We use consent for optional analytics, marketing and other optional processing where consent is required.

Where information is legally required for guest registration or necessary to provide the booked stay, we may be unable to complete check-in if it is not supplied.

We use booking and payment records to form and perform the contract, reconcile payments, issue confirmations, administer changes, cancellations and refunds, and retain evidence of the terms accepted. Card payments are processed by Stripe. Caravelis receives payment status and transaction references but does not receive your complete card number.

Portuguese law requires accommodation providers to register foreign guests. For secure self-check-in we may also verify identity before releasing access details. Please use the secure pre-arrival portal and do not send passports or identity cards by ordinary email, chat, SMS or WhatsApp unless we agree an exceptional safe method.

Essential storage supports language choice, security, authentication, booking sessions and your consent choice. Optional analytics, session replay or marketing technologies remain disabled until the required consent is given. The Cookie and Similar Technologies Policy identifies the current technologies, purposes and durations.

Google Sign-In is optional and does not create a booking. For guests, the Google email address must match an eligible existing booking. We receive the profile information needed to authenticate the account and record security evidence such as first linkage and latest successful sign-in. The available booking-reference access method remains available.

If you use the chatbot or an AI-assisted feature, your message and relevant service context may be sent to configured technology providers to produce a response. Do not enter passport images, payment-card details, door codes or other highly sensitive information in free-text chat. AI output may be inaccurate and must not be relied upon for emergencies, legal advice or final booking terms.

We use enquiry and support details to answer you. We may retain a limited incomplete-checkout record for security, troubleshooting and, where lawfully permitted, a service reminder. Operational booking, safety, check-in and payment messages are not marketing messages.

We send optional newsletters and direct marketing only where a lawful basis permits. Signup records may include email, name, optional birth month, source and campaign information, consent wording and confirmation evidence. You can unsubscribe at any time using the message link or by contacting us. Unsubscribing does not affect essential booking communications.

We disclose data only as needed. Core technology may include Uplisting for property and booking management, MongoDB for data storage, Cloudinary for media and private agreement storage, Stripe for payments, Google for optional authentication and analytics, PostHog for consented product analytics, Sentry for security and error monitoring, Cloudflare for delivery and security, email providers, and configured AI providers. Booking platforms may act as independent controllers. Cleaners, maintenance partners, professional advisers, insurers and public authorities receive only what is needed for their role.

Some providers may process data outside Portugal or the European Economic Area. Where required, we rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. Provider privacy information gives further details of processing locations and safeguards.

• enquiries: 12 months after last contact;
• incomplete checkouts: 30 days;
• booking, invoice and accounting records: 10 years, removing non-essential data earlier where practicable;
• SIBA guest-registration data held by Caravelis: one year after departure;
• identity-document images: after verification and no later than 30 days after checkout, unless an incident or legal hold applies;
• security and login logs: 12 months;
• chatbot transcripts: 12 months;
• marketing-consent evidence: while subscribed and for three years after withdrawal or unsubscribe;
• cookie choices and consent evidence: 24 months.

When a period expires, data is deleted or irreversibly anonymised unless a documented legal hold applies.

We use organisational and technical safeguards appropriate to the information and risk, including restricted administrative access and security logging. No internet service is completely secure. Please tell us promptly if you believe your booking or portal access has been compromised.

Bookings must be made by an adult with legal capacity. We process children’s information only where included in a booking and necessary to provide the stay or meet legal obligations. The lead guest must provide accompanying-guest information lawfully and explain this notice where appropriate.

We do not currently make decisions producing legal or similarly significant effects about guests solely by automated means. Security, fraud and analytics tools may create risk or usage signals, but material booking decisions are subject to appropriate human review.

Subject to legal limits, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time without affecting earlier lawful processing. You may object to direct marketing at any time. Send requests to contact@caravelis.net. We may need proportionate information to verify your identity.

You may complain to the Portuguese data-protection authority, the Comissão Nacional de Proteção de Dados, at https://www.cnpd.pt/cidadaos/participacoes/.

We may update this notice when services, providers or legal obligations change. The version and effective date appear with the document. A material change will trigger a new immutable version and, where required, renewed notice or consent.